Remote packet capturing method and system based on cloud host, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a remote package capturing method and system based on a cloud host, electronic equipment and a storage medium, and relates to the technical field of computer security, the method comprises the following steps: determining at least one target cloud host by responding to a selection operation for the cloud host through a capturing control terminal; the method comprises the following steps: determining a packet capture task for a target cloud host in response to a packet capture task configuration operation for the target cloud host through a capture control terminal, and generating a packet capture instruction corresponding to the packet capture task; sending the packet capturing instruction to a target cloud host through an instruction distribution module; executing a data capture operation corresponding to the packet capture instruction through the target cloud host to obtain service data corresponding to the data capture operation; according to the embodiment of the invention, the service data is acquired by capturing the control terminal and is displayed, so that a user can intuitively feel the operation mode, the operation mode of the user is enriched, and the operation difficulty is reduced.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a remote packet capture method based on a cloud host, a centralized management system, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of cloud computing, various industries are increasingly connecting with Linux cloud servers, leading to a large number of web application servers migrating to the cloud, and even personal computers (PCs) are gradually migrating to cloud computers or cloud terminals. As the number of services on cloud servers increases, so do the number of problems encountered. Operations and maintenance personnel need to be prepared to locate the corresponding problems in order to carry out targeted maintenance.

[0003] In this particular technology, operations and maintenance personnel obtain the username and password of the Linux cloud host from the user, log in to the cloud host, and then use packet capture tools on the Linux cloud host to capture, package, and upload packets for local analysis. However, this process requires operations and maintenance personnel to obtain the corresponding username and password from the cloud host user, which can lead to conflicts between users and results in overly limited operational methods and low packet capture efficiency. Summary of the Invention

[0004] The present invention provides a remote packet capture method, system, electronic device, and computer-readable storage medium based on a cloud host, to solve or partially solve the problems of packet capture process that rely on cloud host users, have overly limited packet subtraction operation methods, and have low packet capture efficiency.

[0005] This invention discloses a remote packet capture method based on a cloud host, applied to a centralized management system. The centralized management system includes at least a packet capture control terminal, at least two cloud hosts communicatively connected to the packet capture control terminal, and an instruction distribution module. The graphical user interface of the packet capture control terminal displays at least the operation interface corresponding to the centralized management system. The method includes:

[0006] The capture control terminal, in response to a selection operation for the cloud host, identifies at least one target cloud host.

[0007] The packet capture control terminal responds to the packet capture task configuration operation for the target cloud host, determines the packet capture task for the target cloud host, and generates a packet capture instruction corresponding to the packet capture task.

[0008] The packet capture command is sent to the target cloud host through the command distribution module.

[0009] By executing the data capture operation corresponding to the packet capture instruction on the target cloud host, business data corresponding to the data capture operation can be obtained.

[0010] The business data is acquired through the capture control terminal and then displayed.

[0011] In some feasible implementations, the operation interface includes at least execution controls, and the generation of packet capture instructions corresponding to the packet capture task includes:

[0012] The capture control terminal generates a packet capture instruction corresponding to the packet capture task in response to the selection operation of the execution control.

[0013] In some feasible implementations, the execution control includes at least an immediate execution control and a timed execution control, the packet capture instruction includes at least an immediate execution instruction and a timed execution instruction, and the generation of the packet capture instruction corresponding to the packet capture task includes:

[0014] In response to a selection operation on the immediate command control, an immediate execution command corresponding to the packet capture task is generated; or, in response to a selection operation on the timed execution control, a timed execution command corresponding to the packet capture task is generated.

[0015] The immediate execution instruction is used to instruct the target cloud host to immediately perform the packet capture task; the timed execution instruction is used to instruct the target cloud host to perform the packet capture task at a set time point or at a preset time interval.

[0016] In some feasible implementations, the operation interface includes at least several parameter items, and the step of determining the packet capture task for the target cloud host in response to the packet capture task configuration operation for the target cloud host includes:

[0017] The capture control terminal responds to a selection operation for at least one of the parameter items, determines the target capture parameters, and configures a packet capture task for the target cloud host based on the target capture parameters.

