Network traffic storage method, electronic device, storage medium, and computer program product

Abstract

This application provides a method for storing network traffic, as well as an electronic device, storage medium, and computer program product, comprising: parsing a 5-tuple from a data packet and determining a session entry corresponding to the 5-tuple in a session table; writing the packet data to a target data file corresponding to the session entry; and writing a specified header of the data packet to a target header file corresponding to the session entry; wherein the specified header consists of a timestamp of the data packet, a first write position, and a first data length, and the first write position and the first data length determine a first position information of the packet data in the target data file. This application's solution reduces storage costs during network traffic storage.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method for storing network traffic and an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Source tracing analysis technology is maturing, providing complete data and rich perspectives for full network visualization, attack analysis, and attack attribution; its importance is self-evident. Full traffic storage is the foundation of source tracing analysis technology, and the methods of packet storage and retrieval are the core of full traffic storage. Under massive traffic pressure, the efficiency of packet storage and retrieval is severely challenged; therefore, packet storage and retrieval counting require continuous improvement and optimization.

[0003] During network traffic storage, it is necessary to record the location information of each data packet. The location information of a large number of data packets will significantly occupy storage space and increase storage costs. Summary of the Invention

[0004] The purpose of this application is to provide a method for storing network traffic, as well as an electronic device, a computer-readable storage medium, and a computer program product, to reduce storage costs during the network traffic storage process.

[0005] On the one hand, this application provides a method for storing network traffic, including:

[0006] Parse the 5-tuple from the data packet and determine the session table entry corresponding to the 5-tuple in the session table;

[0007] Write the message data of the data packet to the target data file corresponding to the session entry;

[0008] A specified message header is constructed for the data packet, and the specified message header is written to the target message header file corresponding to the session table entry; wherein, the specified message header consists of the timestamp of the data packet, a first write position, and a first data length, and the first write position and the first data length determine the first position information of the message data in the target data file.

[0009] By implementing the above measures, a specified header can be constructed for the data packets to store the first position information of the packet data in the target data file. This eliminates the need to occupy additional memory space to store the position information of the packet data, effectively reducing the storage cost of network traffic during the storage process.

[0010] In one embodiment, writing the packet data to the target data file corresponding to the session entry includes:

[0011] The message data of the data packet is cached in a cache list in a zero-copy manner, and the first position information of the message data in the target data file is determined;

[0012] When the preset timer expires or the number of message data in the cache list reaches the first upper limit, all message data in the cache list are written to the target data file with their corresponding first position information.

[0013] By implementing the above measures, message data in the cache linked list can be written to the target data file in batches when the conditions are met, without having to wait for the session table entries to age before writing message data to the target data file, which greatly reduces the requirements for cache space.

[0014] In one embodiment, writing the specified message header to the target message header file corresponding to the session entry includes:

[0015] Cache the specified headers of several data packets from the same session into the contiguous memory corresponding to the session entry;

[0016] When the number of specified message headers in the contiguous memory of the session entry reaches the second upper limit or the session entry ages, determine the second position information of all specified message headers in the contiguous memory in the target message header file;

[0017] The second location information is used to write all specified message headers in the contiguous memory to the target message header file.

[0018] By implementing the above measures, small-volume specified message headers can be cached in contiguous memory corresponding to the session table entries. When the number of specified headers reaches the second upper limit or the session table entries age, multiple specified message headers can be written to the target message header file at once, instead of writing each specified message header to the target message header file one by one. This reduces the number of writes and improves the overall write performance of the device.

[0019] In one embodiment, the method further includes:

[0020] Release the memory space containing the specified header that has been written into the target header file from the contiguous memory.

[0021] By implementing the above measures, after writing the specified message header to the target message header file, the cached specified message header in memory can be cleared to release memory resources and improve the overall performance of the device.

[0022] In one embodiment, the method further includes:

[0023] The session entry records the metadata indicating the session.

