Packet capturing method, device, storage medium and program product

Abstract

An embodiment of the present application provides a packet capturing method, device, storage medium, and program product. The network processing of network data in the first network protocol stack in the kernel is offloaded to the first network card of the network device. The method includes: storing the first network data at the first storage address in the send buffer in the kernel, creating a first data structure corresponding to the first network data, and pointing the pointer therein to the first storage address. The first data structure is the data structure used when storing network data under the second network protocol stack. Sending the first data structure to the virtual second network card to trigger sending a copy of the first data structure to the packet capturing interface created by the network data packet capturing program. Through this solution, the packet capturing path of the traditional packet capturing mechanism can be reused, achieving low-cost and convenient packet capturing.

Description

Technical Field

[0001] This application relates to the field of Internet technologies, and in particular, to a packet capture method, device, storage medium, and program product. Background Art

[0002] Data Capture refers to the process of collecting and recording network data such as data packets or data streams during network transmission. This process is usually used in multiple fields such as network monitoring, performance analysis, and security auditing.

[0003] Data Capture is usually also referred to as packet capture. Currently, there is a mature packet capture mechanism in some operating system kernels: a user-space packet capture application can capture data packets at the data link layer through a specific type of Socket interface, such as the AF_PACKET Socket interface. Specifically, the user-space packet capture application can register a receive callback function for the AF_PACKET Socket interface with the operating system kernel. When the network device sends or receives network data, the network protocol stack in the operating system kernel will trigger this callback function to notify the user-space packet capture application to obtain a copy of these network data on this AF_PACKET Socket interface, thus completing the capture of network data on the network device.

[0004] However, the above-mentioned mature packet capture mechanism in the operating system kernel has the following requirements: 1) The network protocol stack describes network data through the skb (short for struct sk_buff) data structure, which is applicable to most network protocol stacks but not to network protocols that store network data in other ways, such as the shared memory communication protocol stack; 2) The processing of data packets entering and leaving the network device (such as encapsulation and decapsulation processing, etc.) needs to be carried out in the operating system kernel.

[0005] Based on this, if the network protocol stack running in the operating system kernel does not meet the above two conditions, it means that the above-mentioned mature packet capture mechanism cannot be directly used to implement network data capture. If a new packet capture mechanism suitable for the currently running network protocol stack is developed, it will cost a greater price. Therefore, how to reuse the traditional mature packet capture mechanism in the case of a new network protocol stack to complete network data capture in the case of this new network protocol stack at a lower cost and in a more convenient way is an urgent problem to be solved. Summary of the Invention

[0006] The embodiments of the present application provide a packet capture method, device, storage medium and program product, which are used to implement packet capture of user-mode applications by reusing the packet capture mechanism of another network protocol stack (such as a TCP protocol stack, etc.) in the operating system kernel when a certain network protocol stack (such as a shared memory communication protocol stack) is currently running in the operating system kernel.

[0007] In a first aspect, an embodiment of the present application provides a packet capture method, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The method includes:

[0008] In response to the network data sending program sending the first network data, storing the first network data in a first storage address in a sending buffer created in the operating system kernel;

[0009] Creating a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data in the second network protocol stack;

[0010] The first data structure is sent to a pre-configured second network card to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0011] In a second aspect, an embodiment of the present application provides a packet capture device, which is applied to a first network protocol stack in an operating system kernel of a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The device includes:

[0012] A storage module, configured to store the first network data to a first storage address in a sending buffer created in an operating system kernel in response to the network data sending program sending the first network data;

[0013] a creation module, configured to create a first data structure corresponding to the first network data, wherein the first data structure includes a pointer to the first storage address, and the first data structure is a data structure used when storing network data under the second network protocol stack;

[0014] A sending module, configured to send the first data structure to a pre-configured second network card, so as to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the first network data based on the first data structure, where the second network card is a virtual network card set in the network device.

[0015] In a third aspect, an embodiment of the present application provides a packet capture method, which is applied to a first network protocol stack in an operating system kernel of a network device. Among them, network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The method includes:

[0016] Obtain network data sent by a communication peer network device from a target storage address in a receive buffer created in the operating system kernel. Among them, after the first network card receives the encapsulated network data sent by the communication peer network device, it performs decapsulation processing to obtain the network data, and stores the network data in the target storage address;

[0017] Create a data structure corresponding to the network data. The data structure contains a pointer pointing to the target storage address, and the data structure is a data structure used for storing network data under a second network protocol stack;

[0018] Send the data structure to the second network card, so as to trigger sending a copy of the data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program obtains the network data based on the copy of the data structure, where the second network card is a virtual network card set in the network device.

[0019] In a fourth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor, and a communication component; wherein, an executable code is stored on the memory, and when the executable code is executed by the processor, the processor is enabled to execute the packet capture method as described in the first aspect and the third aspect.

[0020] In a fifth aspect, an embodiment of the present application provides a non-transitory machine-readable storage medium, on which an executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the packet capture method as described in the first aspect and the third aspect.

[0021] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it can implement the packet capture method as described in the first aspect and the third aspect.