[0018] The parameters include at least one of the following: network interface card (NIC), source IP, destination IP, source port, destination port, protocol information, and number of data packets; the protocol information includes at least one of the following: UDP protocol, TCP protocol, ICMP protocol, and FTP protocol.

[0019] In some feasible implementations, sending the packet capture command to the target cloud host through the command distribution module includes:

[0020] The packet capture command is encrypted by the command distribution module to generate a corresponding encrypted command, and the encrypted command is forwarded to the target cloud host.

[0021] In some feasible implementations, the cloud host is configured with a proxy unit, and the step of executing the data capture operation corresponding to the packet capture instruction through the target cloud host to obtain the business data corresponding to the data capture operation includes:

[0022] The encrypted command is decrypted by the proxy unit in the target cloud host to obtain the packet capture command, and the validity of the packet capture command is verified.

[0023] If the packet capture command passes the validity verification, the target capture parameters corresponding to the packet capture task are extracted from the packet capture command, and the data capture operation corresponding to the target capture parameters is executed to obtain the business data corresponding to the target capture parameters.

[0024] The business data is stored in a preset file path, and the preset file path and the file identifier corresponding to the business data are sent to the capture control terminal.

[0025] In some feasible implementations, the step of acquiring and displaying the business data through the capture control terminal includes:

[0026] The capture control terminal displays a display link corresponding to the target cloud host in the operation interface. In response to the trigger operation of the display link, the business data is obtained from the target cloud host according to the preset file path, and the data content corresponding to the business data is displayed.

[0027] This invention also discloses a centralized management system, which includes at least a capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module; wherein, the graphical user interface of the capture control terminal displays at least the operation interface corresponding to the centralized management system; wherein,

[0028] The capture control terminal, in response to a selection operation for the cloud host, identifies at least one target cloud host.

[0029] The packet capture control terminal responds to the packet capture task configuration operation for the target cloud host, determines the packet capture task for the target cloud host, and generates a packet capture instruction corresponding to the packet capture task.

[0030] The packet capture command is sent to the target cloud host through the command distribution module.

[0031] By executing the data capture operation corresponding to the packet capture instruction on the target cloud host, business data corresponding to the data capture operation can be obtained.

[0032] The business data is acquired through the capture control terminal and then displayed.

[0033] In some feasible implementations, the user interface includes at least execution controls; wherein,

[0034] The capture control terminal generates a packet capture instruction corresponding to the packet capture task in response to the selection operation of the execution control.

[0035] In some feasible implementations, the execution control includes at least an immediate execution control and a timed execution control, and the packet capture instruction includes at least an immediate execution instruction and a timed execution instruction; wherein,

[0036] The capture control terminal generates an immediate execution command corresponding to the packet capture task in response to the selection operation of the immediate command control, or generates a timed execution command corresponding to the packet capture task in response to the selection operation of the timed execution control.

[0037] The immediate execution instruction is used to instruct the target cloud host to immediately perform the packet capture task; the timed execution instruction is used to instruct the target cloud host to perform the packet capture task at a set time point or at a preset time interval.

[0038] In some feasible implementations, the user interface includes at least several parameter items; among which,

[0039] The capture control terminal responds to a selection operation for at least one of the parameter items, determines the target capture parameters, and configures a packet capture task for the target cloud host based on the target capture parameters.

[0040] The parameters include at least one of the following: network interface card (NIC), source IP, destination IP, source port, destination port, protocol information, and number of data packets; the protocol information includes at least one of the following: UDP protocol, TCP protocol, ICMP protocol, and FTP protocol.

[0041] In some feasible implementations, the packet capture command is encrypted by the command distribution module to generate a corresponding encrypted command, and the encrypted command is forwarded to the target cloud host.

[0042] In some feasible implementations, the cloud host is configured with a proxy unit, wherein,

[0043] The encrypted command is decrypted by the proxy unit in the target cloud host to obtain the packet capture command, and the validity of the packet capture command is verified.

[0044] If the packet capture command passes the validity verification, the target capture parameters corresponding to the packet capture task are extracted from the packet capture command, and the data capture operation corresponding to the target capture parameters is executed to obtain the business data corresponding to the target capture parameters.