[0024] When the session entry ages, the metadata and the third location information corresponding to the session entry are written to the database; wherein, the third location information is composed of several second location information.

[0025] By implementing the above measures, the metadata of each session and the third location information of the specified message header are written as logs to the database during the storage process, so that network traffic can be retrieved later using the logs in the database.

[0026] In one embodiment, the method further includes:

[0027] In response to a search command, metadata matching the search command is determined in the database, and then the third location information corresponding to the retrieved metadata is determined.

[0028] The corresponding target message header file is determined based on the retrieved metadata, and multiple specified message headers are extracted from the target message header file based on the third location information corresponding to the retrieved metadata.

[0029] Determine the target data file corresponding to the target message header file, and extract the corresponding message data from the target data file using the first position information in each specified message header;

[0030] A standard pcap packet is constructed based on each specified header and its corresponding packet data;

[0031] The constructed standard pcap data packet is written into a pcap file, and the pcap file is returned to the source of the retrieval instruction.

[0032] Through the above measures, multiple specified message headers that meet the search criteria can be quickly identified during the search process, and message data can be read with the help of the first position information in each specified message header, thereby completing the search of network traffic in a way that adapts to the aforementioned storage process that saves disk space.

[0033] In one embodiment, parsing the 5-tuple from the data packet and determining the session entry corresponding to the 5-tuple in the session table includes:

[0034] Parse the 5-tuple from the data packet and determine whether there is a session table entry corresponding to the 5-tuple in the session table;

[0035] If not, create a session table entry corresponding to the quintuple in the session table.

[0036] By implementing the above measures, a corresponding session table entry can be created when processing a session's data packet for the first time, which facilitates subsequent storage processes.

[0037] On the other hand, this application provides an electronic device, the electronic device comprising:

[0038] processor;

[0039] Memory used to store processor-executable instructions;

[0040] The processor is configured to execute the aforementioned method for storing network traffic.

[0041] Furthermore, this application provides a computer-readable storage medium storing a computer program that can be executed by a processor to perform the above-described method for storing network traffic.

[0042] In addition, this application provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the above-described method for storing network traffic. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.

[0044] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0045] Figure 2 A flowchart illustrating a method for storing network traffic according to an embodiment of this application;

[0046] Figure 3 A comparative schematic diagram of message headers provided in an embodiment of this application;

[0047] Figure 4 Provided for an embodiment of this application Figure 2 A detailed flowchart of step 220 is shown below;

[0048] Figure 5 Provided for an embodiment of this application Figure 2 A detailed flowchart of step 230 is shown below;

[0049] Figure 6 A flowchart illustrating the overall process of storing network traffic according to an embodiment of this application;

[0050] Figure 7 A schematic flowchart illustrating a network traffic retrieval method provided in an embodiment of this application;

[0051] Figure 8 A block diagram of a network traffic storage device provided in an embodiment of this application. Detailed Implementation

[0052] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0053] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] like Figure 1 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12. Figure 1 Taking a processor 11 as an example, the processor 11 and the memory 12 are connected via a bus 10. The memory 12 stores instructions that can be executed by the processor 11. The instructions are executed by the processor 11 to enable the electronic device 1 to perform all or part of the processes of the methods described in the following embodiments. In one embodiment, the electronic device 1 may be a host, server, server cluster, or cloud computing center, etc., for executing the network traffic storage method.

[0055] The memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable red-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0056] This application also provides a computer-readable storage medium storing a computer program that can be executed by a processor 11 to perform the network traffic storage method provided in this application.

[0057] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the network traffic storage method provided in this application.

[0058] See also Figure 2 This is a flowchart illustrating a method for storing network traffic according to an embodiment of this application. Figure 2As shown, the method may include steps 210-230.

[0059] Step 210: Parse the 5-tuple from the data packet and determine the session table entry corresponding to the 5-tuple in the session table.

[0060] After an electronic device implementing a network traffic storage method obtains data packets from the traffic ingress, it can parse out the 5-tuples. Here, the 5-tuple can be the source IP (Internet Protocol Address), destination IP, protocol, source port, and destination port. Each 5-tuple indicates the traffic of a session.

