Packet capture method and device, storage medium and program product

Abstract

The embodiment of the invention provides a packet capturing method and device, a storage medium and a program product. Network processing of network data in a first network protocol stack in a kernel is unloaded to a first network card of a network device. The method comprises the steps that first network data are stored in a first storage address in a sending buffer area in a kernel, a first data structural body corresponding to the first network data is created, a pointer in the first data structural body points to the first storage address, and the first data structural body is a data structural body adopted when network data are stored under a second network protocol stack. And sending the first data structure body to a virtual second network card to trigger to send a copy of the first data structure body to a packet capture interface created by a network data packet capture program. Through the scheme, the packet capturing path of a traditional packet capturing mechanism can be reused, and low-cost and convenient packet capturing is realized.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a packet capture method, device, storage medium and program product. Background Art

[0002] Data capture refers to the process of collecting and recording network data such as data packets or data streams during network transmission. This process is usually used in many fields such as network monitoring, performance analysis, and security auditing.

[0003] Data capture is also commonly referred to as packet capture. Currently, there is a mature packet capture mechanism in some operating system kernels: user-mode packet capture applications can capture data packets at the data link layer through a specific type of Socket interface, such as the AF_PACKETSocket interface. Specifically, the user-mode packet capture application can register the receiving callback function of the AF_PACKET Socket interface with the operating system kernel. When the network device sends or receives network data, the network protocol stack in its operating system kernel will trigger this callback function, notifying the user-mode packet capture application to obtain a copy of the network data on this AF_PACKET Socket interface, thereby completing the network data capture on the network device.

[0004] However, this mature packet capture mechanism in the above operating system kernel requires: 1) The network protocol stack uses the skb (short for struct sk_buff) data structure to describe network data. Although it is applicable to most network protocol stacks, it is not applicable to network protocols that use other methods to store network data, such as shared memory communication protocol stacks; 2) The network protocol stack's processing of data packets entering and leaving network devices (such as encapsulation and decapsulation processing, etc.) needs to be performed in the operating system kernel.

[0005] Based on this, if the network protocol stack running in the operating system kernel does not meet the above two conditions, it means that the above mature packet capture mechanism cannot be used directly to capture network data. If a new packet capture mechanism suitable for the currently running network protocol stack is developed, it will cost more. Therefore, how to reuse the traditional mature packet capture mechanism in the new network protocol stack to complete the network data capture in the new network protocol stack in a lower cost and more convenient way is an urgent problem to be solved. Summary of the invention

[0006] The embodiments of the present application provide a packet capture method, device, storage medium and program product, which are used to implement packet capture of user-mode applications by reusing the packet capture mechanism of another network protocol stack (such as a TCP protocol stack, etc.) in the operating system kernel when a certain network protocol stack (such as a shared memory communication protocol stack) is currently running in the operating system kernel.

[0007] In a first aspect, an embodiment of the present application provides a packet capture method, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing, and the method includes: In response to the network data sending program sending the first network data, storing the first network data in a first storage address in a sending buffer created in the operating system kernel; Creating a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack; The first data structure is sent to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure, and the second network card is a virtual network card set in the network device.

[0008] In a second aspect, an embodiment of the present application provides a packet capture device, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein the network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing, and the device includes: A storage module, configured to store the first network data to a first storage address in a sending buffer created in an operating system kernel in response to the network data sending program sending the first network data; A creation module, used to create a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack; A sending module is used to send the first data structure to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the first data structure. The second network card is a virtual network card set in the network device.

[0009] In a third aspect, an embodiment of the present application provides a packet capture method, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing, and the method includes: Acquire network data sent by the communication peer network device from the target storage address in the receiving buffer created in the operating system kernel, wherein the first network card decapsulates the encapsulated network data sent by the communication peer network device after receiving the encapsulated network data to obtain the network data, and stores the network data in the target storage address; Creating a data structure corresponding to the network data, wherein the data structure includes a pointer to the target storage address, and the data structure is a data structure used when storing network data under the second network protocol stack; The data structure is sent to a second network card to trigger sending a copy of the data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the network data based on the copy of the data structure. The second network card is a virtual network card set in the network device.

[0010] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a communication component; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the packet capture method described in the first aspect and the third aspect.

[0011] In the fifth aspect, an embodiment of the present application provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the packet capture method described in the first aspect and the third aspect.

[0012] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it can implement the packet capture method described in the first aspect and the third aspect.

[0013] In the packet capture solution provided in the embodiment of the present application, it is assumed that the first network protocol stack is currently running in the operating system kernel of the network device, the network processing of network data in the first network protocol stack (including encapsulation processing and decapsulation processing) is unloaded to the first network card of the network device, and the first network protocol stack does not use the skb data structure to store network data. In addition, it is assumed that the second network protocol stack uses the skb data structure to store network data, and the network processing of network data is implemented in the operating system kernel. Based on this, in the case of the above-mentioned first network protocol stack, the user-mode network data packet capture program can complete the capture of network data in the following way: In response to the network data sending program sending the first network data, the first network data is stored in a first storage address in a sending buffer created in the operating system kernel, and the first network data is sent to the first network card, so that the first network data is encapsulated and processed by the first network card and the encapsulated first network data is sent to the communication peer network device; A first data structure (first sbk) corresponding to the first network data is created, wherein the first data structure includes a pointer to a first storage address, and the first data structure is sent to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure, and the second network card is a virtual network card set in the network device.

