Network traffic storage method, electronic equipment, storage medium and computer program product

Abstract

The invention provides a network flow storage method, electronic equipment, a storage medium and a computer program product, and the method comprises the steps: analyzing a quintuple from a data package, and determining a session table entry corresponding to the quintuple in a session table; writing message data of the data packet into a target data file corresponding to the session table item; writing a specified message header of the data packet into a target message header file corresponding to the session table item; wherein the specified message header is composed of a timestamp of the data packet, a first write-in position and a first data length, and the first write-in position and the first data length determine first position information of the message data in the target data file. According to the scheme, the storage cost in the network flow storage process is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for storing network traffic, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Source tracing analysis technology is becoming more and more mature, providing complete data and rich perspectives for full visualization of the network, attack analysis and attack tracing. Its role is self-evident. Full flow storage is the basis of source tracing analysis technology, and the storage and retrieval method of messages is the core of full flow storage. Under the pressure of massive traffic, the efficiency of message storage and retrieval is greatly challenged. Therefore, the storage and retrieval count of messages needs to be continuously improved and optimized.

[0003] During the network traffic storage process, the location information of each data packet needs to be recorded. The location information of a large number of data packets will significantly occupy storage space and increase storage costs. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a network traffic storage method and electronic device, a computer-readable storage medium, and a computer program product, so as to reduce the storage cost in the network traffic storage process.

[0005] On the one hand, the present application provides a method for storing network traffic, comprising:

[0006] Parsing a five-tuple from the data packet, and determining a session table entry corresponding to the five-tuple in the session table;

[0007] Writing the message data of the data packet into the target data file corresponding to the session table entry;

[0008] Construct a designated message header for the data packet, and write the designated message header into a target message header file corresponding to the session table entry; wherein the designated message header is composed of a timestamp, a first write position, and a first data length of the data packet, and the first write position and the first data length determine the first position information of the message data in the target data file.

[0009] Through the above measures, a specified message header can be constructed for the data packet to store the first position information of the message data in the target data file. There is no need to occupy additional memory space to store the position information of the message data, which effectively reduces the storage cost of network traffic during the storage process.

[0010] In one embodiment, writing the message data of the data packet into the target data file corresponding to the session table entry includes:

[0011] Cache the message data of the data packet in a cache linked list in a zero-copy manner, and determine the first position information of the message data in the target data file;

[0012] When the preset timer times out or the number of message data in the cache linked list reaches a first upper limit, all message data in the cache linked list are written into the target data file with their corresponding first position information.

[0013] Through the above measures, the message data in the cache linked list can be written to the target data file in batches when the trigger condition is met, without waiting for the session table entry to age before writing the message data to the target data file, which greatly reduces the requirement for cache space.

[0014] In one embodiment, writing the designated message header into a target message header file corresponding to the session table entry includes:

[0015] Cache the specified message headers of several data packets of the same session into the continuous memory corresponding to the session table entry;

[0016] When the number of specified message headers in the continuous memory of the session table entry reaches a second upper limit or the session table entry ages, determining second position information of all specified message headers in the continuous memory in the target message header file;

[0017] All designated message headers in the continuous memory are written into the target message header file through the second location information.

[0018] Through the above measures, the specified message headers with small data volume can be cached in the continuous memory corresponding to the session table entry, and when the number reaches the second upper limit value or the session table entry ages, multiple specified message headers can be written to the target message header file at one time, rather than writing the specified message headers one by one to the target message header file, thereby reducing the number of write times and improving the overall write performance of the device.

[0019] In one embodiment, the method further comprises:

[0020] The memory space where the designated message header written into the target message header file is located is released from the continuous memory.

[0021] Through the above measures, after the specified message header is written into the target message header file, the specified message header cached in the memory can be cleared to release memory resources, thereby improving the overall performance of the device.

[0022] In one embodiment, the method further comprises:

[0023] Recording metadata of the session indicated by the session entry in the session entry;

[0024] When the session entry ages, the metadata and third location information corresponding to the session entry are written into a database; wherein the third location information is composed of a plurality of second location information.