[0061] Furthermore, a session table entry corresponding to the 5-tuple can be searched in the session table to determine whether a session table entry corresponding to the 5-tuple exists in the session table.

[0062] On the one hand, if a session table entry corresponding to the quintuple is found in the session table, subsequent storage processes can be executed using that session table entry.

[0063] On the other hand, if there is no session table entry corresponding to the 5-tuple in the session table, a session table entry corresponding to the 5-tuple can be created in the session table, and subsequent storage processes can be executed with the help of the created session table entry.

[0064] Step 220: Write the packet data to the target data file corresponding to the session table entry.

[0065] For each session indicated by a session entry, a corresponding target data file (denoted as target.data file) can be created for it. This target data file is used to record the packet data of multiple data packets belonging to this session.

[0066] The session entry can record the filename of the target data file, and then the target data file corresponding to the session entry can be determined based on the filename, and the packet data can be written to the target data file.

[0067] Step 230: Construct a specified header for the data packet and write the specified header to the target header file corresponding to the session table entry; wherein, the specified header consists of the timestamp of the data packet, the first write position and the first data length, and the first write position and the first data length determine the first position information of the data packet in the target data file.

[0068] The first write position indicates the write position of the message data in the target data file, and the first data length indicates the data length of the message data. For any data packet, the first write position of the message data of the current data packet can be determined based on the first position information of the message data of the previous data packet, while the first data length can be determined by the message data itself.

[0069] For each data packet, a corresponding specified header can be constructed, which contains the timestamp of the data packet, the first write position of the data packet in the target data file, and the first data length of the data packet.

[0070] See also Figure 3 This is a comparative schematic diagram of the message header provided in an embodiment of this application, as shown below. Figure 3 As shown, the specified packet header (My Packet Header) consists of a timestamp, a first data length, and a second data length. Figure 3 The capture length is equal to the first data length of the message data, and the first write position (Offset) constitutes the packet; while the standard PCP packet header consists of a timestamp, the capture length, and the actual length.

[0071] Since the capture length in the standard PCP header is consistent with the actual length, by changing the actual length to the first write position of the message data in the target data file, a specified header can be constructed. (Of course, the arrangement of the timestamp, first data length, and first write position in the specified header can be flexibly configured and is not limited to...) Figure 3 In this case, the first position information of the message data can be determined by using the first write position and the first data length in the specified message header, and then the message data can be read from the target data file through the first position information.

[0072] By implementing the above measures, a specified header can be constructed for the data packets to store the first position information of the packet data in the target data file. This eliminates the need to occupy additional memory space to store the position information of the packet data, effectively reducing the storage cost of network traffic during the storage process.

[0073] In one embodiment, see Figure 4 This is provided as an embodiment of the present application. Figure 2 A detailed flowchart of step 220 is shown below. Figure 4 As shown, when executing step 220, steps 410 to 420 can be executed.

[0074] Step 410: Cache the packet data into the cache list in a zero-copy manner, and determine the first position information of the packet data in the target data file.

[0075] After an electronic device receives a data packet, it temporarily stores the packet in its memory. To process it, the packet's message data can be cached in a thread's cache list using a zero-copy method. In this case, there is no need to cache the message data itself; only the location information of the message data in memory is cached in the cache list, which reduces the workload of data transmission.

[0076] Furthermore, for message data in the cached list, the first write position of the message data in the target data file can be determined by the first position information of the message data of the previous data packet of the session to which the message data belongs, and then the first position information can be determined based on the first write position and the first data length of the message data.

[0077] Step 420: When the preset timer expires or the number of message data in the cache list reaches the first upper limit, write all message data in the cache list to the target data file with their corresponding first position information.

[0078] By setting a timer, message data can be written to the target data file in batches. At this time, the period of the timer can be configured according to experience.