[0014] In the above scheme, by constructing the first skb pointing to the first network data required for reusing the traditional packet capture mechanism in the operating system kernel, the packet capture point is triggered by sending it to the specified virtual network card, so that the packet capture program can capture the first network data on the virtual network card. Under this scheme, the communication scenario of the first network protocol stack can reuse the kernel packet capture mechanism, user state library and tools in the traditional second network protocol stack communication scenario, and have similar performance overhead, realizing low-cost and convenient network data capture in the first network protocol stack scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1a It is a schematic diagram of a traditional packet capture mechanism; Figure 1b It is a schematic diagram of the principle of network data storage based on skb data structure; Figure 2 A flowchart of a packet capture method provided in an embodiment of the present application; Figure 3 A schematic diagram of a packet capture mechanism provided in an embodiment of the present application; Figure 4 A flowchart of a packet capture method provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of a packet capture device provided in an embodiment of the present application; Figure 6 A schematic diagram of the structure of an electronic device provided in this embodiment. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. In addition, the step timing in the following method embodiments is only an example, not a strict limitation.

[0018] It should be noted that, in the case of user information involved in the embodiments of this application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to large language models or other models) are in compliance with relevant laws and standards.

[0019] First, the terms involved in the embodiments of the present application are explained.

[0020] Data capture: Data capture refers to the process of collecting and recording network data such as data packets or data streams during network transmission.

[0021] tcpdump: is a network packet capture tool that can capture and analyze network traffic in real time in the command line. tcpdump allows users to display packet contents in text form and select and display specific packets based on user-defined filtering conditions. It is an important tool for network fault diagnosis and traffic analysis.

[0022] libpcap: libpcap is a C language library for capturing network data. It provides a set of application programming interfaces (APIs) to access network data streams at the data link layer. libpcap supports network interfaces on different platforms and is often used to develop network monitoring, analysis, and security tools, including tcpdump.

[0023] Transmission Control Protocol: TCP is a connection-oriented transport layer protocol widely used in the Internet and computer networks. Its main features include reliability, connection orientation, orderliness, and flow control. User Datagram Protocol: (UDP) is a connectionless transport layer protocol, mainly used for fast data transmission. Its characteristics are connectionlessness, unreliability and fast transmission rate.

[0024] Address Resolution Protocol (ARP) is a network transmission protocol that finds data link layer addresses by resolving network layer addresses.

[0025] Internet Control Message Protocol (ICMP) is a sub-protocol of the TCP / IP protocol suite, used to transmit control messages between hosts and routers.

[0026] Socket: It is the basic concept and interface used to realize communication between different hosts in computer network programming. It is an abstract data structure through which the application can send requests to the network protocol stack to realize data sending and receiving.

[0027] Shared Memory Communication (SMC) network protocol: is a high-performance kernel network protocol. The SMC protocol transparently transmits the network data of TCP socket in the form of shared memory access, providing a high-throughput, low-latency, and low-overhead network. In practical applications, the SMC protocol can be further divided into SMC over DMA (SMC-D) and SMC over RDMA (SMC-R) based on Remote Direct Memory Access (RDMA) technology.

[0028] Dummy Device: A virtual interface that does not correspond to any physical hardware and is used for testing or development purposes. It can simulate network behavior without relying on real network hardware and is often used to quickly and easily implement data transmission testing or functional verification during development. The virtual device in the embodiment of the present application may be a virtual network card.

[0029] Send buffer (sndbuf): It is a buffer used by the SMC protocol stack to cache network data to be sent, located in the operating system kernel. The user-mode network data sending program can store the network data to be sent in this buffer through socket system calls such as send(), waiting for the network adapter to send it.

[0030] Remote Memory Buffer (RMB): A buffer in the SMC protocol stack used to store network data to be received. The network adapter stores the received network data in this buffer and notifies the user-mode network data receiving program to use the socket system call such as recv() to receive the network data.

[0031] Remote Direct Memory Access (RDMA) is a technology that allows one computer to directly access the memory of another computer without the intervention of the operating system. It is mainly used for data transmission in high-speed networks.

[0032] Berkeley Packet Filter (BPF): Originally designed for network packet filtering, it provides an efficient, low-overhead network packet filtering mechanism for the operating system. Over time, the application and functionality of BPF have been significantly expanded, and it is now commonly used in monitoring, troubleshooting, security analysis and other fields.

[0033] Let's combine Figure 1a , introduces a traditional kernel packet capture mechanism that can be applied to network protocol stacks such as TCP, UDP, ARP, ICMP, etc. In Figure 1, the TCP / IP network protocol stack is used as an example for explanation, and the same is true for other network protocol stacks.