[0022] In the packet capture solution provided by the embodiments of the present application, it is assumed that the first network protocol stack is currently running in the operating system kernel of the network device. The network processing of network data (including encapsulation processing and decapsulation processing) in the first network protocol stack is offloaded to the first network card of the network device, and the first network protocol stack does not use the skb data structure to store network data. Additionally, it is assumed that the second network protocol stack uses the skb data structure to store network data, and the network processing of network data is implemented in the operating system kernel. Based on this, in the case of the above-mentioned first network protocol stack, the network data capture program in the user space can capture network data through the following methods:

[0023] In response to the sending of the first network data by the network data sending program, the first network data is stored at the first storage address in the sending buffer created in the operating system kernel, and the first network data is sent to the first network card to perform encapsulation processing on the first network data through the first network card and send the encapsulated first network data to the communication peer network device;

[0024] Create a first data structure (first sbk) corresponding to the first network data. The first data structure contains a pointer pointing to the first storage address, and send the first data structure to a pre-configured second network card to trigger the sending of a copy of the first data structure to the packet capture interface created by the network data capture program, so that the network data capture program can obtain the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0025] In the above solution, by constructing the first skb pointing to the first network data required when reusing the traditional packet capture mechanism in the operating system kernel and triggering the packet capture point by sending it to the specified virtual network card, the packet capture program can capture the first network data on the virtual network card. Under this solution, the communication scenario of the first network protocol stack can reuse the kernel packet capture mechanism, user space library, and tools in the traditional second network protocol stack communication scenario and have similar performance overheads, achieving low-cost and convenient network data capture in the case of the first network protocol stack. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0027] Figure 1a It is a schematic diagram of a traditional packet capture mechanism;

[0028] Figure 1b It is a schematic diagram of the principle for network data storage based on the skb data structure;

[0029] Figure 2 It is a flowchart of a packet capture method provided by an embodiment of the present application;

[0030] Figure 3 It is a schematic diagram of a packet capture mechanism provided by an embodiment of the present application;

[0031] Figure 4 It is a flowchart of a packet capture method provided by an embodiment of the present application;

[0032] Figure 5 It is a schematic diagram of the structure of a packet capture device provided by an embodiment of the present application; <*

[0033] Figure 6 It is a schematic diagram of the structure of an electronic device provided by this embodiment. Detailed implementation manners[[ID=2*]]

[0034] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the protection scope of the present application. In addition, the sequence of steps in the following method embodiments is only an example and is not strictly limited.

[0035] It should be noted that in the case where the embodiments of the present application involve user information, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the embodiments of the present application are all information and data that have been authorized by the user or fully authorized by all parties. And the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions, and corresponding operation entrances are provided for users to choose to authorize or refuse. In addition, various models involved in the present application (including but not limited to large language models or other models) comply with relevant laws and standards.

[0036] First, the terms involved in the embodiments of the present application are described.

[0037] Data capture: Data capture refers to the process of collecting and recording network data such as data packets or data streams during network transmission.

[0038] tcpdump: A network packet capture tool that enables real-time capture and analysis of network traffic in the command line. Tcpdump allows users to display packet contents in text form and select and display specific packets according to user-defined filtering conditions, making it an important tool for network fault diagnosis and traffic analysis.

[0039] libpcap: A C language library for capturing network data that provides a set of application programming interfaces (APIs) to access network data streams at the data link layer. Libpcap supports network interfaces on different platforms and is often used in the development of network monitoring, analysis, and security tools, including tcpdump.

[0040] Transmission Control Protocol: (TCP for short) is a connection-oriented transport layer protocol widely used in the Internet and computer networks. Its main features include reliability, connection orientation, orderliness, and flow control.

[0041] User Datagram Protocol: (UDP for short) is a connectionless transport layer protocol mainly used for fast data transmission. Its characteristics are connectionlessness, unreliability, and fast transmission rate.

[0042] Address Resolution Protocol (ARP for short) is a network transport protocol that finds the data link layer address by resolving the network layer address.

[0043] Internet Control Message Protocol (ICMP for short). It is a sub-protocol of the TCP / IP protocol suite used to transfer control messages between hosts and routers.

[0044] Socket: A basic concept and interface for implementing communication between different hosts in computer network programming. It is an abstract data structure through which an application can send requests to the network protocol stack to achieve data sending and receiving.

[0045] Shared Memory Communication (SMC) network protocol: A high-performance kernel network protocol. The SMC protocol transparently transfers network data of TCP sockets in the form of shared memory access, providing a network with high throughput, low latency, and low overhead. In practical applications, the SMC protocol can be further divided into SMC over DMA (referred to as SMC-D) and SMC over RDMA (referred to as SMC-R) based on Remote Direct Memory Access (RDMA) technology.

[0046] Dummy Device: A virtual interface that does not correspond to any physical hardware, used for testing or development purposes. It can simulate network behavior without relying on real network hardware and is often used to conveniently and quickly implement data transfer testing or function verification during the development process. The dummy device in the embodiments of this application can be a virtual network card.

[0047] Send buffer (sndbuf): A buffer in the SMC protocol stack used to cache network data to be sent, located in the operating system kernel. The network data sending program in the user space can store the network data to be sent in this buffer through socket system calls such as send() and wait for the network adapter to send it out.

[0048] Remote Memory Buffer (RMB): A buffer in the SMC protocol stack used to store network data to be received. The network adapter stores the received network data in this buffer and notifies the network data receiving program in the user space to receive the network data using socket system calls such as recv().

[0049] Remote Direct Memory Access (RDMA): A technology that allows one computer to directly access the memory of another computer without the intervention of the operating system, mainly used for data transfer in high-speed networks.

[0050] Berkeley Packet Filter (BPF): Initially designed for network packet filtering, it provides an efficient and low-overhead network packet filtering mechanism for the operating system. Over time, the application and functions of BPF have been significantly extended and are now often used in multiple fields such as monitoring, troubleshooting, and security analysis.