[0045] The business data is stored in a preset file path, and the preset file path and the file identifier corresponding to the business data are sent to the capture control terminal.

[0046] Among some feasible implementation methods,

[0047] The capture control terminal displays a display link corresponding to the target cloud host in the operation interface. In response to the trigger operation of the display link, the business data is obtained from the target cloud host according to the preset file path, and the data content corresponding to the business data is displayed.

[0048] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0049] The memory is used to store computer programs;

[0050] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0051] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0052] The embodiments of the present invention have the following advantages:

[0053] In this embodiment of the invention, the system is applied to a centralized management system. The centralized management system includes at least a capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module. During the process of controlling the cloud hosts to remotely capture packets, the system can determine at least one target cloud host in response to a selection operation for the cloud host via the capture control terminal, and determine a packet capture task for the target cloud host in response to a packet capture task configuration operation for the target cloud host. The system then generates a packet capture instruction corresponding to the packet capture task. The instruction distribution module then sends the packet capture instruction to the target cloud host. The target cloud host then executes the data capture operation corresponding to the packet capture instruction to obtain the business data corresponding to the data capture operation. The capture control terminal obtains and displays the business data. Thus, the centralized management system can visualize the packet capture operation process, allowing users to intuitively experience the operation method, enriching the user's operation methods, reducing the difficulty of operation, and reducing the user's login process for remote cloud hosts by batch remotely controlling the cloud hosts. This also reduces the difficulty of obtaining business data packets. Attached Figure Description

[0054] Figure 1 This is a flowchart of the steps of a remote packet capture method based on a cloud host provided in an embodiment of the present invention;

[0055] Figure 2 This is a schematic diagram of the remote packet capture process provided in an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of the control interface provided in an embodiment of the present invention;

[0057] Figure 4 This is a schematic diagram of the packet capture process provided in an embodiment of the present invention;

[0058] Figure 5 This is a structural block diagram of a centralized management system provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] As an example, with the rapid development of cloud computing, various industries are increasingly connecting with Linux cloud servers, leading to a large number of web application servers migrating to the cloud, and even personal PCs are gradually migrating to cloud computers or cloud terminals. As the number of services on cloud servers increases, so do the problems encountered, such as how operations and maintenance personnel can quickly locate network faults, service status, and cloud server status on Linux servers. One common technique involves operations and maintenance personnel obtaining the cloud server's username and password from the user, logging into the cloud server, and then using packet capture tools (such as the tcpdump command) to capture, package, and upload packets for local analysis. This method is the most effective and direct; however, several significant problems still exist in this process:

[0061] 1. It is necessary to obtain the account and password from cloud server users. Some users do not want to give their account and password to third parties, but they still need the support of operations and maintenance personnel to locate faults, thus causing a conflict.

[0062] 2. There is a lack of a unified packet capture management interface or platform, which makes it impossible to simultaneously issue packet capture commands to multiple cloud hosts and arbitrarily extract the data packets captured by each cloud host on a unified interface.

[0063] 3. Packet capture can be performed using the tcpdump command that comes with the Linux system, but the tcpdump command has many parameters, which is not user-friendly or system administrators.

[0064] 4. Low packet capture efficiency. Maintenance personnel need to log in to the Linux cloud host first, then use the tcpdump command with the appropriate parameters (source IP, destination IP, port, network card, number of packets, etc.) to capture packets, and finally upload the captured packets from the cloud host to their local machine.

[0065] In this invention, the system is applied to a centralized management system. The centralized management system includes at least a capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module. The capture control terminal provides a unified control interface, allowing users to input corresponding capture configuration operations to remotely control the cloud hosts for packet capture. During remote packet capture, the system can respond to a selection operation for a cloud host via the capture control terminal, identifying at least one target cloud host. It also responds to a packet capture task configuration operation for the target cloud host, determining a packet capture task for that target cloud host and generating a corresponding packet capture task. The packet capture command is then sent to the target cloud host via the command distribution module. The target cloud host then executes the data capture operation corresponding to the packet capture command to obtain the business data corresponding to the data capture operation. The business data is also obtained through the capture control terminal and displayed. Thus, the packet capture operation process can be visualized through the centralized management system, allowing users to intuitively experience the operation method, enriching the user's operation methods, reducing the operation difficulty, and reducing the operation process by remotely controlling the cloud host in batches. This not only reduces the user's operation process of logging into the remote cloud host, but also reduces the difficulty of obtaining business data packets.