[0025] Through the above measures, metadata of each session and the third position information of the designated message header are written into the database as logs during the storage process, so that network traffic can be retrieved later with the help of the logs in the database.

[0026] In one embodiment, the method further comprises:

[0027] In response to a search instruction, determining metadata matching the search instruction in the database, and further determining third location information corresponding to the retrieved metadata;

[0028] Determine a corresponding target message header file according to the retrieved metadata, and extract a plurality of specified message headers from the target message header file according to third position information corresponding to the retrieved metadata;

[0029] Determine a target data file corresponding to the target message header file, and extract corresponding message data from the target data file according to the first position information in each designated message header;

[0030] Construct a standard pcap data packet based on each specified message header and its corresponding message data;

[0031] The constructed standard pcap data packet is written into a pcap file, and the pcap file is returned to the source of the retrieval instruction.

[0032] Through the above measures, multiple specified message headers that meet the search conditions can be quickly determined during the search process, and the message data can be read with the help of the first position information in each specified message header, thereby completing the retrieval of network traffic in a manner that adapts to the aforementioned storage process that saves disk space.

[0033] In one embodiment, parsing a quintuple from a data packet and determining a session table entry corresponding to the quintuple in a session table includes:

[0034] Parsing a five-tuple from the data packet, and determining whether a session table entry corresponding to the five-tuple exists in the session table;

[0035] If not, a session table entry corresponding to the quintuple is created in the session table.

[0036] Through the above measures, a corresponding session table entry can be created for a data packet of a session when it is processed for the first time, which is convenient for the subsequent storage process.

[0037] On the other hand, the present application provides an electronic device, the electronic device comprising:

[0038] processor;

[0039] a memory for storing processor-executable instructions;

[0040] Wherein, the processor is configured to execute the above-mentioned network traffic storage method.

[0041] Furthermore, the present application provides a computer-readable storage medium, which stores a computer program, and the computer program can be executed by a processor to complete the above-mentioned network traffic storage method.

[0042] In addition, the present application provides a computer program product, including a computer program / instruction, which implements the above-mentioned network traffic storage method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solution of the embodiments of the present application, the drawings required for use in the embodiments of the present application are briefly introduced below.

[0044] Figure 1 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application;

[0045] Figure 2 A schematic diagram of a flow chart of a method for storing network traffic provided in an embodiment of the present application;

[0046] Figure 3 A schematic diagram of a comparison of message headers provided in an embodiment of the present application;

[0047] Figure 4 An embodiment of the present application provides Figure 2 Detailed flow diagram of step 220;

[0048] Figure 5 An embodiment of the present application provides Figure 2 Detailed flow chart of step 230;

[0049] Figure 6 An overall flow chart of a method for storing network traffic provided by an embodiment of the present application;

[0050] Figure 7 A flowchart of a method for retrieving network traffic provided in one embodiment of the present application;

[0051] Figure 8 A block diagram of a storage device for network traffic provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0053] Similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0054] like Figure 1 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 1 A processor 11 is taken as an example. The processor 11 and the memory 12 are connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 so that the electronic device 1 can execute all or part of the process of the method in the following embodiment. In one embodiment, the electronic device 1 can be a host, a server, a server cluster or a cloud computing center, etc., for executing the storage method of network traffic.

[0055] The memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, disk or optical disk.

[0056] The present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by the processor 11 to complete the network traffic storage method provided by the present application.

[0057] The present application also provides a computer program product, including a computer program / instruction, which implements the network traffic storage method provided by the present application when the computer program / instruction is executed by a processor.

[0058] See also Figure 2 , is a flow chart of a method for storing network traffic provided by an embodiment of the present application, such as Figure 2As shown, the method may include the following steps 210 to 230.

[0059] Step 210: parse the five-tuple from the data packet, and determine the session table entry corresponding to the five-tuple in the session table.

[0060] After the electronic device executing the method for storing network traffic obtains the data packet from the traffic inlet, it can parse out a five-tuple from it. Here, the five-tuple can be a source IP (Internet Protocol Address), a destination IP, a protocol, a source port, and a destination port. Each five-tuple indicates the traffic of a session.