[0051] The following will first combine with Figure 1a, a traditional kernel packet capture mechanism applicable to network protocol stacks such as TCP, UDP, ARP, ICMP, etc. is introduced. In Figure 1, the TCP / IP network protocol stack is taken as an example for illustration, and the same applies to other network protocol stacks.

[0052] In Figure 1a , a pair of communication devices are schematically shown: a sending device and a receiving device. Among them, the user-space application program for sending network data in the sending device is named the network data sending program, and the user-space application program for receiving network data in the receiving device is named the network data receiving program. The user-space application program for capturing network data in both devices is named the network data packet capture program. In practical applications, the network data packet capture program can be the tcpdump tool.

[0053] To achieve the sending of network data, the network data sending program will create a Socket interface for sending network data, such as the AF_INET Socket interface schematically shown in the figure, but not limited to this. Similarly, to achieve the receiving of network data, the network data receiving program will create a Socket interface for receiving network data, such as the AF_INET Socket interface schematically shown in the figure, but not limited to this. Moreover, to achieve the capture of network data, the network data packet capture programs of the sending device and the receiving device can create a Socket interface for capturing network data, such as the AF_PACKET Socket interface schematically shown in the figure, but not limited to this. Specifically, the network data packet capture program can complete the creation of the AF_PACKET Socket interface based on, for example, the libpcap function library.

[0054] The sending and receiving processes of network data and the capture process are as follows:

[0055] On the premise that the network protocol stacks running in the operating system kernels of the sending device and the receiving device are both TCP / IP network protocol stacks, first, the sending device and the receiving device complete the establishment of a TCP connection through a handshake negotiation process. Specifically, this TCP connection is established at both ends of the AF_INET Socket interfaces created by the network data sending program and the network data receiving program. After that, the network data sending program passes a certain network data (as the payload of the encapsulated data packet) into the operating system kernel through the set system call via the AF_INET Socket interface.

[0056] After that, the TCP / IP network protocol stack in the operating system kernel creates an skb data structure to describe this network data. Specifically, as Figure 1bAs shown, the TCP / IP network protocol stack will allocate two memory spaces in the memory space of the operating system kernel: memory space a and memory space b. Among them, memory space a is used to store skb data structures, and memory space b is used for the linear data area corresponding to the skb data structure, where the above network data and various headers added during subsequent encapsulation processing of the network data are stored. Among them, what is actually stored in the skb are some pointers (such as pointer 1 - pointer m shown in the figure), which point to different parts of the data packet stored in memory space b. The data packet will contain various headers and the above network data as the payload. It should be noted that the memory space of the kernel occupied by the above linear data area is often relatively small, which means that the amount of network data that can be stored is relatively small. When the data volume of the data packet to be transmitted exceeds its storage limit, a non-linear data area can be created as needed. This non-linear data area will occupy another non-contiguous memory space c. Figure 1b is not shown in the figure. Generally speaking, multiple element (flag) pointers will be stored in the non-linear data area, and different element pointers point to the kernel memory storage addresses (usually pointing to different memory pages) storing different parts of the data packet. Thus, through the pointers in the skb data structure and the pointers pointed to by the pointers contained therein, a complete data packet can be found, and the header and payload parts of the data packet can be located. Moreover, the description of the network data by the skb data structure mainly means: describing the additional information such as the header of the network data through the pointer pointing to the corresponding linear data area, or it can also describe the data content itself as the network data (payload), or describe the memory storage address of the network data (payload) in the kernel through the pointer of the non-linear data area.

[0057] The TCP / IP network protocol stack then performs layer-by-layer network processing on the network data. For example, a TCP header, an IP header, and a header of the data link layer are added in front of the network data. After the encapsulation of these headers, the encapsulated network data (i.e., a complete data packet) is obtained, and different pointers in the skb data structure are correspondingly pointed to the corresponding storage addresses. For example, some pointers directly point to the corresponding parts in the linear data area, and some pointers point to the element pointers corresponding to the non-linear data area, so as to point to the storage address where the network data is actually stored through these element pointers.

[0058] After that, on the one hand, the TCP / IP network protocol stack will call the network card driver to send the data packet to the network card (NIC), and transmit it to the receiving device through the network card. On the other hand, in the code call stack of the TCP / IP network protocol stack for sending network data, it calls the packet capture function in the sending direction shown in the figure (dev_queue_xmit_nit()). Through this function, a copy of the skb data structure will be made, and the receiving callback function of the AF_PACKET socket interface will be called to receive this skb data structure. Thus, the network data capture program can capture the complete data packet (encapsulated network data) that the sending device intends to send through this network card from the operating system kernel based on this skb data structure. Similarly, after the network card of the receiving device receives the above data packet, on the one hand, the network card driver stores the data packet in the skb data structure created by the network card driver. Then, after the TCP network protocol stack performs layer-by-layer header decapsulation on the data packet in the kernel, it sends the above network data (payload) obtained after decapsulation to the AF_INET Socket interface so that the network data receiving program can obtain this network data. On the other hand, it triggers the TCP / IP network protocol stack to call the packet capture function in the receiving direction shown in the figure (netif_receive_skb_core()) in its code call stack for receiving network data. Through this function, a copy of the skb data structure constructed by the network card driver is made, and the receiving callback function of the AF_PACKET socket interface is called to receive this skb data structure. Thus, the network data capture program can capture the encapsulated network data (i.e., the data packet sent by the sending device) received by the receiving device from the network card from the operating system kernel based on this skb data structure.