[0066] Reference Figure 1 This diagram illustrates a flowchart of a remote packet capture method based on a cloud host, provided in an embodiment of the present invention. The method is applied to a centralized management system, which includes at least a packet capture control terminal, at least two cloud hosts communicatively connected to the control terminal, and an instruction distribution module. The graphical user interface of the control terminal displays at least the operation interface corresponding to the centralized management system, and may specifically include the following steps:

[0067] Step 101: In response to the selection operation for the cloud host, the capture control terminal determines at least one target cloud host.

[0068] The centralized management system may include a packet capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module. The capture control terminal can be used to configure and issue packet capture instructions, stop packet capture instructions, and display a list of all data packet files for the cloud service; the instruction distribution module can be used to forward instructions to the corresponding cloud hosts; and the cloud hosts can be used to execute the corresponding packet capture instructions. Optionally, the cloud hosts can be Linux cloud hosts, and this invention does not limit this.

[0069] When remotely controlling a cloud host to capture packets, users can input corresponding user operations on the graphical user interface provided by the packet capture control terminal. The packet capture control terminal can determine the corresponding packet capture task based on the user operation and generate the corresponding packet capture instruction. Then, the instruction distribution module can distribute the packet capture instruction to the corresponding cloud host. After receiving the packet capture instruction, the cloud host performs packet capture according to the corresponding packet capture task, thereby realizing remote control of the cloud host to capture packets.

[0070] The capture control terminal can display a corresponding control interface through a graphical user interface. The control interface can include host controls corresponding to several cloud hosts. Users can select at least one of the host controls to determine the target cloud host to be captured, so as to set the corresponding capture parameters for the target cloud host.

[0071] Step 102: In response to the packet capture task configuration operation for the target cloud host, the capture control terminal determines the packet capture task for the target cloud host and generates a packet capture instruction corresponding to the packet capture task.

[0072] In this embodiment of the invention, after the user determines the target cloud host to be captured, the user can further input the corresponding packet capture task configuration operation in the control interface. The packet capture control terminal determines the packet capture task for the target cloud host based on the packet capture task configuration operation and generates the corresponding packet capture command so as to remotely control the target cloud host to capture packets through the packet capture command.

[0073] The operation interface includes at least several parameter items. After the user inputs a selection operation for a parameter item, the centralized management system responds to the selection operation for at least one parameter item through the capture control terminal, determines the target capture parameters, and configures a packet capture task for the target cloud host based on the target capture parameters.

[0074] Optionally, the parameter items include at least one of the following: network card, source IP, destination IP, source port, destination port, protocol information, and number of data packets; wherein, the protocol information includes at least one of the following: UDP (User Datagram Protocol), TCP (Transmission Control Protocol), ICMP (Internet Control Message Protocol), and FTP (File Transfer Protocol).

[0075] Furthermore, the user interface also includes at least an execution control. After the user selects the corresponding parameter item to determine the corresponding capture parameters, the user can also generate capture instructions corresponding to the capture task through the execution control, so as to control the target cloud host to perform corresponding data capture operations through different execution instructions. In specific implementation, the centralized management system can generate the packet capture instructions corresponding to the packet capture task through the capture control terminal in response to the selection operation of the execution control.

[0076] The execution controls include at least immediate execution controls and timed execution controls, and the packet capture commands include at least immediate execution commands and timed execution commands. The capture control terminal can respond to the selection operation of the immediate command control by generating an immediate execution command corresponding to the packet capture task, or respond to the selection operation of the timed execution control by generating a timed execution command corresponding to the packet capture task. By generating different types of capture commands, the cloud host can be controlled to perform corresponding data capture operations, allowing users to select according to their actual needs and meet their different packet capture requirements. Furthermore, the entire operation process does not require Linux cloud host administrators or users to have relevant knowledge; the corresponding capture tasks can be configured through simple operation methods, effectively reducing the difficulty of remotely controlling the cloud host for packet capture.