[0034] exist Figure 1aA pair of communication devices is illustrated in FIG. 1 : a sending device and a receiving device. The user-state application for sending network data in the sending device is named a network data sending program, and the user-state application for receiving network data in the receiving device is named a network data receiving program. The user-state applications for capturing network data in the two devices are named network data packet capture programs. In practical applications, the network data packet capture program can be a tcpdump tool.

[0035] In order to realize the sending of network data, the network data sending program can create a Socket interface for sending network data, such as the AF_INET Socket interface illustrated in the figure, but not limited thereto. Similarly, in order to realize the reception of network data, the network data receiving program can create a Socket interface for receiving network data, such as the AF_INET Socket interface illustrated in the figure, but not limited thereto. Moreover, in order to realize the capture of network data, the network data packet capture program of the transmitting end device and the receiving end device can create a Socket interface for capturing network data, such as the AF_PACKET Socket interface illustrated in the figure, but not limited thereto. Specifically, the network data packet capture program can complete the creation of the AF_PACKET Socket interface based on, for example, the libpcap function library.

[0036] The network data sending, receiving and capturing process is as follows: On the premise that the network protocol stacks running in the operating system kernels of the sending device and the receiving device are both TCP / IP network protocol stacks, first, the sending device and the receiving device complete the establishment of a TCP connection through a handshake negotiation process. Specifically, the TCP connection is established at both ends of the AF_INET Socket interface created by the network data sending program and the network data receiving program. Afterwards, the network data sending program passes certain network data (as the payload of the encapsulated data packet) to the operating system kernel through the AF_INET Socket interface through the set system call.

[0037] Afterwards, the TCP / IP network protocol stack in the operating system kernel creates an skb data structure to describe the network data. Specifically, Figure 1bAs shown, the TCP / IP network protocol stack will open up two memory spaces in the memory space of the operating system kernel: memory space a and memory space b, where memory space a is used to store the skb data structure, and memory space b is used for the linear data area corresponding to the skb data structure, which stores the above-mentioned network data and various packet headers added when the network data is subsequently encapsulated and processed. Among them, what is actually stored in skb are some pointers (such as pointer 1-pointer m shown in the figure), pointing to different parts of the data packet stored in memory space b. The data packet will contain various packet headers and the above-mentioned network data as payload. It should be noted that the kernel memory space occupied by the above-mentioned linear data area is often relatively small, which means that the amount of network data that can be stored is relatively small. When the amount of data packets to be transmitted exceeds its storage upper limit, a non-linear data area can be created on demand. The non-linear data area will occupy another non-continuous memory space c. Figure 1b It is not shown in the figure. In general, multiple element (flag) pointers are stored in the nonlinear data area, and different element pointers point to the kernel memory storage addresses (often pointing to different memory pages) that store different parts of the data packet. It can be seen that through the pointers in the skb data structure and the pointers pointed to by the pointers contained therein, a complete data packet can be found, and the header and payload parts of the data packet can be located. Moreover, the description of network data by the skb data structure mainly refers to: describing the header and other additional information of the network data through a pointer pointing to the corresponding linear data area, or it can also describe the data content itself as the network data (payload), or describing the memory storage address of the network data (payload) in the kernel through a pointer in the nonlinear data area.

[0038] The TCP / IP network protocol stack then performs layer-by-layer network processing on the network data, such as adding a TCP header, an IP header, and a data link layer header in front of the network data. After encapsulation of these headers, the encapsulated network data (i.e., a complete data packet) is obtained, and the different pointers in the skb data structure are pointed to the corresponding storage addresses. For example, some pointers directly point to the corresponding parts in the linear data area, and some pointers point to the element pointers corresponding to the non-linear data area, so as to point to the storage address where the network data is actually stored through these element pointers.

[0039] After that, the TCP / IP network protocol stack will call the network card driver to send the data packet to the network card (NIC), and transmit it to the receiving device through the network card. On the other hand, the TCP / IP network protocol stack calls the packet capture function (dev_queue_xmit_nit()) of the sending direction shown in the figure in its code call stack for sending network data. Through this function, the skb data structure will be copied, and the receiving callback function of the AF_PACKET socket interface will be called to receive this skb data structure. Therefore, the network data packet capture program can capture the complete data packet (encapsulated network data) that the sending device wants to send through this network card from the operating system kernel based on the skb data structure. Similarly, after the network card of the receiving device receives the above data packet, on the one hand, the network card driver stores the data packet in the skb data structure created by the network card driver. After that, the TCP network protocol stack decapsulates the data packet layer by layer in the kernel, and sends the above network data (payload) obtained after decapsulation to the AF_INET Socket interface, so that the network data receiving program can obtain the network data. On the other hand, the TCP / IP network protocol stack is triggered to call the packet capture function (netif_receive_skb_core()) of the receiving direction shown in the figure in its code call stack for receiving network data. Through this function, the skb data structure constructed by the network card driver is copied, and the receiving callback function of the AF_PACKET socket interface is called to receive this skb data structure. Therefore, the network data packet capture program can capture the encapsulated network data received by the receiving device from the network card (that is, the data packet sent by the sending device) from the operating system kernel based on the skb data structure.