[0059] It should be noted that on the sending device side, the packet capture point (the dev_queue_xmit_nit() function) is executed after the network data is encapsulated, that is, after the encapsulation in the data link layer is completed. Therefore, the network data capture program on the sending side captures the encapsulated network data. On the receiving device side, the packet capture point (the __netif_receive_skb_core() function) is executed after receiving the encapsulated network data, that is, before the decapsulation in the data link layer is performed. Therefore, the network data capture program on the receiving side also captures the encapsulated network data containing complete header information.

[0060] As can be seen from the above introduction, the network protocol stack applicable to the above packet capture mechanism stores network data through the skb data structure, and the encapsulation and decapsulation processing of network data are both implemented by the network protocol stack in the operating system kernel. This will limit the wide applicability of the packet capture mechanism: when the network protocol stack stores network data in a way that does not use the skb data structure (such as the SMC protocol stack), and the network processing of network data does not need to be completed in the operating system kernel (such as a network protocol based on RDMA technology offloads network processing to a hardware device), the above packet capture mechanism cannot be directly reused.

[0061] In view of this, in the embodiments of the present application, a solution is introduced on how to reuse the above traditional packet capture mechanism, that is, reuse the packet capture path, to achieve low-cost and convenient network data capture when the network protocol stack running in the operating system kernel does not use the skb data structure to store network data, and the network processing of network data is not performed in the operating system kernel, but is offloaded to the hardware network card of the network device for execution.

[0062] The following will describe in detail some embodiments of the present application with reference to the accompanying drawings. Without conflict between the embodiments, the following embodiments and the features in the embodiments can be combined with each other.

[0063] Figure 2 The flowchart of a packet capture method provided by an embodiment of the present application is executed by a first network protocol stack in the operating system kernel of a network device, where the network processing of network data in the first network protocol stack is offloaded to the first network card of the network device. As Figure 2 shown, the method includes the following steps:

[0064] 201. In response to the sending of the first network data by the network data sending program, store the first network data at the first storage address in the sending buffer created in the operating system kernel.

[0065] 202. Create a first data structure corresponding to the first network data, where the first data structure contains a pointer to the first storage address, and the first data structure is the data structure used when storing network data under the second network protocol stack.

[0066] 203. Send the first data structure to a pre-configured second network card to trigger the sending of a copy of the first data structure to the packet capture interface created by the network data packet capture program, so that the network data packet capture program can obtain the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0067] The network device in the embodiment of the present application can be any computer device with network communication functions, including but not limited to user terminal devices, servers, routers, gateways, switches, and other devices.

[0068] Optionally, the first network protocol stack in the embodiment of the present application can be, for example, the SMC protocol stack. The way the SMC protocol stack stores network data is as follows: it uses the send buffer (sndbuf) to store network data to be sent, and uses the receive buffer (RMB) to store received network data, and does not use the skb data structure to describe network data. Further optionally, the first network protocol stack can be the SMC-R protocol stack that offloads network processing such as encapsulation and decapsulation of network data to the hardware network card (the first network card in the above text) based on the RDMA technology. Of course, it can be understood that in actual applications, there are many network protocol stacks that do not use the skb data structure and offload network processing such as encapsulation and decapsulation of network data to hardware units in network devices such as hardware network cards, and are not limited to the SMC series of network protocol stacks.

[0069] In the following, the first network protocol stack is taken as an example of the SMC protocol stack (specifically, it can be the SMC-R protocol stack) for illustration. This SMC protocol stack operates in the operating system kernel space.

[0070] To implement this embodiment, first, it is necessary to set up a virtual hardware device - the second network card (a virtual network card) in the network device. The physical hardware network card originally on the network device is called the first network card. Specifically, the operation and maintenance personnel can create this second network card in the user space through the corresponding network operation and maintenance tools. After that, notify the SMC protocol stack of the second network card used for packet capture through the netlink interface provided by the SMC protocol stack (not limited to this), and listen to the network data passing through this second network card through a network data packet capture program such as tcpdump. For example, create an AF_PACKET Socket interface so that the network data packet capture program listens to the network data of the second network card through this interface to achieve packet capture.

[0071] In addition, the SMC protocol stack uses the send buffer (sndbuf) and the receive buffer (RMB) to store network data. Therefore, the SMC protocol stack can pre-create these two buffers, that is, set these two buffers in the memory space of the operating system kernel.

[0072] The following combines Figure 3 to illustrate the execution process of the above embodiment. In Figure 3 In order to more intuitively illustrate the sending and receiving processes of network data, two network devices, a sending-end device and a receiving-end device, are illustrated. Figure 2 The network device in the illustrated embodiment can be Figure 3The sending device in it. Of course, in fact, this network device also has the functions of a receiving device.

[0073] Refer to Figure 1a the example in Figure 3 shown in , the sending device includes a network data sending program and a network data packet capturing program in the user space, and the receiving device includes a network data receiving program and a network data packet capturing program in the user space. Among them, for the same network device with sending and receiving functions, the above two network data packet capturing programs are actually the same one.

[0074] For the network data packet capturing program, as Figure 3 shown in , similarly, the creation of the AF_PACKET Socket interface can be completed based on the libpcap function library to implement the packet capturing function through this interface. However, since the network protocol stack running in the operating system kernel of the network device is already the SMC protocol stack at this time, the data transfer interfaces of the network data sending program and the network data receiving program with the operating system kernel are no longer the AF_INET Socket interface corresponding to the second network protocol stack (such as the TCP / IP protocol stack), but for example Figure 3 the AF_SMC Socket interface shown in .

