Server package capturing method and device and computer storage medium

Abstract

The invention discloses a server packet capturing method and device and a computer storage medium, and relates to the technical field of network communication, and the method comprises the steps: obtaining a target data packet on a network interface of a server; analyzing the target data packet to determine a protocol type of the target data packet and a serial number of the target data packet; based on the serial number, sorting the target data packet and recombining the sorted target data packet to obtain an original data packet; and classifying session information in the original data packet into at least one network session, and generating a data interaction record based on the network session. According to the method, the data packet on the network interface of the server is analyzed and recombined, so that the data integrity in network transmission is ensured. The recombined original data packet can be used for tracking and analyzing the data flow of the original data packet in the whole network session, so that detailed tracking of the data interaction process of the server side is realized, and the transparency of data interaction is improved.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a server packet capture method, device and computer storage medium. Background Art

[0002] In the field of network communications, troubleshooting of data interaction problems on the server side mainly relies on logging and network monitoring tools. Logging usually only records the occurrence of events without involving the specific content of the data packet. Network monitoring tools can capture data packets and analyze multiple network layers including the application layer.

[0003] However, the above tools focus more on the network layer and transport layer, and cannot well support the analysis of application layer protocols. Therefore, the data exchange process on the server side is like a "black box", and its internal data interaction process is not transparent to the outside world, which makes it difficult for R&D personnel to quickly locate the problem when problems occur on the server side. Summary of the invention

[0004] The main purpose of this application is to provide a server packet capture method, device and computer storage medium, aiming to solve the technical problem of how to improve the transparency of the server-side data interaction process.

[0005] To achieve the above object, an embodiment of the present application provides a server packet capturing method, the server packet capturing method comprising: Get the target data packet on the server's network interface; Parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet; Based on the sequence number, sorting the target data packets and reorganizing the sorted target data packets to obtain original data packets; The session information in the original data packet is classified into at least one network session, and a data interaction record is generated based on the network session.

[0006] In one embodiment, before the step of obtaining the target data packet on the network interface of the server, the method further includes: Capture the data packets interacting with the server through the network capture interface; The data packets that meet the preset filtering rules are selected as the target data packets.

[0007] In one embodiment, the step of parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet includes: Identify the protocol type of the target data packet; Extracting the structural information of the target data packet through a parser corresponding to the protocol type; Based on the structural information, the sequence number of the target data packet is obtained.

[0008] In one embodiment, the step of identifying the protocol type of the target data packet further includes: Extracting data of a preset length at the beginning of the target data packet as a fragment to be matched; Performing feature value matching between the to-be-matched fragment and the protocol template; For each of the protocol templates, calculating the ratio of the number of features that are successfully matched in the to-be-matched segment to the total number of features in the protocol template, and obtaining a matching degree value; When the matching degree value reaches or exceeds a preset matching threshold, the protocol type corresponding to the protocol template is determined as the protocol type of the target data packet.

[0009] In one embodiment, the step of parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet further includes: Traversing the target data packets and identifying the target data packets with fragment identifiers; Arranging the target data packets having the same fragment identifier in the order of the sequence numbers to obtain a target data packet sequence; Detecting whether the sequence numbers of adjacent target data packets in the target data packet sequence are continuous; If the sequence numbers are continuous, determining the relative position relationship of the fragment target data packets in the original data packet according to the fragment offset field and the total length in the fragment target data packet; Based on the order of the fragment offset fields and the total length, the valid data of the fragmented target data packets are extracted in sequence and spliced ​​together to obtain the original data packet.

[0010] In one embodiment, before the step of traversing the target data packet and identifying the target data packet with a fragment identifier, the step includes: Calculating an expected sequence number of the target data packet based on the sequence number of the target data packet that was received last; Comparing the sequence number of the target data packet with the expected sequence number to determine whether the sequence number of the target data packet is abnormal; If the sequence number of the target data packet is inconsistent with the expected sequence number, the target data packet is checked for sequence number jump or wrap.

[0011] In one embodiment, if the sequence number of the target data packet is inconsistent with the expected sequence number, the step of checking whether the target data packet has a sequence number jump or wraparound further includes: If there is a sequence number jump in the target data packet, determining the sequence number range of the lost data packet, and requesting retransmission of the data packet containing the sequence number range; If the target data packet has a sequence number wraparound, adding the sequence number of the target data packet to the maximum possible value of the sequence number to obtain a new expected sequence number; The new expected sequence number is updated as the sequence number of the target data packet.