[0079] Alternatively, a first upper limit value can be set for the cache list, which indicates the maximum number of message data that the cache list can store. When the number of message data in the cache list reaches the first upper limit value, batch writing of message data to the target data file can be triggered.

[0080] Alternatively, batch writing of message data to the target data file can be triggered by two conditions: a timer and a first upper limit value. In this case, batch writing of message data to the target data file can be performed whenever either condition is met.

[0081] Since the cache list records the location information of multiple message data in memory, the message data can be retrieved from memory based on the location information, and then written to the location indicated by the first location information in the target data file.

[0082] By implementing the above measures, message data in the cache linked list can be written to the target data file in batches when the conditions are met, without having to wait for the session table entries to age before writing message data to the target data file, which greatly reduces the requirements for cache space.

[0083] In one embodiment, see Figure 5 This is provided as an embodiment of the present application. Figure 2 A detailed flowchart of step 230 is shown below. Figure 5 As shown, when executing step 230, steps 510 to 530 can be executed.

[0084] Step 510: Cache the specified headers of several data packets from the same session into the contiguous memory corresponding to the session table entry.

[0085] When processing multiple data packets within the same session, after constructing the corresponding specified header for each data packet, these specified headers can be cached in contiguous memory corresponding to the session's session table entry. In other words, each time a new specified header is constructed, it can be written to the memory space corresponding to the session table entry, starting from the end position of the previous specified header.

[0086] Step 520: When the number of specified headers in the contiguous memory of the session table reaches the second upper limit or the session table entry ages, determine the second position information of all specified headers in the contiguous memory in the target header file.

[0087] Step 530: Write all specified message headers in contiguous memory to the target message header file using the second location information.

[0088] A second upper limit value can be set for contiguous memory, which indicates the maximum number of specified headers that can be stored in contiguous memory. When the number of specified headers in the contiguous memory of a session entry reaches the second upper limit value, writing all specified headers in contiguous memory to the target header file can be triggered.

[0089] Alternatively, when a session entry ages out, you can trigger the writing of all specified headers in contiguous memory to the target header file.

[0090] In this case, the writing position of the first specified message header in the target message header file and the ending position of the last specified message header in the target message header file can be determined as the second position information.

[0091] After obtaining the second location information, all specified message headers in contiguous memory can be written to the target message header file as a whole, along with the second location information.

[0092] By implementing the above measures, small-volume specified message headers can be cached in contiguous memory corresponding to the session table entries. When the number of specified headers reaches the second upper limit or the session table entries age, multiple specified message headers can be written to the target message header file at once, instead of writing each specified message header to the target message header file one by one. This reduces the number of writes and improves the overall write performance of the device.

[0093] In one embodiment, after each triggering of writing multiple specified headers to the target header file corresponding to the session table entry into contiguous memory, the memory space containing the specified headers that have been written to the target header file can be released from contiguous memory.

[0094] This measure allows memory resources to be released after the specified message header is written to the target message header file, thus improving the overall performance of the device.

[0095] In one embodiment, during the storage of data packets for any session, metadata indicating the session can be recorded in the session table entry. Here, the metadata may include information such as the aforementioned five-tuple, application type, and number of uplink and downlink packets.

[0096] When a session entry ages out, the recorded metadata and the corresponding third position information can be written to the database. Here, a columnar database can be selected to optimize query performance. The third position information indicates the position of all specified headers of the session within the target header file. This third position information is composed of several second position information entries. For example, if a specified header of any session is written to the target header file only once, the third position information for that session is the second position information at the time of that write. If a specified header of any session is written to the target header file in at least two write processes, the third position information for that session is obtained by concatenating the second position information from both write processes.

[0097] By implementing the above measures, the metadata of each session and the third location information of the specified message header are written as logs to the database during the storage process, so that network traffic can be retrieved later using the logs in the database.