[0061] Furthermore, the session table entry corresponding to the five-tuple may be searched in the session table to determine whether there is a session table entry corresponding to the five-tuple in the session table.

[0062] On the one hand, if a session table entry corresponding to the five-tuple is found in the session table, the subsequent storage process can be executed with the help of the session table entry.

[0063] On the other hand, if there is no session table entry corresponding to the five-tuple in the session table, a session table entry corresponding to the five-tuple may be created in the session table, and subsequent storage processes may be performed with the help of the created session table entry.

[0064] Step 220: Write the message data of the data packet into the target data file corresponding to the session table entry.

[0065] For each session indicated by the session table entry, a corresponding target data file (referred to as a target .data file) may be created for it. The target data file is used to record the message data (PacketData) of multiple data packets belonging to the session.

[0066] The file name of the target data file may be recorded in the session table entry, and then the target data file corresponding to the session table entry may be determined based on the file name, and the message data of the data packet may be written into the target data file.

[0067] Step 230: Construct a specified message header for the data packet, and write the specified message header to the target message header file corresponding to the session table entry; wherein the specified message header is composed of the timestamp, the first write position and the first data length of the data packet, and the first write position and the first data length determine the first position information of the message data in the target data file.

[0068] The first write position indicates the write position of the message data in the target data file, and the first data length indicates the data length of the message data. For any data packet, the first write position of the message data of the current data packet can be determined according to the first position information of the message data of the previous data packet, and the first data length can be determined by the message data itself.

[0069] For each data packet, a corresponding designated message header may be constructed for it, in which the timestamp of the data packet, the first writing position of the message data in the target data file and the first data length of the message data are written.

[0070] See also Figure 3 , is a comparative schematic diagram of a message header provided in an embodiment of the present application, such as Figure 3 As shown, the specified message header (My Packet Header) consists of a timestamp (Timestamp), a first data length ( Figure 3 The capture length is equal to the first data length of the message data) and the first write position (Offset); while the standard pcp message header (Pacp PacketHeader) is composed of a timestamp (Timestamp), a capture length and an actual length.

[0071] Since the captured length in the standard pacp message header is consistent with the actual length, the actual length is changed to the first write position of the message data in the target data file, so that the specified message header can be constructed (of course, the arrangement of the timestamp, the first data length and the first write position in the specified message header can be flexibly configured, not limited to Figure 3 In this case, the first position information of the message data can be determined by specifying the first write position and the first data length in the message header, and the message data can be read from the target data file through the first position information.

[0072] Through the above measures, a specified message header can be constructed for the data packet to store the first position information of the message data in the target data file. There is no need to occupy additional memory space to store the position information of the message data, which effectively reduces the storage cost of network traffic during the storage process.

[0073] In one embodiment, see Figure 4 , provided in one embodiment of the present application Figure 2 The detailed flow chart of step 220 is as follows: Figure 4 As shown, when executing step 220, the following steps 410 to 420 may be executed.

[0074] Step 410: Cache the message data of the data packet in a cache linked list in a zero-copy manner, and determine the first position information of the message data in the target data file.

[0075] After the electronic device obtains the data packet, the data packet is temporarily stored in the memory of the electronic device. To process it, the message data of the data packet can be cached in the cache linked list of the thread in a zero-copy manner. In this case, there is no need to cache the message data itself, but only cache the location information of the message data in the memory in the cache linked list, which can reduce the workload of data transmission.

[0076] Furthermore, for the message data in the cache linked list, the first write position of the message data in the target data file can be determined through the first position information of the message data of the previous data packet of the session to which the data packet belongs, and then the first position information can be determined based on the first write position and the first data length of the message data.

[0077] Step 420: When the preset timer times out or the number of message data in the cache linked list reaches a first upper limit, all message data in the cache linked list are written into the target data file with their corresponding first position information.

[0078] The batch writing of message data to the target data file is triggered by setting a timer. At this time, the cycle length of the timer can be configured based on experience.

[0079] Alternatively, a first upper limit value of the cache linked list may be set, which indicates the maximum number of message data that the cache linked list can store. When the number of message data in the cache linked list reaches the first upper limit value, batch writing of message data to the target data file may be triggered.