[0077] It should be noted that the immediate execution command is used to instruct the target cloud host to immediately perform packet capture tasks; the timed execution command is used to instruct the target cloud host to perform packet capture tasks at a set time point or at preset intervals.

[0078] Step 103: Send the packet capture command to the target cloud host through the command distribution module;

[0079] In practice, the instruction distribution module can be integrated into the capture control terminal or it can be independent of the capture control terminal. After the capture control terminal generates the corresponding packet capture instruction, the centralized management system can encrypt the packet capture instruction through the instruction distribution module, generate the corresponding encrypted instruction, and forward the encrypted instruction to the target cloud host so that the target cloud host can perform the corresponding data capture operation based on the packet capture instruction.

[0080] It should be noted that for packet capture commands, the command distribution module can encrypt the packet capture commands using the corresponding encryption algorithm before sending them out. After receiving the corresponding encrypted commands, the target cloud host can decrypt them according to the pre-agreed decryption method to obtain the corresponding packet capture commands.

[0081] Step 104: Execute the data capture operation corresponding to the packet capture command through the target cloud host to obtain the business data corresponding to the data capture operation;

[0082] Once the target cloud host receives the corresponding packet capture command, it can execute the data capture operation corresponding to the packet capture command to obtain the corresponding business data. The captured business data can then be returned to the capture control terminal, so that users can view the captured business data to understand the network faults, service status, and cloud host status in a timely manner, thereby facilitating timely operation and maintenance decisions.

[0083] In some feasible implementations, a proxy unit can be configured in the cloud host. The centralized management system can then decrypt the encrypted instructions through the proxy unit in the target cloud host to obtain the packet capture instructions. The validity of the packet capture instructions is then verified. If the packet capture instructions pass the validity verification, the target capture parameters corresponding to the packet capture task are extracted from the packet capture instructions, and the data capture operation corresponding to the target capture parameters is executed to obtain the business data corresponding to the target capture parameters. The business data is then stored in a preset file path, and the preset file path and the file identifier corresponding to the business data are sent to the capture control terminal so that the capture control terminal can obtain the corresponding business data based on the preset file path and the corresponding file identifier. If the packet capture instructions fail the validity verification, the target cloud host can directly discard the packet capture instructions and not execute the corresponding data capture operation.

[0084] It's important to note that validating packet capture commands can be achieved through various methods, including syntax checking, simulated execution, comparison with known correct commands, step-by-step verification, using a test environment, and reviewing error messages. These methods effectively ensure the syntax and format of packet capture commands, thereby improving their reliability and accuracy.

[0085] In one example, the target cloud host can use tcpdump to capture packets. Specifically, when using tcpdump, the target cloud host can specify the network interface card (NIC) to capture packets from in the capture parameters. The -i option allows you to select a specific NIC, such as eth0. Then, the src and dst options specify the source and destination IPs respectively, ensuring tcpdump only captures packets from the specified source IP and destined for the specified destination IP. Next, the port option allows you to specify a specific port number, such as port 80 or 443, ensuring tcpdump only captures packets associated with those ports. The proto option allows you to specify a specific protocol type, such as TCP or UDP, ensuring tcpdump only captures packets of that protocol. Furthermore, you can specify the number of packets to capture using the -c option, such as specifying to capture 100 packets. Based on the user-defined capture parameters, the target cloud host can perform corresponding data capture operations to capture relevant business data.

[0086] Step 105: Obtain the business data through the capture control terminal and display the business data.

[0087] In this embodiment of the invention, the capture control terminal displays a link corresponding to the target cloud host in the operation interface. In response to the trigger operation of the displayed link, business data is obtained from the target cloud host according to the preset file path, and the data content corresponding to the business data is displayed. Thus, the packet capture operation process can be visualized through the centralized management system, allowing users to intuitively experience the operation method, enriching the user's operation method, reducing the operation difficulty, and by batch remotely controlling the cloud host to capture packets, not only is the operation process of logging into the remote cloud host reduced, but the difficulty of obtaining business data packets is also reduced.