[0098] To illustrate the overall process of network traffic storage, see [link / reference]. Figure 6 The above is an overall flowchart of a network traffic storage method provided in an embodiment of this application, as shown below. Figure 6 As shown, after obtaining a data packet from the traffic inlet, the five-tuple of the data packet can be parsed, and the corresponding session table entry can be determined in the session table.

[0099] Furthermore, the packet data is cached in a zero-copy manner into the cache list corresponding to the thread, and the first position information of the packet data in the target data file corresponding to the session entry is calculated. During the storage of network traffic, the metadata of the session can be recorded in the session entry, and the specified packet header of each packet of the session can be cached in a contiguous block of memory in the session entry.

[0100] During network traffic storage, it can be determined whether the number of packet data in the cache list has reached a first upper limit, or whether the timer has timed out, thereby determining whether the trigger condition for writing packet data to the target data file is met. If the trigger condition is not met, it can continue to wait; if the trigger condition is met, the packet data can be written to the target data file in batches according to the pre-calculated first position information.

[0101] During network traffic storage, it can be determined whether the number of specified headers in contiguous memory of a session entry has reached a second upper limit, or whether the session entry has aged, thereby determining whether the trigger condition for writing the specified header to the target header file is met. If the trigger condition is not met, the process can continue to wait. If the trigger condition is met, the second position information of multiple specified headers in contiguous memory in the target header file can be determined, this second position information can be recorded in the session entry, and the specified headers can be written to the target header file all at once according to this second position information.

[0102] During the storage of network traffic, it's possible to determine if a session entry is aging. If it's not aging, the process can continue. If it is aging, the session's metadata and the information about the specified packet header's third position in the target packet header file can be written to the database to facilitate subsequent retrieval.

[0103] In one embodiment, see Figure 7 This is a schematic flowchart illustrating a network traffic retrieval method provided in an embodiment of this application, as shown below. Figure 7 As shown, the method may include steps 710 to 750.

[0104] Step 710: In response to the search command, determine the metadata that matches the search command in the database, and then determine the third location information corresponding to the retrieved metadata.

[0105] When a user needs to view network traffic, they can construct a search command and send it to the electronic device storing the network traffic. Here, the search command instructs the user to retrieve network traffic that meets the search criteria, which can be configured as needed. For example, search criteria can be any combination of one or more of the following: source IP, destination IP, 5-tuple, protocol, and reception time.

[0106] After receiving a search command, the electronic device can parse the search criteria and search the database for metadata that matches the search criteria, which is then used as the metadata matching the search command. After retrieving the metadata, the corresponding third-party location information can be determined.

[0107] Step 720: Determine the corresponding target message header file based on the retrieved metadata, and extract multiple specified message headers from the target message header file based on the third location information corresponding to the retrieved metadata.

[0108] The metadata can include the file identifier (e.g., filename, file ID, etc.) of the corresponding target message header file. Therefore, the corresponding target message header file can be determined based on the file identifier in the retrieved metadata. After obtaining the target message header file, multiple specified message headers can be extracted from it based on the third location information corresponding to the metadata. Here, after reading data from the target message header file based on the third location information, the read data can be split according to the data length of a single specified message header to obtain multiple specified message headers.

[0109] Step 730: Determine the target data file corresponding to the target message header file, and extract the corresponding message data from the target data file using the first position information in each specified message header.

[0110] The target header file and target data file of the same session are associated through a predefined mapping relationship, so the corresponding target data file can be determined through the target header file. For example, the target header file and target data file have the same file identifier (but different file types).

[0111] Since each specified message header records the first position information of the message data of its corresponding data packet, the corresponding message data can be extracted from the target data file based on the first position information in each specified message header.

[0112] Step 740: Construct a standard pcap packet based on each specified header and its corresponding packet data.

[0113] After extracting the corresponding message data for each specified message header, the specified message header can be converted into a standard pcap message header (replacing the first write position with the actual length and arranging the fields according to the order specified in the standard pcap message header), and then the standard pcap message header and message data can be combined to construct a standard pcap data packet.