[0075] At this time, the sending process and the capturing process of the first network data (the network data currently sent by the sending device) are as follows:

[0076] First, the sending device and the receiving device complete the establishment of a TCP connection. Then, during the three-way handshake negotiation process of this TCP connection, it is detected whether the other party supports the SMC protocol stack. If so, the SMC protocol stacks at both ends exchange SMC connection establishment messages and RDMA resources through this TCP connection to establish an SMC connection, and use the RDMA link to transmit network data between the two ends.

[0077] During the process of establishing the SMC connection, the SMC protocol stack creates a sending buffer and a receiving buffer, that is Figure 3 the creation of the SMC sndbuf and SMC RMB shown in . It should be noted that in Figure 3 only the SMC sndbuf is shown in the sending device and not the SMC RMB, and only the SMC RMB is shown in the receiving device and not the SMC sndbuf.

[0078] After that, the network data sending program passes the first network data (as the payload of the encapsulated data packet) into the operating system kernel through the set system call via the AF_SMC Socket interface. The SMC protocol stack stores the first network data at the first storage address in the SMC sndbuf. In Figure 3 the black block indicates the first network data.

[0079] After that, the SMC protocol stack creates a first skb data structure for describing the first network data and makes the pointer in the first skb data structure point to the first storage address. Generally speaking, under the SMC protocol stack, the data volume of the data packet is often relatively large and difficult to accommodate in the linearly created data area synchronized with the first skb data structure. Therefore, a non-linearly created data area is used to store the creation of multiple element pointers pointing to the above-mentioned first storage address. It can be understood that the first storage address is actually a section of kernel memory space, that is, a section of storage address corresponding to the sending buffer, often corresponding to multiple memory pages, and different element pointers point to different memory page addresses therein.

[0080] In addition, the SMC protocol stack can also perform related construction processing on the created first skb data structure. Optionally, determine the header information of different network layers corresponding to the first skb data structure for recording the identification information of the current sending-end device and the receiving-end device of the communication peer. Specifically, the first skb data structure can be constructed as a UDP skb, that is, add a UDP header (including port information), an IP header, etc. corresponding to the current sending-end device and the receiving-end device in the linearly created data area of the first skb data structure for recording the IP, port and other identification information of both ends of the shared memory (i.e., the sending-end device and the receiving-end device). In this way, based on the filling of the UDP header, the data packet will be parsed into a UDP message later. The reason for constructing it as a UDP message is the natural advantage of the UDP message. Of course, this is not limited to this, and it can also be constructed as other types of messages.

[0081] In addition, optionally, the SMC protocol stack can also determine the header information of the SMC protocol stack corresponding to the first skb data structure. Specifically, add the header information related to the SMC protocol stack, such as a header indicating the SMC protocol stack type and other information, in the linearly created data area of the first skb data structure, so that the network data capture program can successfully complete the parsing of the first skb data structure based on this header information.

[0082] Additionally, optionally, the SMC protocol stack can also determine the identification information corresponding to the second network card corresponding to the first skb data structure, and specifically, the identification information of the second network card can be added to the linear data area or the non-linear data area corresponding to the first skb data structure, so as to send the first skb data structure to the second network card based on the identification information of the second network card.

[0083] After that, on the one hand, the SMC protocol stack in the operating system kernel triggers, for example, an RDMA write operation, causing the first network card to read the first network data from the above-mentioned first storage address. Based on the RDMA write operation triggered by the SMC protocol stack, the SMC protocol stack actually realizes the transmission of the first network data to the first network card ( Figure 3 the RNIC shown in ). Specifically, the first network card can read the first network data from the first storage address in the send buffer according to the relevant information in this write operation. Since the network processing of the network data has been offloaded to the first network card, the first network card will perform encapsulation processing on the first network data, and then send the encapsulated first network data to the receiving device. Among them, as described above, this encapsulation processing can include the encapsulation of the transport layer header, the IP network layer header, the data link layer header, etc. adapted to the SMC protocol stack. Through these encapsulation processes, the finally obtained encapsulated first network data is a complete data packet.

[0084] Moreover, the SMC protocol stack will call the driver of the second network card to send the first skb data structure (such as UDP skb) to the second network card ( Figure 3 the dummy NIC shown in ). At the same time, in the code call stack for sending the first skb data structure, it calls Figure 3 the packet capture function (dev_queue_xmit_nit()) shown in to copy the first skb data structure (such as UDP skb) through this function, and calls the receive callback function of the AF_PACKET socket interface to receive this copy of the first skb data structure. Thus, the network data capture program can capture the first network data sent by the sending device from the operating system kernel based on the pointer information in the copy of the first skb data structure, and can understand the relevant communication information based on various header information added to the copy of the first skb data structure: such as the IP address, port information, etc. corresponding to the first network data. It should be noted that after receiving the first skb data structure, the second network card does not perform any processing, but only silently releases the memory space occupied by the first skb data structure. Because the purpose of sending the first skb data structure to the second network card is to trigger the execution of the packet capture point in the sending direction (the above-mentioned packet capture function) to adapt to the packet capture path of the packet capture point in the sending direction when the skb data structure is sent to the network card under the traditional packet capture mechanism.