[0088] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0089] In this embodiment of the invention, the system is applied to a centralized management system. The centralized management system includes at least a capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module. During the process of controlling the cloud hosts to remotely capture packets, the system can determine at least one target cloud host in response to a selection operation for the cloud host via the capture control terminal, and determine a packet capture task for the target cloud host in response to a packet capture task configuration operation for the target cloud host. The system then generates a packet capture instruction corresponding to the packet capture task. The instruction distribution module then sends the packet capture instruction to the target cloud host. The target cloud host then executes the data capture operation corresponding to the packet capture instruction to obtain the business data corresponding to the data capture operation. The capture control terminal obtains and displays the business data. Thus, the centralized management system can visualize the packet capture operation process, allowing users to intuitively experience the operation method, enriching the user's operation methods, reducing the difficulty of operation, and reducing the user's login process for remote cloud hosts by batch remotely controlling the cloud hosts. This also reduces the difficulty of obtaining business data packets.

[0090] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the following examples are provided for illustrative purposes:

[0091] For a centralized management system, it can consist of a front-end display control module located in the capture control terminal, a command distribution module, an agent module located on the cloud host, and a data display module located on the capture control terminal. The front-end display control module displays the user's Linux cloud host configuration entries, command issuance buttons, and data packet displays. The command issuance buttons are divided into two types: immediate execution and scheduled execution. Selecting immediate execution sends the user-selected parameters to the command distribution module; selecting scheduled execution allows maintenance personnel or users to set a specific time point for the packet capture command to be issued. The command distribution module forwards the packet capture commands configured by the front-end display control module to the designated Linux cloud host. The agent module on the cloud host is responsible for executing the issued packet capture commands on the cloud host. After receiving the packet capture command forwarded by the command distribution module, this module first verifies the validity of the packet capture command. If it does not conform to the previously agreed rules, it is discarded; if it conforms to the rules, the packet capture task is executed. The data display module obtains the data packet files obtained by the agent module in performing the packet capture operation and then displays the data packet files.

[0092] Regarding the above process, refer to Figure 2 This diagram illustrates the remote packet capture process provided in this embodiment of the invention. Users can input corresponding user operations in the control interface to determine the capture task. After the front-end display control module determines the packet capture instruction based on the user operation, the instruction distribution module can forward the packet capture instruction configured by the front-end display control module to the designated Linux cloud host. The Linux cloud host receives the corresponding packet capture instruction through the corresponding agent, and performs the corresponding data packet capture operation after the validity verification is passed. Then, the captured data is stored in the httpd download directory so that the packet capture control terminal can obtain the corresponding data from the directory for display.

[0093] For the configuration process of the crawling task, please refer to... Figure 3This diagram illustrates the control interface provided in this embodiment of the invention. Users can manually input or select parameters such as the Linux remote cloud host's network card, source IP, destination IP, port, protocol type (e.g., HTTP, UDP, ICMP, and FTP), and the number of packets to be captured in the control interface displayed by the front-end control module. These parameters are then concatenated into a packet capture command in the command distribution module. After determining the capture parameters, packet capture can be performed on the specified Linux cloud host using either "immediate execution" or "scheduled execution" methods. The entire operation process does not require Linux cloud host maintenance personnel or users to have relevant knowledge; they can simply select the necessary parameters to complete the capture task configuration. This provides a visual representation of the packet capture process, allowing users to intuitively experience the operation, enriching their experience, and reducing the difficulty of operation. Furthermore, the control interface can display all Linux cloud hosts currently used by the maintenance personnel or users. At least two cloud hosts can be selected for packet capture in the control interface. By remotely controlling cloud hosts in batches for packet capture, not only is the user's operation process of logging into remote cloud hosts reduced, but the difficulty of obtaining business data packets can also be reduced.

[0094] Accordingly, refer to Figure 4 The diagram illustrates the packet capture process provided in this embodiment of the invention. After receiving the corresponding packet capture command through the agent module, the Linux cloud host can verify the validity of the packet capture command. If the verification fails, the packet capture command is directly discarded; if the verification passes, the packet capture operation is executed, and the current packet capture operation is terminated. The captured data is stored in the corresponding file directory (such as the Httpd download directory) for the capture control operation to retrieve the corresponding data.