[0080] Alternatively, the batch writing of message data to the target data file may be triggered by two conditions, namely, a timer and a first upper limit value. In this case, the batch writing of message data to the target data file may be performed when any one of the conditions is satisfied.

[0081] Since the cache linked list records the location information of multiple message data in the memory, the message data can be obtained from the memory according to the location information, and then the message data is written to the location indicated by the first location information in the target data file.

[0082] Through the above measures, the message data in the cache linked list can be written to the target data file in batches when the trigger condition is met, without waiting for the session table entry to age before writing the message data to the target data file, which greatly reduces the requirement for cache space.

[0083] In one embodiment, see Figure 5 , provided in one embodiment of the present application Figure 2 The detailed flow chart of step 230 is as follows: Figure 5 As shown, when executing step 230, the following steps 510 to 530 may be executed.

[0084] Step 510: Cache the designated message headers of several data packets of the same session into the continuous memory corresponding to the session table entry.

[0085] When processing several data packets of the same session, after constructing corresponding designated message headers for each data packet, these designated message headers can be cached in the continuous memory corresponding to the session table entry of the session. In other words, each time a new designated message header is constructed, the new designated message header can be written starting from the end position of the previous designated message header in the memory space corresponding to the session table entry.

[0086] Step 520: When the number of designated message headers in the continuous memory of the session table entry reaches a second upper limit or the session table entry ages, second position information of all designated message headers in the continuous memory in the target message header file is determined.

[0087] Step 530: Write all designated message headers in the continuous memory into the target message header file through the second location information.

[0088] A second upper limit value of the continuous memory may be set, indicating the maximum number of designated message headers that can be stored in the continuous memory. When the number of designated message headers in the continuous memory of the session entry reaches the second upper limit value, it may trigger writing all designated message headers in the continuous memory to the target message header file.

[0089] Alternatively, when the session table entry ages, it may trigger the writing of all specified message headers in the continuous memory to the target message header file.

[0090] In this case, the writing position of the first designated message header in the target message header file and the termination position of the last designated message header in the target message header file in the continuous memory may be determined as the second position information.

[0091] After the second position information is obtained, all designated message headers in the continuous memory may be written as a whole into the target message header file with the second position information.

[0092] Through the above measures, the specified message headers with small data volume can be cached in the continuous memory corresponding to the session table entry, and when the number reaches the second upper limit value or the session table entry ages, multiple specified message headers can be written to the target message header file at one time, rather than writing the specified message headers one by one to the target message header file, thereby reducing the number of write times and improving the overall write performance of the device.

[0093] In one embodiment, after each triggering of writing a plurality of designated message headers in the continuous memory to the target message header file corresponding to the session table entry, the memory space where the designated message headers written into the target message header file are located may be released from the continuous memory.

[0094] This measure can release memory resources after writing the specified message header to the target message header file, thereby improving the overall performance of the device.

[0095] In one embodiment, when storing data packets of any session, metadata of the session indicated by the session entry may be recorded in the session entry. Here, the metadata may include the aforementioned five-tuple, application type, number of uplink and downlink messages, and other information.

[0096] When a session table entry ages, the recorded metadata and the third position information corresponding to the session table entry can be written to the database. Here, the database can select a column-based database to optimize query performance. The third position information is the position information of all specified message headers of the session indicated by the session table entry in the target message header file. The third position information is composed of a number of second position information. Exemplarily, if the specified message header of any session is written to the target message header file only in one writing process, at this time, the third position information of the session is the second position information at the time of this writing. If the specified message header of any session is written to the target message header file in at least two writing processes, at this time, the third position information of the session is obtained by splicing the second position information of at least two writing processes.

[0097] Through the above measures, metadata of each session and the third position information of the designated message header are written into the database as logs during the storage process, so that network traffic can be retrieved later with the help of the logs in the database.

[0098] To explain the overall process of network traffic storage, see Figure 6 , is an overall flow chart of a method for storing network traffic provided by an embodiment of the present application, such as Figure 6 As shown, after obtaining a data packet from a traffic inlet, the five-tuple of the data packet can be parsed, and a session table entry corresponding to the five-tuple can be determined in the session table.