[0085] Through the above process, the first network data sending and capturing process of the sending-end device is completed. Due to the design of the first skb data structure, the created first skb data structure only contains a pointer to the first network data that needs to be sent currently in the sending buffer and related packet header information. When copying the first skb data structure, no new memory space is created and the first network data in the sending buffer is not copied. The pointer in the copied first skb data structure also points to the above first storage address, so the overhead is very small.

[0086] Moreover, in the case of the SMC protocol stack, the packet capture tools (network data packet capture programs), function libraries, interfaces, etc. in the traditional packet capture mechanism are reused, and the packet capture path based on the skb data structure is reused, enabling network data capture to be completed more conveniently with lower cost overhead under the SMC protocol stack.

[0087] Figure 4 It is a flowchart of a packet capture method provided by an embodiment of the present application. This method is executed by the first network protocol stack in the operating system kernel of the network device. Among them, the network processing of network data in the first network protocol stack is offloaded to the first network card of the network device. As Figure 4 shown, this method includes the following steps:

[0088] 401. Obtain the second network data sent by the communication peer network device from the second storage address in the receive buffer created in the operating system kernel. Among them, after the first network card receives the encapsulated second network data sent by the communication peer network device, it performs decapsulation processing to obtain the second network data and stores the second network data in the second storage address.

[0089] 402. Send the second network data to the network data receiving program.

[0090] 403. Create a second data structure corresponding to the second network data. The second data structure contains a pointer to the second storage address. The second data structure is the data structure used to store network data under the second network protocol stack.

[0091] 404. Send the second data structure to the second network card to trigger the sending of a copy of the second data structure to the packet capture interface, so that the network data packet capture program can obtain the second network data based on the copy of the second data structure.

[0092] Next, still in combination with Figure 3 to illustrate the execution process of the above embodiment. Figure 4 The network device in the embodiment shown can be Figure 3The receiving device in it. For the convenience of explaining the receiving process of network data and the packet capture process in the receiving direction, it is assumed that the receiving device receives the encapsulated second network data from the sending device. In fact, the sending process of the second network data can refer to the relevant descriptions in the foregoing embodiments and will not be elaborated here.

[0093] On the receiving device side, after receiving the encapsulated second network data through Figure 3 the first network card (RNIC) shown in, corresponding decapsulation processing is performed in the RNIC to obtain the second network data, and the second network data is stored in the SMC RMB pre-created by the SMC protocol stack, specifically stored at the second storage address.

[0094] After that, the SMC protocol stack creates a second skb data structure corresponding to the second network data, and points the pointer in the second skb data structure to the second storage address.

[0095] Similar to the sending process, optionally, the SMC protocol stack can determine the header information of different network layers corresponding to the second skb data structure to be used for recording the identification information of the network device and the communication peer network device, and determine the header information of the SMC protocol stack corresponding to the second skb data structure. Specifically, the header information corresponding to different network layers and the header information corresponding to the SMC protocol stack can be added to the linear data area corresponding to the second skb data structure. The identification information corresponding to the second network card corresponding to the second skb data structure can also be determined. Specifically, the identification information corresponding to the second network card ( Figure 3 the dummy NIC shown in) can be added to the linear data area or non-linear data area corresponding to the second skb data structure, so as to send the second skb data structure to the second network card based on the identification information of the second network card.

[0096] After that, on the one hand, the SMC protocol stack reads the second network data from the second storage address and sends it to the AF_SMC Socket interface corresponding to the network data receiving program, so that the network data receiving program obtains the second network data from this interface. At the same time, on the other hand, the SMC protocol stack calls the driver program of the second network card to send the second skb data structure (such as UDPskb) to the second network card ( Figure 3 the dummy NIC shown in). At the same time, in the code call stack for sending the second skb data structure to the second network card, call Figure 3The packet capture function (dev_queue_xmit_nit()) shown in the figure is used to copy a second skb data structure through this function, and call the receive callback function of the AF_PACKET socket interface to receive a copy of this second skb data structure. Thus, the network data capture program can capture the second network data received by the receiving device from the operating system kernel based on the pointer information in the copy of the second skb data structure, and can understand the relevant communication information based on various packet header information added in the copy of the second skb data structure: such as the IP address and port information corresponding to the second network data. It should be noted that at this time, the packet capture function (dev_queue_xmit_nit()) is still scheduled because for the SMC protocol stack, the skb data structure is still sent from the kernel to the virtual network card.

[0097] In summary, referring to the packet capture mechanism in traditional mature operating system kernels, when the SMC protocol stack runs in the operating system kernel, the biggest problem is that the transmission of network data does not pass through the kernel packet capture processing point under the above traditional packet capture mechanism. In the SMC protocol stack, the transmitted network data is stored in a pre-allocated send buffer, and the network data is encapsulated and sent by RDMA or other protocol offloading technologies in the network card hardware; conversely, the network card hardware also parses the received packets and stores the network data in a pre-allocated receive buffer. These network processing operations are not completed in the operating system kernel, and the skb data structure is not used to store network data. Therefore, in order to reuse the existing kernel packet capture mechanism and provide a similar packet capture ability, when the SMC protocol stack is adopted in the kernel in the embodiments of the present application, a solution is provided to construct an skb data structure pointing to the transmitted / received network data, send it to a specified virtual network card, and capture the network data on the virtual network card. This solution enables the reuse of the existing kernel packet capture mechanism, user-space function libraries, and packet capture tools under the SMC protocol stack, and has similar performance overhead to traditional network data capture, achieving convenience and low cost.