[0040] It should be noted that on the sending device side, the packet capture point (dev_queue_xmit_nit() function) is executed after the network data is encapsulated, that is, after the encapsulation of the data link layer is completed. Therefore, the network data packet capture program on the sending end captures the encapsulated network data. On the receiving device side, the packet capture point (__netif_receive_skb_core() function) is executed after receiving the encapsulated network data, that is, before the decapsulation of the data link layer. Therefore, the network data packet capture program on the receiving end also captures the encapsulated network data containing complete header information.

[0041] From the above introduction, we can know that the network protocol stack to which the above packet capture mechanism is applicable uses the skb data structure to complete the storage of network data, and the encapsulation and decapsulation of network data are all implemented by the network protocol stack in the operating system kernel. This will restrict the wide applicability of the packet capture mechanism: when a network protocol stack does not use the skb data structure to store network data (such as the SMC protocol stack), and the network processing of network data does not need to be completed in the operating system kernel (such as the network protocol based on RDMA technology to offload network processing to hardware devices), the above packet capture mechanism will not be directly reused.

[0042] In view of this, an embodiment of the present application introduces a method for reusing the above-mentioned traditional packet capture mechanism, that is, reusing the packet capture path, to achieve a low-cost and convenient network data capture solution when the network protocol stack running in the operating system kernel does not use the skb data structure to store network data, and the network processing of the network data is not performed in the operating system kernel, but the network processing is offloaded to the hardware network card of the network device for execution.

[0043] In the following, some embodiments of the present application are described in detail in conjunction with the accompanying drawings. In the case where there is no conflict between the embodiments, the following embodiments and features in the embodiments can be combined with each other.

[0044] Figure 2 A flowchart of a packet capture method provided in an embodiment of the present application, the method is executed by a first network protocol stack in an operating system kernel of a network device, wherein the network processing of network data in the first network protocol stack is offloaded to a first network card of the network device. Figure 2 As shown, the method comprises the following steps: 201. In response to a network data sending program sending first network data, store the first network data in a first storage address in a sending buffer created in an operating system kernel.

[0045] 202. Create a first data structure corresponding to the first network data, wherein the first data structure includes a pointer pointing to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack.

[0046] 203. Send the first data structure to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0047] The network device in the embodiments of the present application can be any computer device with network communication function, including but not limited to user terminal equipment, servers, routers, gateways, switches and other devices.

[0048] Optionally, the first network protocol stack in the embodiment of the present application may be, for example, an SMC protocol stack, and the SMC protocol stack adopts the following method for storing network data: a sending buffer (sndbuf) is used to store network data to be sent, and a receiving buffer (RMB) is used to store received network data, and neither of them adopts an skb data structure to describe network data. Further optionally, the first network protocol stack may be an SMC-R protocol stack based on RDMA technology that offloads network processing such as encapsulation and decapsulation of network data to a hardware network card (the first network card mentioned above). Of course, it is understandable that in actual applications, there are many network protocol stacks that do not use skb data structures and offload network processing such as encapsulation and decapsulation of network data to hardware units in network devices such as hardware network cards, and are not limited to the SMC series of network protocol stacks.

[0049] The following description is made by taking the first network protocol stack as an SMC protocol stack (specifically, an SMC-R protocol stack) as an example. The SMC protocol stack works in the kernel space of the operating system.

[0050] In order to implement this embodiment, first, a virtual hardware device, the second network card (a virtual network card), needs to be set in the network device, and the physical hardware network card originally on the network device is called the first network card. Specifically, the operation and maintenance personnel can create the second network card in the user state space through the corresponding network operation and maintenance tools, and then notify the SMC protocol stack of the second network card used for packet capture through the netlink interface (not limited to this) provided by the SMC protocol stack, and monitor the network data passing through the second network card through network data capture programs such as tcpdump, such as creating an AF_PACKET Socket interface, so that the network data capture program monitors the network data of the second network card through the interface to achieve packet capture.

[0051] In addition, the SMC protocol stack uses the send buffer (sndbuf) and the receive buffer (RMB) to store network data. Therefore, the SMC protocol stack can create these two buffers in advance, that is, set these two buffers in the memory space of the operating system kernel.

[0052] Combine the following Figure 3 To illustrate the execution process of the above embodiment. Figure 3 In order to more intuitively illustrate the process of sending and receiving network data, two network devices, a sending device and a receiving device, are illustrated. Figure 2 The network device in the illustrated embodiment may be Figure 3The sending device in the network device, of course, actually the network device also has the function of a receiving device.

[0053] refer to Figure 1a In the example, similarly, Figure 3 As shown in , the sending end device includes a user-state network data sending program and a network data packet capture program, and the receiving end device includes a user-state network data receiving program and a network data packet capture program. Among them, for the same network device with sending and receiving functions, the above two network data packet capture programs are actually the same.