[0095] A centralized management system can visualize the packet capture process, allowing users to intuitively understand the operation, enriching their experience, reducing operational difficulty, and enabling batch remote control of cloud hosts for packet capture. This not only reduces the user's need to log in to the remote cloud host but also lowers the difficulty of obtaining business data packets.

[0096] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0097] Reference Figure 5This diagram illustrates a structural block diagram of a centralized management system provided in an embodiment of the present invention. The centralized management system includes at least a capture control terminal, at least two cloud hosts communicatively connected to the capture control terminal, and an instruction distribution module. The graphical user interface of the capture control terminal displays at least the operation interface corresponding to the centralized management system.

[0098] The capture control terminal, in response to a selection operation for the cloud host, identifies at least one target cloud host.

[0099] The packet capture control terminal responds to the packet capture task configuration operation for the target cloud host, determines the packet capture task for the target cloud host, and generates a packet capture instruction corresponding to the packet capture task.

[0100] The packet capture command is sent to the target cloud host through the command distribution module.

[0101] By executing the data capture operation corresponding to the packet capture instruction on the target cloud host, business data corresponding to the data capture operation can be obtained.

[0102] The business data is acquired through the capture control terminal and then displayed.

[0103] In some feasible implementations, the user interface includes at least execution controls; wherein,

[0104] The capture control terminal generates a packet capture instruction corresponding to the packet capture task in response to the selection operation of the execution control.

[0105] In some feasible implementations, the execution control includes at least an immediate execution control and a timed execution control, and the packet capture instruction includes at least an immediate execution instruction and a timed execution instruction; wherein,

[0106] The capture control terminal generates an immediate execution command corresponding to the packet capture task in response to the selection operation of the immediate command control, or generates a timed execution command corresponding to the packet capture task in response to the selection operation of the timed execution control.

[0107] The immediate execution instruction is used to instruct the target cloud host to immediately perform the packet capture task; the timed execution instruction is used to instruct the target cloud host to perform the packet capture task at a set time point or at a preset time interval.

[0108] In some feasible implementations, the user interface includes at least several parameter items; among which,

[0109] The capture control terminal responds to a selection operation for at least one of the parameter items, determines the target capture parameters, and configures a packet capture task for the target cloud host based on the target capture parameters.

[0110] The parameters include at least one of the following: network interface card (NIC), source IP, destination IP, source port, destination port, protocol information, and number of data packets; the protocol information includes at least one of the following: UDP protocol, TCP protocol, ICMP protocol, and FTP protocol.

[0111] In some feasible implementations, the packet capture command is encrypted by the command distribution module to generate a corresponding encrypted command, and the encrypted command is forwarded to the target cloud host.

[0112] In some feasible implementations, the cloud host is configured with a proxy unit, wherein,

[0113] The encrypted command is decrypted by the proxy unit in the target cloud host to obtain the packet capture command, and the validity of the packet capture command is verified.

[0114] If the packet capture command passes the validity verification, the target capture parameters corresponding to the packet capture task are extracted from the packet capture command, and the data capture operation corresponding to the target capture parameters is executed to obtain the business data corresponding to the target capture parameters.

[0115] The business data is stored in a preset file path, and the preset file path and the file identifier corresponding to the business data are sent to the capture control terminal.

[0116] Among some feasible implementation methods,

[0117] The capture control terminal displays a display link corresponding to the target cloud host in the operation interface. In response to the trigger operation of the display link, the business data is obtained from the target cloud host according to the preset file path, and the data content corresponding to the business data is displayed.

[0118] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0119] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described remote packet capture method embodiment based on a cloud host and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0120] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the aforementioned cloud-host-based remote packet capture method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0121] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0122] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, EEPROM, Flash, and eMMC, etc.) containing computer-usable program code.