[0098] In addition, in an optional embodiment, when the network data capture program wants to capture network data that meets specific filtering conditions, corresponding filtering rules (such as BPF filters) can also be configured in the operating system kernel. For example, when the network data capture program wants to capture network data sent from a specific remote IP address to the local, corresponding BPF filtering rules can be configured to pass the eligible skb data structures to the receive callback function of the AF_PACKET Socket interface based on the source IP address field of the IP packet header in the skb data structure.

[0099] In addition, an embodiment of the present application provides a packet capturing method, which is applied to a first network protocol stack in the operating system kernel of a network device. Among them, the network processing of network data in the first network protocol stack is offloaded to the first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The method includes:

[0100] Obtain the network data sent by the communication peer network device from the target storage address in the receive buffer created in the operating system kernel. After the first network card receives the encapsulated network data sent by the communication peer network device, it performs decapsulation processing to obtain the network data, and stores the network data at the target storage address;

[0101] Create a data structure corresponding to the network data. The data structure contains a pointer pointing to the target storage address. The data structure is the data structure used when storing network data under the second network protocol stack;

[0102] Send the data structure to the second network card to trigger the sending of a copy of the data structure to the packet capturing interface created by the network data packet capturing program, so that the network data packet capturing program can obtain the network data based on the copy of the data structure. The second network card is a virtual network card set in the network device.

[0103] The network device in the above embodiment corresponds to the receiving end device in the foregoing embodiment, and the corresponding communication peer network device is the sending end network device. The specific implementation of this solution can refer to the relevant descriptions in the foregoing embodiments and will not be elaborated here.

[0104] Hereinafter, a packet capturing device according to one or more embodiments of the present application will be described in detail. Those skilled in the art can understand that these devices can all be configured by using commercially available hardware components through the steps taught by this solution.

[0105] Figure 5 The structure diagram of a packet capturing device provided for an embodiment of the present application. The packet capturing device is applied to a first network protocol stack in the operating system kernel of a network device. Among them, the network processing of network data in the first network protocol stack is offloaded to the first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. As Figure 5 shown, the device includes: a storage module 11, a creation module 12, and a sending module 13.

[0106] The storage module 11 is configured to store the first network data at the first storage address in the send buffer created in the operating system kernel in response to the sending of the first network data by the network data sending program.

[0107] A creation module 12 is used to create a first data structure corresponding to the first network data. A pointer to the first storage address is included in the first data structure, and the first data structure is the data structure used for storing network data under the second network protocol stack.

[0108] A sending module 13 is used to send the first data structure to a pre-configured second network card, so as to trigger sending a copy of the first data structure to a packet capture interface created by a network data packet capture program, so that the network data packet capture program can obtain the first network data based on the copy of the first data structure. The second network card is a virtual network card set in the network device.

[0109] Wherein, the sending module 13 is further used to send the first network data to the first network card, so as to perform encapsulation processing on the first network data through the first network card and send the encapsulated first network data to a communication peer network device.

[0110] Optionally, the creation module 12 is further used to: determine header information of different network layers corresponding to the first data structure, so as to record identification information of the network device and the communication peer network device.

[0111] Optionally, the creation module 12 is further used to: determine header information of the first network protocol stack corresponding to the first data structure.

[0112] Optionally, the creation module 12 is further used to: determine identification information corresponding to the second network card of the first data structure, so as to send the first data structure to the second network card based on the identification information of the second network card.

[0113] Optionally, the device further includes: a reading module, configured to obtain second network data sent by the communication peer network device from a second storage address in a receive buffer created in the operating system kernel, where after receiving the encapsulated second network data sent by the communication peer network device, the first network card performs decapsulation processing to obtain the second network data, and stores the second network data at the second storage address. Based on this, the sending module 13 is further configured to: send the second network data to a network data receiving program. The creating module 12 is further configured to: create a second data structure corresponding to the second network data, where the second data structure includes a pointer pointing to the second storage address, and the second data structure is a data structure used for storing network data under the second network protocol stack. The sending module 13 is further configured to: send the second data structure to the second network card, so as to trigger sending a copy of the second data structure to the packet capture interface, so that the network data packet capture program obtains the second network data based on the copy of the second data structure.

[0114] Optionally, the creating module 12 is further configured to: determine header information of different network layers corresponding to the second data structure, so as to record identification information of the network device and the communication peer network device, and determine header information of the first network protocol stack corresponding to the second data structure.

[0115] Optionally, the creating module 12 is further configured to: determine identification information corresponding to the second network card corresponding to the second data structure, so as to send the second data structure to the second network card based on the identification information of the second network card.

[0116] Optionally, the first network protocol stack includes a shared memory communication protocol stack.

[0117] Figure 5 The device shown can execute the steps in the packet capture method in the foregoing embodiment. For the detailed execution process and technical effects, refer to the description in the foregoing embodiment, which will not be elaborated here.

[0118] Figure 6 This is a schematic structural diagram of an electronic device provided by an embodiment of the present application. As Figure 6 shown, in practice, the electronic device includes: a memory 21 and a processor 22.

[0119] The memory 21 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application program or method for operating on the electronic device, data structures, contact data, phone book data, messages, pictures, videos, etc.

[0120] A processor 22, coupled to a memory 21, is configured to execute a computer program in the memory 21 to implement the packet capture method provided in the foregoing embodiments.