[0054] For network data capture programs, such as Figure 3 As shown, similarly, the creation of the AF_PACKET Socket interface can be completed based on the libpcap function library to implement the packet capture function through the interface. However, since the network protocol stack running in the operating system kernel of the network device is already the SMC protocol stack, the data transmission interface between the network data sending program and the network data receiving program and the operating system kernel is no longer the AF_INET Socket interface corresponding to the second network protocol stack (such as the TCP / IP protocol stack), but rather the AF_INET Socket interface corresponding to the second network protocol stack (such as the TCP / IP protocol stack). Figure 3 The AF_SMC Socket interface shown in Figure 1.

[0055] At this time, the sending process and capturing process of the first network data (network data currently sent by the sending end device) are as follows: First, the sending device and the receiving device complete the establishment of a TCP connection, and then detect whether the other party supports the SMC protocol stack during the three-way handshake negotiation of the TCP connection. If supported, the SMC protocol stacks at both ends exchange SMC connection establishment messages and RDMA resources through the TCP connection to establish an SMC connection, which uses the RDMA link to transmit network data at both ends.

[0056] In the process of establishing an SMC connection, the SMC protocol stack creates a send buffer and a receive buffer, that is, Figure 3 The creation of SMC sndbuf and SMC RMB is shown in the figure. Figure 3 In the figure, only SMC sndbuf is indicated in the sending device but not SMC RMB, and only SMC RMB is indicated in the receiving device but not SMC sndbuf.

[0057] Afterwards, the network data sending program transmits the first network data (as the payload of the encapsulated data packet) to the operating system kernel through the AF_SMC Socket interface through the set system call, and the SMC protocol stack stores the first network data to the first storage address in the SMC sndbuf. Figure 3 In FIG. 1 , the black block indicates the first network data.

[0058] Afterwards, the SMC protocol stack creates a first skb data structure for describing the first network data, and makes the pointer in the first skb data structure point to the first storage address. Generally speaking, under the SMC protocol stack, the amount of data in the data packet is often relatively large, and the linear data area created synchronously with the first skb data structure is difficult to accommodate, so the creation of multiple element pointers pointing to the above-mentioned first storage address will be stored through the non-linear data area, wherein it can be understood that the first storage address is actually a section of kernel memory space, that is, corresponding to a section of storage address in the send buffer, often corresponding to multiple memory pages, and different element pointers point to different memory page addresses.

[0059] In addition, the SMC protocol stack can also perform relevant construction processing for the first skb data structure created. Optionally, the header information of different network layers corresponding to the first skb data structure is determined to record the identification information of the current sending device and the receiving device of the communication counterpart. Specifically, the first skb data structure can be constructed as a UDP skb, that is, the UDP header (including port information) and IP header corresponding to the current sending device and the receiving device are added to the linear data area corresponding to the first skb data structure to record the IP, port and other identification information of the two ends of the shared memory (i.e., the sending device and the receiving device). In this way, based on the filling of the UDP header, the data packet will be parsed into a UDP message later. The reason why it is constructed as a UDP message is because of the natural advantages of the UDP message. Of course, it is not limited to this, and it can also be constructed as other types of messages.

[0060] In addition, optionally, the SMC protocol stack can also determine the header information of the SMC protocol stack corresponding to the first skb data structure. Specifically, it can add the header information related to the SMC protocol stack in the linear data area corresponding to the first skb data structure, such as the header indicating the SMC protocol stack type and other information, so that the network data packet capture program can successfully complete the parsing of the first skb data structure based on the header information.

[0061] In addition, optionally, the SMC protocol stack can also determine the identification information corresponding to the second network card corresponding to the first skb data structure. Specifically, the identification information of the second network card can be added to the linear data area or non-linear data area corresponding to the first skb data structure, so as to send the first skb data structure to the second network card based on the identification information of the second network card.

[0062] Afterwards, on one hand, the SMC protocol stack in the operating system kernel triggers, for example, an RDMA write operation, so that the first network card reads the first network data from the first storage address. Based on the RDMA write operation triggered by the SMC protocol stack, the SMC protocol stack actually implements the transmission of the first network data to the first network card ( Figure 3 RNIC illustrated in the figure), specifically, the first network card reads the first network data from the first storage address in the sending buffer according to the relevant information in the write operation. Since the network processing of the network data has been unloaded to the first network card, the first network card will encapsulate the first network data, and then send the encapsulated first network data to the receiving device. As described above, the encapsulation process may include the encapsulation of the transport layer header, IP network layer header, data link layer header, etc. adapted to the SMC protocol stack. Through these encapsulation processes, the encapsulated first network data is finally obtained as a complete data packet.