[0099] Furthermore, the message data in the data packet is cached in a zero-copy manner in a cache linked list corresponding to the thread, and the first position information of the message data in the target data file corresponding to the session table entry is calculated. During the storage of network traffic, the metadata of the session can be recorded in the session table entry, and the specified message header of each data packet of the session can be cached in a continuous memory of the session table entry.

[0100] In the process of storing network traffic, it can be determined whether the number of message data in the cache linked list reaches the first upper limit value, or whether the timer has timed out, so as to determine whether the trigger condition for writing the message data into the target data file is met. If the trigger condition is not met, it can continue to wait, and if the trigger condition is met, the message data can be written into the target data file in batches according to the pre-calculated first position information.

[0101] In the process of storing network traffic, it can be determined whether the number of specified message headers in the continuous memory of the session table entry reaches the second upper limit value, or whether the session table entry is aged, so as to determine whether the trigger condition for writing the specified message header into the target message header file is met. If the trigger condition is not met, the system can continue to wait, and if the trigger condition is met, the second position information of multiple specified message headers in the continuous memory in the target message header file can be determined, the second position information can be recorded in the session table entry, and the specified message header can be written into the target message header file at one time according to the second position information.

[0102] During the storage of network traffic, it can be determined whether the session entry has aged. If not, it can continue to wait. If it has aged, the metadata of the session and the third position information of the specified message header in the target message header file can be written into the database to facilitate the subsequent retrieval process.

[0103] In one embodiment, see Figure 7 , is a flow chart of a method for retrieving network traffic provided by an embodiment of the present application, such as Figure 7 As shown, the method may include the following steps 710 to 750.

[0104] Step 710: In response to a search instruction, metadata matching the search instruction is determined in a database, and then third location information corresponding to the retrieved metadata is determined.

[0105] When a user needs to view network traffic, a search instruction can be constructed as needed, and a search instruction can be initiated to an electronic device storing network traffic. Here, the search instruction indicates to search for network traffic that meets the search conditions, and the search conditions can be configured as needed. Exemplarily, the search conditions can be any one or more combinations of source IP, destination IP, quintuple, protocol, receiving time, etc.

[0106] After the electronic device obtains the search instruction, it can parse the search conditions therein and search the database for metadata matching the search conditions as metadata matching the search instruction. After the metadata is retrieved, the third location information corresponding to the metadata can be determined.

[0107] Step 720: Determine a corresponding target message header file according to the retrieved metadata, and extract a plurality of designated message headers from the target message header file according to the third position information corresponding to the retrieved metadata.

[0108] The metadata may include the file identifier of the corresponding target message header file (e.g., file name, file ID, etc.), so the corresponding target message header file can be determined according to the file identifier in the retrieved metadata. After obtaining the target message header file, multiple specified message headers can be extracted from the target message header file according to the third position information corresponding to the metadata. Here, after reading data from the target message header file according to the third position information, the read data can be split according to the data length of a single specified message header, thereby obtaining multiple specified message headers.

[0109] Step 730: Determine a target data file corresponding to the target message header file, and extract corresponding message data from the target data file using the first position information in each designated message header.

[0110] The target message header file and the target data file of the same session are associated through a preset mapping relationship, so the corresponding target data file can be determined through the target message header file. Exemplarily, the target message header file and the target data file have the same file identifier (but different file types).

[0111] Since each designated message header records the first position information of the message data of the corresponding data packet, the corresponding message data can be extracted from the target data file based on the first position information in each designated message header.

[0112] Step 740: Construct a standard pcap data packet according to each specified message header and its corresponding message data.

[0113] After extracting the corresponding message data for each specified message header, the specified message header can be converted into a standard pcap message header (the first write position is replaced with the actual length, and each field is arranged in the order specified by the standard pcap message header), and then the standard pcap message header is combined with the message data to construct a standard pcap data packet.

[0114] Step 750: Write the constructed standard pcap data packet into a pcap file, and return the pcap file to the source of the retrieval instruction.