[0114] Step 750: Write the constructed standard pcap data packet into a pcap file and return the pcap file to the source of the retrieval instruction.

[0115] After constructing the standard pcap data packet, multiple standard pcap data packets from the same session can be written into a pcap file, resulting in at least one pcap file. Furthermore, the pcap file can be returned to the source of the retrieval command, thus completing the retrieval process.

[0116] Through the above measures, multiple specified message headers that meet the search criteria can be quickly identified during the search process, and message data can be read with the help of the first position information in each specified message header, thereby completing the search of network traffic in a way that adapts to the aforementioned storage process that saves disk space.

[0117] Figure 8 This is a block diagram of a network traffic storage device according to an embodiment of the present invention, such as... Figure 8 As shown, the device may include:

[0118] The determination module 810 is used to parse out the 5-tuple from the data packet and determine the session table entry corresponding to the 5-tuple in the session table;

[0119] The first writing module 820 is used to write the message data of the data packet to the target data file corresponding to the session entry;

[0120] The second writing module 830 is used to construct a specified message header for the data packet and write the specified message header to the target message header file corresponding to the session entry; wherein, the specified message header consists of the timestamp of the data packet, a first writing position and a first data length, and the first writing position and the first data length determine the first position information of the message data in the target data file.

[0121] The specific implementation process of the functions and roles of each module in the above-mentioned device can be found in the implementation process of the corresponding steps in the above-mentioned network traffic storage method, and will not be repeated here.

[0122] The apparatuses and methods disclosed in the several embodiments provided in this application can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatuses, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0123] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0124] If a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

Claims

1. A method for storing network traffic, characterized in that, include: Parse the 5-tuple from the data packet and determine the session table entry corresponding to the 5-tuple in the session table; The packet data is cached in a zero-copy manner on a cache list, and the first position information of the packet data in the target data file is determined. When the preset timer expires or the number of message data in the cache list reaches the first upper limit, all message data in the cache list are written to the target data file with their corresponding first position information. A specified header is constructed for the data packet, and the specified headers of several data packets of the same session are cached in the contiguous memory corresponding to the session entry; when the number of specified headers in the contiguous memory of the session entry reaches the second upper limit or the session entry ages, the second position information of all specified headers in the contiguous memory in the target header file is determined. The second location information is used to write all specified message headers in the contiguous memory to the target message header file; wherein, the specified message header is composed of the timestamp of the data packet, the first write position and the first data length, and the first write position and the first data length determine the first location information of the message data in the target data file.

2. The method according to claim 1, characterized in that, The method further includes: Release the memory space containing the specified header that has been written into the target header file from the contiguous memory.

3. The method according to claim 1, characterized in that, The method further includes: The session entry records the metadata indicating the session. When the session entry ages, the metadata and the third location information corresponding to the session entry are written to the database; wherein, the third location information is composed of several second location information.

4. The method according to claim 3, characterized in that, The method further includes: In response to a search command, metadata matching the search command is determined in the database, and then the third location information corresponding to the retrieved metadata is determined. The corresponding target message header file is determined based on the retrieved metadata, and multiple specified message headers are extracted from the target message header file based on the third location information corresponding to the retrieved metadata. Determine the target data file corresponding to the target message header file, and extract the corresponding message data from the target data file using the first position information in each specified message header; A standard pcap packet is constructed based on each specified header and its corresponding packet data; The constructed standard pcap data packet is written into a pcap file, and the pcap file is returned to the source of the retrieval instruction.

5. The method according to claim 1, characterized in that, The step of parsing the 5-tuple from the data packet and determining the session table entry corresponding to the 5-tuple in the session table includes: Parse the 5-tuple from the data packet and determine whether there is a session table entry corresponding to the 5-tuple in the session table; If not, create a session table entry corresponding to the quintuple in the session table.

6. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; The processor is configured to execute the network traffic storage method according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that can be executed by a processor to perform the network traffic storage method according to any one of claims 1-5.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the network traffic storage method according to any one of claims 1-5.

Images