[0063] Moreover, the SMC protocol stack will call the driver of the second network card to send the first skb data structure (such as UDPskb) to the second network card ( Figure 3 At the same time, in the code call stack that sends the first skb data structure, call Figure 3 The packet capture function (dev_queue_xmit_nit()) shown in the figure is used to copy the first skb data structure (such as UDP skb) through the function, and the receiving callback function of the AF_PACKET socket interface is called to receive the copy of the first skb data structure. Thus, the network data packet capture program can capture the first network data sent by the sending end device from the operating system kernel based on the pointer information in the copy of the first skb data structure, and can understand the relevant communication information based on the various header information added in the copy of the first skb data structure: such as the IP address and port information corresponding to the first network data. It should be noted that after receiving the first skb data structure, the second network card does not perform any processing, but only silently releases the memory space occupied by the first skb data structure. Because the purpose of sending the first skb data structure to the second network card is to trigger the execution of the packet capture point (the above-mentioned packet capture function) in the sending direction, so as to adapt to the packet capture path of the packet capture point in the sending direction when the skb data structure is sent to the network card under the traditional packet capture mechanism.

[0064] Through the above process, the first network data sending and capturing process of the sending end device is completed. Due to the design of the first skb data structure, the created first skb data structure only contains a pointer to the first network data currently required to be sent in the sending buffer and related packet header information. When copying the first skb data structure, no new memory space will be created and the first network data in the sending buffer will be copied. The pointer in the copied first skb data structure also points to the above first storage address, so the overhead is very small.

[0065] Moreover, in the case of the SMC protocol stack, the packet capture tools (network data packet capture program), function libraries, interfaces, etc. in the traditional packet capture mechanism are reused, and the packet capture path based on the skb data structure is reused, so that the network data can be captured more conveniently with lower cost under the SMC protocol stack.

[0066] Figure 4 A flowchart of a packet capture method provided in an embodiment of the present application, the method is executed by a first network protocol stack in an operating system kernel of a network device, wherein the network processing of network data in the first network protocol stack is offloaded to a first network card of the network device. Figure 4 As shown, the method comprises the following steps: 401. Obtain second network data sent by a communication peer network device from a second storage address in a receiving buffer created in an operating system kernel, wherein the first network card decapsulates the encapsulated second network data sent by the communication peer network device after receiving the encapsulated second network data to obtain the second network data, and stores the second network data in the second storage address.

[0067] 402. Send the second network data to the network data receiving program.

[0068] 403. Create a second data structure corresponding to the second network data. The second data structure includes a pointer to the second storage address. The second data structure is a data structure used when storing network data under the second network protocol stack.

[0069] 404. Send the second data structure to the second network card to trigger sending a copy of the second data structure to the packet capture interface, so that the network data packet capture program obtains the second network data based on the copy of the second data structure.

[0070] The following is still combined Figure 3 To illustrate the execution process of the above embodiment. Figure 4 The network device in the illustrated embodiment may be Figure 3In order to facilitate the description of the network data receiving process and the packet capture process in the receiving direction, it is assumed that the receiving device receives the encapsulated second network data from the sending device. In fact, the sending process of the second network data can refer to the relevant description in the above embodiment, which is not repeated here.

[0071] On the receiving device side, Figure 3 After the first network card (RNIC) shown in the figure receives the encapsulated second network data, the RNIC performs corresponding decapsulation processing to obtain the second network data, and stores the second network data in the SMC RMB pre-created by the SMC protocol stack, specifically in the second storage address.

[0072] Afterwards, the SMC protocol stack creates a second skb data structure corresponding to the second network data, and points the pointer in the second skb data structure to the second storage address.

[0073] Similar to the sending process, optionally, the SMC protocol stack can determine the header information of different network layers corresponding to the second skb data structure, so as to record the identification information of the network device and the communication peer network device, and determine the header information of the SMC protocol stack corresponding to the second skb data structure. Specifically, the header information corresponding to different network layers and the header information corresponding to the SMC protocol stack can be added in the linear data area corresponding to the second skb data structure. The identification information corresponding to the second network card corresponding to the second skb data structure can also be determined. Specifically, the second network card ( Figure 3 The identification information corresponding to the dummy NIC illustrated in the figure is stored so as to send the second skb data structure to the second network card based on the identification information of the second network card.

[0074] Afterwards, the SMC protocol stack reads the second network data from the second storage address and sends it to the AF_SMC Socket interface corresponding to the network data receiving program, so that the network data receiving program obtains the second network data from the interface. At the same time, the SMC protocol stack calls the driver of the second network card to send the second skb data structure (such as UDPskb) to the second network card ( Figure 3 At the same time, in the code call stack that sends the second skb data structure to the second network card, call Figure 3The packet capture function (dev_queue_xmit_nit()) shown in the figure is used to copy the second skb data structure through the function, and the receiving callback function of the AF_PACKET socket interface is called to receive the copy of the second skb data structure. Thus, the network data packet capture program can capture the second network data received by the receiving device from the operating system kernel based on the pointer information in the copy of the second skb data structure, and can understand the relevant communication information based on the various header information added in the copy of the second skb data structure: such as the IP address and port information corresponding to the second network data. It should be noted that the packet capture function (dev_queue_xmit_nit()) is still scheduled at this time, because for the SMC protocol stack, the skb data structure is still sent from the kernel to the virtual network card.