[0115] After constructing the standard pcap data packet, multiple standard pcap data packets of the same session can be written into a pcap file, thereby obtaining at least one pcap file. Further, the pcap file can be returned to the source of the retrieval instruction, thereby completing the retrieval process.

[0116] Through the above measures, multiple specified message headers that meet the search conditions can be quickly determined during the search process, and the message data can be read with the help of the first position information in each specified message header, thereby completing the retrieval of network traffic in a manner that adapts to the aforementioned storage process that saves disk space.

[0117] Figure 8 is a block diagram of a network traffic storage device according to an embodiment of the present invention. Figure 8 As shown, the device may include:

[0118] A determination module 810, configured to parse a quintuple from a data packet and determine a session table entry corresponding to the quintuple in a session table;

[0119] A first writing module 820, configured to write the message data of the data packet into a target data file corresponding to the session table entry;

[0120] The second writing module 830 is used to construct a specified message header for the data packet and write the specified message header to the target message header file corresponding to the session table entry; wherein the specified message header is composed of the timestamp, the first writing position and the first data length of the data packet, and the first writing position and the first data length determine the first position information of the message data in the target data file.

[0121] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned network traffic storage method, which will not be repeated here.

[0122] In several embodiments provided in the present application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram may represent a module, a program segment or a part of a code, and a module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0124] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

Claims

1. A method for storing network traffic, characterized in that: include: Parsing a five-tuple from the data packet, and determining a session table entry corresponding to the five-tuple in the session table; Writing the message data of the data packet into the target data file corresponding to the session table entry; Construct a designated message header for the data packet, and write the designated message header into a target message header file corresponding to the session table entry; wherein the designated message header is composed of a timestamp, a first write position, and a first data length of the data packet, and the first write position and the first data length determine the first position information of the message data in the target data file.

2. The method according to claim 1, characterized in that The step of writing the message data of the data packet into the target data file corresponding to the session table entry includes: Cache the message data of the data packet in a cache linked list in a zero-copy manner, and determine the first position information of the message data in the target data file; When the preset timer times out or the number of message data in the cache linked list reaches a first upper limit, all message data in the cache linked list are written into the target data file with their corresponding first position information.

3. The method according to claim 1, characterized in that The step of writing the designated message header into a target message header file corresponding to the session table entry includes: Cache the specified message headers of several data packets of the same session into the continuous memory corresponding to the session table entry; When the number of specified message headers in the continuous memory of the session table entry reaches a second upper limit or the session table entry ages, determining second position information of all specified message headers in the continuous memory in the target message header file; All designated message headers in the continuous memory are written into the target message header file through the second location information.

4. The method according to claim 3, characterized in that The method further comprises: The memory space where the designated message header written into the target message header file is located is released from the continuous memory.

5. The method according to claim 3, characterized in that: The method further comprises: Recording metadata of the session indicated by the session entry in the session entry; When the session entry ages, the metadata and third location information corresponding to the session entry are written into a database; wherein the third location information is composed of a plurality of second location information.

6. The method according to claim 5, characterized in that The method further comprises: In response to a search instruction, determining metadata matching the search instruction in the database, and further determining third location information corresponding to the retrieved metadata; Determine a corresponding target message header file according to the retrieved metadata, and extract a plurality of specified message headers from the target message header file according to third position information corresponding to the retrieved metadata; Determine a target data file corresponding to the target message header file, and extract corresponding message data from the target data file according to the first position information in each designated message header; Construct a standard pcap data packet based on each specified message header and its corresponding message data; The constructed standard pcap data packet is written into a pcap file, and the pcap file is returned to the source of the retrieval instruction.

7. The method according to claim 1, characterized in that The step of parsing a five-tuple from a data packet and determining a session table entry corresponding to the five-tuple in a session table includes: Parsing a five-tuple from the data packet, and determining whether a session table entry corresponding to the five-tuple exists in the session table; If not, a session table entry corresponding to the quintuple is created in the session table.

8. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the network traffic storage method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program can be executed by a processor to complete the network traffic storage method described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the method for storing network traffic described in any one of claims 1 to 7 is implemented.

Images