[0012] In one embodiment, the step of classifying the session information in the original data packet into at least one network session and generating a data interaction record based on the network session further includes: Extracting five-tuple information of each of the target data packets in the original data packet, and determining a network session identifier of each of the target data packets based on the five-tuple information; According to the network session identifier, the session information of each target data packet is obtained; Classifying all the session information in the original data packet into at least one of the network sessions; According to the time sequence of each of the target data packets arriving at the network capture interface, the session information is sorted to obtain the transmission timing of the network session; Recording the payload data volume information of each target data packet in the network session; The data interaction record is generated based on the transmission timing and the effective load data volume information.

[0013] An embodiment of the present application also provides a server packet capture device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the server packet capture method described above.

[0014] An embodiment of the present application further provides a computer storage medium, which is a computer-readable storage medium. A computer program is stored on the computer storage medium. When the computer program is executed by a processor, the steps of the server packet capture method described above are implemented.

[0015] The embodiment of the present application discloses a server packet capture method, which obtains a target data packet on the network interface of the server; parses the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet; based on the sequence number, sorts the target data packet and reorganizes the sorted target data packet to obtain the original data packet; classifies the session information in the original data packet into at least one network session, and generates a data interaction record based on the network session. The present application ensures the integrity of data in network transmission by parsing and reorganizing the data packets on the server network interface. The reorganized original data packet can be used to track and analyze the data flow of the original data packet in the entire network session, thereby realizing detailed tracking of the data interaction process on the server side and improving the transparency of data interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the first embodiment of the server packet capture method involved in the embodiment scheme of the present application; Figure 2 This is a flow chart of a second embodiment of a server packet capturing method according to an embodiment of the present application; Figure 3 This is a flow chart of a third embodiment of a server packet capturing method according to an embodiment of the present application; Figure 4 Another flowchart diagram of the fourth embodiment of the server packet capturing method involved in the embodiment of the present application; Figure 5 This is a schematic diagram of the structure of the packet capture device of the application server.

[0017] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0018] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0019] In the field of network communications, troubleshooting of data interaction problems on the server side mainly relies on logging and network monitoring tools. Logging usually only records the occurrence of events, without involving the specific content of the data packet. Network monitoring tools can capture data packets and analyze multiple network layers including the application layer, but their analysis tends to focus more on the network layer and transport layer, and has limited support for parsing application layer protocols. Especially when faced with custom business protocols, these tools may lack effective parsing capabilities, making the data exchange process on the server side like a "black box", and its internal data interaction process is difficult to be transparent to the outside world. Therefore, when a problem occurs on the server side, it is difficult for R&D personnel to quickly locate the problem through existing tools.

[0020] In order to solve the above-mentioned defects existing in the related art, an embodiment of the present application proposes a server packet capture method, which obtains a target data packet on the network interface of the server; parses the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet; based on the sequence number, sorts the target data packet and reorganizes the sorted target data packet to obtain the original data packet; classifies the session information in the original data packet into at least one network session, and generates a data interaction record based on the network session. The present application ensures the integrity of data in network transmission by parsing and reorganizing the data packets on the server network interface. The reorganized original data packet can be used to track and analyze the data flow of the original data packet in the entire network session, thereby realizing detailed tracking of the data interaction process on the server side and improving the transparency of data interaction.

[0021] It should be noted that the execution subject of this embodiment can be a server packet capture system, or a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or a server packet capture device capable of realizing the above functions, etc. The following takes the server packet capture system as an example (hereinafter referred to as the "system") to illustrate this embodiment and the following embodiments.

[0022] The server packet capture method of the first embodiment proposed in this application, please refer to Figure 1 The method comprises steps S10 to S40: Step S10: Acquire the target data packet on the network interface of the server.

[0023] The system usually uses a dedicated network capture interface to obtain data packets on the server network interface. These network capture interfaces can be virtual interfaces at the software level or interfaces with capture functions provided by hardware devices. They can monitor the data flow on the network interface in real time and capture the data packets passing through. For example, the network packet capture tools that come with some operating systems use the network capture interface mechanism provided by the system to capture data packets on the specified network interface under the corresponding permissions.

[0024] Exemplarily, the network packet capture tools built into the operating system include TcpDump in Linux system, Libpcap in Unix / Linux system, WinPcap / Npcap in Windows, and the like.

[0025] In this embodiment, the network interface of the server refers to the channel for the server to connect to the external network and transmit data. The target data packet refers to a data packet that meets specific conditions or requirements in a specific network communication scenario. These conditions or requirements may be based on the source address, destination address, port number, protocol type, data content, etc. of the data packet.

[0026] It should be noted that not all data packets passing through the network interface will be treated as target data packets for subsequent processing. Instead, it is necessary to determine which data packets are the focus of this packet capture operation based on specific packet capture requirements and screening conditions. These selected data packets are the target data packets.