[0075] In summary, referring to the packet capture mechanism in the traditional mature operating system kernel, when the SMC protocol stack is run in the operating system kernel, the biggest problem is that the transmission of network data does not pass through the kernel packet capture processing point under the above-mentioned traditional packet capture mechanism. In the SMC protocol stack, the sent network data is stored in the pre-applied sending buffer, and the network data is encapsulated and sent in the network card hardware by RDMA or other protocol offloading technologies; conversely, the network card hardware also performs protocol parsing on the received data packets, and stores the network data in the pre-applied receiving buffer. These network processing operations are not completed in the operating system kernel, and the skb data structure is not used to store network data. Therefore, in order to reuse the existing kernel packet capture mechanism and provide similar packet capture capabilities, the embodiment of the present application provides a solution for constructing a skb data structure pointing to the sent / received network data when the SMC protocol stack is used in the kernel, sending it to the specified virtual network card, and capturing the network data on the virtual network card. This solution enables the SMC protocol stack to reuse the existing kernel packet capture mechanism, user-state function library and packet capture tool, and has a performance overhead similar to that of traditional network data capture, which is convenient and low in cost.

[0076] In addition, in an optional embodiment, when the network data packet capture program wants to capture network data that meets specific filtering conditions, corresponding filtering rules (such as BPF filters) can also be configured in the operating system kernel. For example, when the network data packet capture program wants to capture network data sent to the local from a specific remote IP address, the corresponding BPF filtering rules can be configured to pass the qualified skb data structure to the receiving callback function of the AF_PACKET Socket interface based on the source IP address field of the IP packet header in the skb data structure.

[0077] In addition, an embodiment of the present application provides a packet capture method, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing, and the method includes: Obtaining network data sent by the communication peer network device from a target storage address in a receiving buffer created in the operating system kernel, wherein the first network card decapsulates the encapsulated network data sent by the communication peer network device after receiving the encapsulated network data to obtain the network data, and stores the network data in the target storage address; Creating a data structure corresponding to the network data, the data structure including a pointer to a target storage address, the data structure being a data structure used when storing network data under the second network protocol stack; The data structure is sent to the second network card to trigger sending a copy of the data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the network data based on the copy of the data structure. The second network card is a virtual network card set in the network device.

[0078] The network device in the above embodiment corresponds to the receiving end device in the above embodiment, and the corresponding communication peer network device is the sending end network device. The specific implementation of this solution can refer to the relevant description in the above embodiment, which will not be repeated here.

[0079] The packet capture device of one or more embodiments of the present application will be described in detail below. Those skilled in the art will appreciate that these devices can be configured using commercially available hardware components through the steps taught in this solution.

[0080] Figure 5 A schematic diagram of the structure of a packet capture device provided in an embodiment of the present application, wherein the packet capture device is applied to a first network protocol stack in an operating system kernel of a network device, wherein the network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing, such as Figure 5 As shown, the device includes: a storage module 11, a creation module 12, and a sending module 13.

[0081] The storage module 11 is used for storing the first network data to a first storage address in a sending buffer created in an operating system kernel in response to the network data sending program sending the first network data.

[0082] The creation module 12 is used to create a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack.

[0083] The sending module 13 is used to send the first data structure to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0084] The sending module 13 is further used to send the first network data to the first network card, so as to encapsulate the first network data through the first network card and send the encapsulated first network data to the communication peer network device.

[0085] Optionally, the creation module 12 is further used to: determine the packet header information of different network layers corresponding to the first data structure, so as to record the identification information of the network device and the communication peer network device.

[0086] Optionally, the creation module 12 is further used to: determine the packet header information of the first network protocol stack corresponding to the first data structure.

[0087] Optionally, the creation module 12 is further used to: determine identification information corresponding to the second network card corresponding to the first data structure, so as to send the first data structure to the second network card based on the identification information of the second network card.

[0088] Optionally, the device further includes: a reading module, which is used to obtain the second network data sent by the communication peer network device from the second storage address in the receiving buffer created in the operating system kernel, wherein the first network card receives the encapsulated second network data sent by the communication peer network device and performs decapsulation processing to obtain the second network data, and stores the second network data in the second storage address. Based on this, the sending module 13 is also used to send the second network data to the network data receiving program. The creation module 12 is also used to create a second data structure corresponding to the second network data, the second data structure contains a pointer to the second storage address, and the second data structure is a data structure used when storing network data under the second network protocol stack. The sending module 13 is also used to send the second data structure to the second network card to trigger sending a copy of the second data structure to the packet capture interface, so that the network data packet capture program obtains the second network data based on the copy of the second data structure.

[0089] Optionally, the creation module 12 is also used to: determine the packet header information of different network layers corresponding to the second data structure, so as to record the identification information of the network device and the communication peer network device, and determine the packet header information of the first network protocol stack corresponding to the second data structure.

[0090] Optionally, the creation module 12 is further used to: determine identification information corresponding to the second network card corresponding to the second data structure, so as to send the second data structure to the second network card based on the identification information of the second network card.

[0091] Optionally, the first network protocol stack includes a shared memory communication protocol stack.

[0092] Figure 5 The device shown can execute the steps in the packet capture method in the aforementioned embodiment. The detailed execution process and technical effects can be found in the description in the aforementioned embodiment, which will not be repeated here.