[0123] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0125] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 One or more processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0126] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0127] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0128] The above provides a detailed description of a remote packet capture method and a remote packet capture device based on a cloud host provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A remote packet capture method based on a cloud host, characterized in that: Applied to a centralized management system, the centralized management system at least includes a grab control terminal and at least two cloud hosts in communication with the grab control terminal, and an instruction distribution module; wherein the content displayed in the graphical user interface of the grab control terminal at least includes an operation interface corresponding to the centralized management system, and the method includes: Determining at least one target cloud host by the capture control terminal in response to a selection operation on the cloud host; Determining, by the capture control terminal, a packet capture task for the target cloud host in response to a packet capture task configuration operation for the target cloud host, and generating a packet capture instruction corresponding to the packet capture task; Sending the packet capture instruction to the target cloud host through the instruction distribution module; Executing the data capture operation corresponding to the packet capture instruction through the target cloud host to obtain business data corresponding to the data capture operation; The business data is acquired through the capture control terminal and displayed.

2. The method according to claim 1, characterized in that The operation interface at least includes an execution control, and the generating of a packet capture instruction corresponding to the packet capture task includes: The capture control terminal generates a packet capture instruction corresponding to the packet capture task in response to a selection operation on the execution control.

3. The method according to claim 2, characterized in that The execution control includes at least an immediate execution control and a scheduled execution control, the packet capture instruction includes at least an immediate execution instruction and a scheduled execution instruction, and the generating of the packet capture instruction corresponding to the packet capture task includes: In response to a selection operation on the immediate instruction control, generating an immediate execution instruction corresponding to the packet capture task, or, in response to a selection operation on the scheduled execution control, generating a scheduled execution instruction corresponding to the packet capture task; Among them, the immediate execution instruction is used to instruct the target cloud host to immediately perform the packet capture task; the scheduled execution instruction is used to instruct the target cloud host to perform the packet capture task at a set time point or at preset time intervals.

4. The method according to claim 1, characterized in that: The operation interface includes at least a plurality of parameter items, and the step of determining the packet capture task for the target cloud host in response to the packet capture task configuration operation for the target cloud host includes: Determining, by the capture control terminal, a target capture parameter in response to a selection operation on at least one of the parameter items, and configuring a packet capture task for the target cloud host based on the target capture parameter; Among them, the parameter items include at least one of the network card, source IP, destination IP, source port, destination port, protocol information and number of data packets; wherein the protocol information includes at least one of the UDP protocol, TCP protocol, ICMP protocol and FTP protocol.

5. The method according to claim 1, characterized in that The step of sending the packet capture instruction to the target cloud host through the instruction distribution module includes: The packet capture instruction is encrypted by the instruction distribution module, a corresponding encrypted instruction is generated, and the encrypted instruction is forwarded to the target cloud host.

6. The method according to claim 5, characterized in that The cloud host is provided with an agent unit, and the target cloud host executes the data capture operation corresponding to the packet capture instruction to obtain the business data corresponding to the data capture operation, including: Decrypting the encrypted instruction through the proxy unit in the target cloud host to obtain the packet capture instruction, and verifying the validity of the packet capture instruction; If the packet capture instruction passes the validity verification, a target capture parameter corresponding to the packet capture task is extracted from the packet capture instruction, and a data capture operation corresponding to the target capture parameter is performed to obtain business data corresponding to the target capture parameter; The business data is stored in a preset file path, and the preset file path and a file identifier corresponding to the business data are sent to the capture control terminal.

7. The method according to any one of claims 1 to 5, characterized in that: The acquiring the business data through the grabbing control terminal and displaying the business data includes: The crawling control terminal displays a display link corresponding to the target cloud host in the operation interface, responds to a trigger operation on the display link, obtains the business data from the target cloud host according to the preset file path, and displays data content corresponding to the business data.

8. A centralized management system, characterized in that: The centralized management system at least includes a grab control terminal and at least two cloud hosts in communication with the grab control terminal, and an instruction distribution module; wherein the content displayed in the graphical user interface of the grab control terminal at least includes an operation interface corresponding to the centralized management system; wherein, Determining at least one target cloud host by the capture control terminal in response to a selection operation on the cloud host; Determining, by the capture control terminal, a packet capture task for the target cloud host in response to a packet capture task configuration operation for the target cloud host, and generating a packet capture instruction corresponding to the packet capture task; Sending the packet capture instruction to the target cloud host through the instruction distribution module; Executing the data capture operation corresponding to the packet capture instruction through the target cloud host to obtain business data corresponding to the data capture operation; The business data is acquired through the capture control terminal and displayed.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images