[0027] Optionally, you can capture all packets passing through the network interface, including protocol data units below the transport layer, by creating a raw socket. Raw sockets allow programs to interact directly with network layer protocols, thereby receiving and sending packets that are not encapsulated by the transport layer.

[0028] Specifically, the program creates a raw socket by calling the socket system call, specifying SOCK_RAW as the socket type, and the corresponding protocol family, such as PF_INET for IPv4, and the protocol, such as IPPROTO_IP for the IP protocol. To ensure that all packets passing through the network interface can be captured, including those that are not sent directly to the local machine, the program can set the raw socket to promiscuous mode. Then, the program can call the bind function to bind the raw socket to a specific network interface so that only packets from that network interface can be captured. Finally, the program enters a loop to read packets from the raw socket using the recvfrom or recv function.

[0029] In a feasible implementation manner, step S10 may include steps S11 to S12: Step S11, capturing data packets for data interaction with the server through a network capture interface.

[0030] In this embodiment, in addition to using the network packet capture tool provided by the operating system to capture data packets, the network capture interface can also be directly configured with parameters to achieve data packet capture.

[0031] For software-level virtual interfaces, you can configure related parameters through the network settings interface or command line tools provided by the operating system. For example, in some operating systems, you can modify the configuration file of the network interface to set parameters such as capture mode, captured packet type, and specify the network interface to be captured.

[0032] Exemplarily, the capture mode is set to promiscuous mode or normal mode; the captured data packet types include, for example, capturing only IP data packets, capturing data packets of all protocol types, and the like.

[0033] It should be noted that the promiscuous mode will capture all packets passing through the network capture interface, regardless of whether the destination address of these packets is directed to the computer where the network capture interface is located. This mode allows network monitoring tools to capture and analyze all traffic on the network, including packets not sent to the host. Normal mode is the default operating mode of the network interface card, which only captures packets whose destination address is directed to the computer where the network capture interface is located. In this mode, the network interface card will ignore all other packets, which helps reduce unnecessary data processing and network traffic and improve network efficiency.

[0034] For the network capture interface provided by the hardware device, the parameters are usually configured through the device's own management interface or console.

[0035] For example, on some network analysis devices, you can set the source address range, destination address range, port number range and other parameters of the data packets to be captured by the device, so as to capture the data packets that interact with the server according to specific needs. By properly configuring these parameters, the network capture interface can more accurately capture the required target data packets, avoid capturing too many irrelevant data packets, and improve the efficiency and pertinence of data packet capture.

[0036] Step S12, screening the data packets that meet the preset filtering rules as the target data packets.

[0037] In this embodiment, filters can be configured to filter packets in various ways to determine target packets, for example, filtering operations can be performed based on the source address and destination address, port number, protocol type, and packet content characteristics of the packet.

[0038] The following four steps are mainly involved in setting and filtering rules: Configuration distribution: In the configuration center or cloud native control panel, the configuration is distributed to the specified faulty server node for development and debugging.

[0039] Configuration content: Usually configured in a format that is easy to read and modify, such as YAML (YAML Ain't Markup Language, a format used to express data serialization) or JSON (JavaScript Object Notation). The configuration content includes but is not limited to the protocol type to be monitored, the application port number, and the remote log address.

[0040] Setting of filtering rules: After the configuration is successfully sent to the specified server node, the application will automatically parse the configuration file, for example, use Libpcap to generate the BPF expression corresponding to the configuration content, and pass the BPF expression to the kernel through system calls to complete the configuration of the filtering rules.

[0041] It should be noted that BPF (Berkeley Packet Filter) expression is an expression syntax used for network packet filtering. It allows users to specify filtering conditions so as to efficiently filter out packets that meet specific conditions during network monitoring and packet analysis.

[0042] Filtering process: When a data packet arrives at the network capture interface, the network driver in the system kernel receives the data packet and passes it from the hardware layer to the software layer. Before the data packet is passed to the network protocol stack of the operating system, it is sent to the BPF filter through the network sub-interface, that is, the bypass mechanism. This step is equivalent to copying the data packet in the network interface driver, and the original data packet continues to be processed normally along the network protocol stack.

[0043] The BPF filter will match the received data packets according to the preset filtering rules to find the target data packets that meet the filtering conditions. Once the match is completed, the BPF filter will provide a user-level API interface independent of the system in the user space, and finally notify the application layer through this API interface. In this way, the application layer will be able to know in time that the qualified data packets have been filtered out, so that these data packets can be analyzed, processed, and other operations can be performed to achieve the screening and effective monitoring of the target data packets in the entire server packet capture process.