[0093] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, in practice, the electronic device includes: a memory 21 and a processor 22.

[0094] The memory 21 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, data structures, contact data, phone book data, messages, pictures, videos, etc.

[0095] The processor 22 is coupled to the memory 21 and is used to execute the computer program in the memory 21 to implement the packet capturing method provided in the above embodiment.

[0096] Further, if Figure 6 As shown, the electronic device also includes: a communication component 23, a display 24, a power component 25, an audio component 26 and other components. Figure 6 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 6 The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone or an IOT device, or a server device such as a conventional server, a cloud server or a server array.

[0097] The above-mentioned memory can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0098] The communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as a mobile communication network such as 2G, 3G, 4G / LTE, 5G, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel.

[0099] The display includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0100] The power supply assembly provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply assembly is located.

[0101] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (Microphone, MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0102] Accordingly, the embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the processor is enabled to implement each step in the above method embodiment. Among them, the computer-readable storage medium includes volatile or non-volatile or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (Phase-change Random Access Memory, PRAM), static random access memory (SRAM), dynamic random access memory (Dynamic Random Access Memory, DRAM), other types of random access memory (Random-Access Memory, RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (Digital Video Disc, DVD) or other optical storage, magnetic cassette, tape disk storage or other magnetic storage device or any other non-transmission medium Accordingly, the present application embodiment also provides a computer program product, the computer program product includes a computer program or an instruction, when the computer program or the instruction is executed by the processor, the processor is enabled to implement each step in the above method embodiment. It should be understood that each process or a combination of multiple processes in the above method flow can be implemented by a computer program or an instruction. In addition, these computer programs or instructions can be applied to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device, so that the processor of the general-purpose computer, the special-purpose computer, the embedded processor or other programmable data processing device can be implemented as a device for implementing the corresponding functions in the above method embodiment.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A packet capture method, characterized in that: A first network protocol stack applied to an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, the network processing includes encapsulation processing and decapsulation processing, and the method includes: In response to the network data sending program sending the first network data, storing the first network data in a first storage address in a sending buffer created in the operating system kernel; Creating a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack; The first data structure is sent to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure, and the second network card is a virtual network card set in the network device.

2. The method according to claim 1, characterized in that: The method further comprises: Determine the packet header information of different network layers corresponding to the first data structure, so as to record the identification information of the network device and the communication peer network device.

3. The method according to claim 1, characterized in that The method further comprises: Determine the packet header information of the first network protocol stack corresponding to the first data structure.

4. The method according to claim 1, characterized in that The method further comprises: Determine identification information corresponding to the second network card corresponding to the first data structure, so as to send the first data structure to the second network card based on the identification information of the second network card.

5. The method according to claim 1, characterized in that The method further comprises: Acquire second network data sent by the communication peer network device from a second storage address in the receiving buffer created in the operating system kernel, wherein the first network card decapsulates the encapsulated second network data sent by the communication peer network device after receiving the data to obtain the second network data, and stores the second network data in the second storage address; Creating a second data structure corresponding to the second network data, wherein the second data structure includes a pointer to the second storage address, and the second data structure is a data structure used when storing network data under the second network protocol stack; The second data structure is sent to the second network card to trigger sending a copy of the second data structure to the packet capture interface, so that the network data packet capture program obtains the second network data based on the copy of the second data structure.

6. The method according to claim 5, characterized in that The method further comprises: Determine the packet header information of different network layers corresponding to the second data structure to record the identification information of the network device and the communication peer network device, and determine the packet header information of the first network protocol stack corresponding to the second data structure.

7. The method according to claim 5, characterized in that The method further comprises: Determine identification information corresponding to the second network card corresponding to the second data structure, so as to send the second data structure to the second network card based on the identification information of the second network card.

8. The method according to any one of claims 1 to 7, characterized in that The first network protocol stack includes a shared memory communication protocol stack.

9. A packet capture method, characterized in that: A first network protocol stack applied to an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, the network processing includes encapsulation processing and decapsulation processing, and the method includes: Acquire network data sent by the communication peer network device from the target storage address in the receiving buffer created in the operating system kernel, wherein the first network card decapsulates the encapsulated network data sent by the communication peer network device after receiving the encapsulated network data to obtain the network data, and stores the network data in the target storage address; Creating a data structure corresponding to the network data, wherein the data structure includes a pointer to the target storage address, and the data structure is a data structure used when storing network data under the second network protocol stack; The data structure is sent to a second network card to trigger sending a copy of the data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the network data based on the copy of the data structure. The second network card is a virtual network card set in the network device.

10. An electronic device, characterized in that: include: A memory, a processor, and a communication component; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the packet capture method as described in any one of claims 1 to 9.

11. A non-transitory machine-readable storage medium, characterized in that: The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor is caused to execute the packet capturing method according to any one of claims 1 to 9.

12. A computer program product, characterized in that include: A computer program, when executed by a processor of an electronic device, causes the processor to execute the packet capturing method according to any one of claims 1 to 9.

Images