[0121] Further, as Figure 6 shown, the electronic device further includes: a communication component 23, a display 24, a power supply component 25, an audio component 26, and other components. Figure 6 Only some components are schematically shown herein, and it does not mean that the electronic device only includes Figure 6 the components shown. The electronic device in this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, or an IOT device, or can also be a server device such as a conventional server, a cloud server, or a server array.

[0122] The foregoing memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read only memory (EEPROM), an erasable programmable read only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk.

[0123] The foregoing communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as a mobile communication network such as 2G, 3G, 4G / LTE, 5G, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel.

[0124] The foregoing display includes a screen, and the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can not only sense the boundaries of touch or swipe actions, but also detect the duration and pressure associated with the touch or swipe operation.

[0125] The above power supply component provides power for various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device where the power supply component is located.

[0126] The above audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (Microphone, MIC). When the device where the audio component is located is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive external audio signals. The received audio signals can be further stored in the memory or sent via the communication component. In some embodiments, the audio component further includes a speaker for outputting audio signals.

[0127] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it causes the processor to be able to implement the steps in the above method embodiments. Among them, the computer-readable storage medium can be implemented by volatile or non-volatile or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic disk storage or other magnetic storage devices or any other non-transmission medium

[0128] Accordingly, an embodiment of the present application further provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, the processor is enabled to implement each step in the above method embodiment. It should be understood that each process or the combination of multiple processes in the above method flow can be implemented by the computer program or instructions. In addition, these computer programs or instructions can be applied to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing devices, so that the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing devices can be used as devices to implement the corresponding functions in the above method embodiment.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A packet capture method, characterized in that, A first network protocol stack in an operating system kernel applied to a network device, wherein network processing of network data in the first network protocol stack is offloaded to a first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The method includes: In response to the sending of first network data by a network data sending program, storing the first network data at a first storage address in a send buffer created in the operating system kernel; Creating a first data structure corresponding to the first network data, where the first data structure contains a pointer to the first storage address, and the first data structure is a data structure used for storing network data under a second network protocol stack, and where the data transfer interface of the network data sending program, the data transfer interface of the operating system kernel, and the interface of the second network protocol stack do not correspond; Sending the first data structure to a pre-configured second network card to trigger sending a copy of the first data structure to a capture interface created by a network data capture program, so that the network data capture program obtains the first network data based on the copy of the first data structure, and the second network card is a virtual network card set in the network device.

2. The method according to claim 1, characterized in that, The method further includes: Determining header information of different network layers corresponding to the first data structure for recording identification information of the network device and a communication peer network device.

3. The method according to claim 1, wherein The method further includes: Determining header information of the first network protocol stack corresponding to the first data structure.

4. The method according to claim 1, wherein The method further includes: Determining identification information corresponding to the second network card corresponding to the first data structure, so as to send the first data structure to the second network card based on the identification information of the second network card.

5. The method according to claim 1, characterized in that The method further includes: Obtaining second network data sent by a communication peer network device from a second storage address in a receive buffer created in the operating system kernel, where after the first network card receives the encapsulated second network data sent by the communication peer network device, it performs decapsulation processing to obtain the second network data and stores the second network data at the second storage address; Creating a second data structure corresponding to the second network data, where the second data structure contains a pointer to the second storage address, and the second data structure is a data structure used for storing network data under the second network protocol stack; Sending the second data structure to the second network card to trigger sending a copy of the second data structure to the capture interface, so that the network data capture program obtains the second network data based on the copy of the second data structure.

6. The method according to claim 5, wherein The method further includes: Determining header information of different network layers corresponding to the second data structure for recording identification information of the network device and the communication peer network device, and determining header information of the first network protocol stack corresponding to the second data structure.

7. The method according to claim 5, characterized in that, The method further includes: Determine the identification information corresponding to the second network card corresponding to the second data structure, so as to send the second data structure to the second network card based on the identification information of the second network card.

8. The method according to any one of claims 1 to 7, characterized in that, The first network protocol stack includes a shared memory communication protocol stack.

9. A packet capture method, characterized in that Applied to the first network protocol stack in the operating system kernel of a network device, wherein the network processing of network data in the first network protocol stack is offloaded to the first network card of the network device, and the network processing includes encapsulation processing and decapsulation processing. The method includes: Obtain the network data sent by the communication peer network device from the target storage address in the receive buffer created in the operating system kernel, wherein after the first network card receives the encapsulated network data sent by the communication peer network device, it performs decapsulation processing to obtain the network data, and stores the network data in the target storage address; Create a data structure corresponding to the network data, the data structure contains a pointer pointing to the target storage address, and the data structure is the data structure used to store network data under the second network protocol stack, wherein the data transfer interface of the operating system kernel does not correspond to the interface of the second network protocol stack; Send the data structure to the second network card to trigger sending a copy of the data structure to the capture interface created by the network data capture program, so that the network data capture program can obtain the network data based on the copy of the data structure, and the second network card is a virtual network card set in the network device.

10. An electronic device, characterized in that, Includes: A memory, a processor, and a communication component; wherein, an executable code is stored on the memory, and when the executable code is executed by the processor, the processor executes the packet capture method according to any one of claims 1 to 9.

11. A non-transitory machine-readable storage medium, characterized in that, An executable code is stored on the non-transitory machine-readable storage medium, and when the executable code is executed by the processor of an electronic device, the processor executes the packet capture method according to any one of claims 1 to 9.

12. A computer program product, characterized in that, Includes: A computer program, and when the computer program is executed by the processor of an electronic device, the processor executes the packet capture method according to any one of claims 1 to 9.

Images