[0044] It should be noted that the network protocol stack is a set of layered network protocols used to achieve network communication between different computers. It usually consists of multiple layers, such as application layer, transport layer, network layer, link layer, etc. Each layer has its own specific functions and protocols. Data packets will be passed between these different layers in sequence, and each layer will process the data packets accordingly, such as adding or removing the protocol header information of this layer, performing data encapsulation or decapsulation, etc.

[0045] The network tap interface, also known as the bypass mechanism, is a special method used in the process of network data processing. Its main function is to separate a part of the data packet from the normal data flow before the data packet is passed to the protocol stack of the operating system, and send it to the BPF filter through this special interface for filtering.

[0046] Step S20: Parse the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet.

[0047] In network communications, different application scenarios and functional requirements have led to the emergence of various network protocols. Protocol types are used to distinguish these different network protocols. For example, common ones include TCP (Transmission Control Protocol), UDP (User Datagram Protocol), IP (Internet Protocol), ICMP (Internet Control Message Protocol), etc. Each network protocol has its own specific format, rules, and uses. By determining the protocol type of the target data packet, we can know the rules by which the target data packet is encapsulated and transmitted, and then interpret the content according to the corresponding network protocol specifications.

[0048] For many network protocols, especially those used for reliable transmission, such as TCP, the sequence number is a very important attribute. It is a sequential number assigned to each data packet, which is used to identify the position of the data packet in the entire data transmission sequence. Through the sequence number, the receiving end can determine whether the data packet arrives in the correct order, whether there is any loss or duplication, etc.

[0049] For example, in the TCP protocol, the sending end will number the sent data packets in a certain order, and the receiving end will reassemble the received data packets according to these sequence numbers to ensure the integrity and correctness of the data.

[0050] In this embodiment, the protocol type can be preliminarily determined based on some specific fields in the data packet. For example, the IP protocol data packet header has specific fields such as version number and header length that can assist in identification; the TCP protocol data packet header has characteristic fields such as source port, destination port, sequence number, etc., and the protocol type can be determined to a certain extent by checking and analyzing these fields.

[0051] Optionally, some protocols have unique traffic patterns and behavioral characteristics, so the identification of the protocol type can be completed based on the traffic patterns and behavioral characteristics.

[0052] For example, the TCP protocol is a connection-oriented protocol, and its communication process has a "three-way handshake" connection establishment phase and a "four-way handshake" disconnection phase. The TCP protocol can be identified by observing the sending and receiving sequence and frequency of data packets and the process of connection establishment and removal.

[0053] For example, the UDP protocol is connectionless, and the transmission of data packets is relatively simple and direct, without complicated connection establishment and removal processes. By analyzing whether the traffic pattern of the target data packet meets these characteristics, it can also assist in identifying the protocol type.

[0054] For example, for some real-time streaming protocols, their traffic pattern is usually to send data packets continuously and at high speed to ensure smooth playback of video or audio. This behavioral feature can also help identify the protocol type.

[0055] Optionally, some network protocols have specific formats or keywords in the payload content, and the protocol type can be identified by parsing the payload content. This method can not only identify standard network protocols, but also be used to identify custom protocols or non-standard protocols. This is because custom protocols usually still follow the basic protocol structure in the payload content. Therefore, by identifying the characteristics of their payload content, these data packets can still be effectively identified and analyzed.

[0056] For example, HTTP requests and responses usually contain specific strings, such as request methods such as "GET" and "POST".

[0057] Specifically, the content can be extracted from the payload of the data packet and analyzed according to predefined rules and feature libraries. These rules may include specific string patterns, byte sequences, protocol commands, etc. By using regular expressions or other text matching techniques, specific keywords or patterns in the payload content of the data packet can be found. Once the payload content of the data packet matches a protocol feature in the feature library, the protocol type of the data packet can be determined based on the matching results.

[0058] Step S30: based on the sequence number, sort the target data packets and reassemble the sorted target data packets to obtain the original data packets.

[0059] During network data transmission, especially in application scenarios where data integrity and correct order of reception need to be guaranteed, data packets may be out of order or some data packets may be lost when they arrive at the receiving end due to various factors such as network congestion and differences in transmission paths.

[0060] It should be noted that the receiving end here refers to the situation where the server performs packet capture analysis.

[0061] In order to accurately restore the original data content sent by the sender and the logical order of data transmission, it is necessary to sort and reorganize the data packets based on the sequence numbers they carry. This step is to further process the data packets after determining the protocol type and sequence number of the target data packets, so that they meet the original order and integrity requirements of data transmission, thereby providing a reliable data basis for subsequent accurate analysis of network sessions, generation of data interaction records, and other operations.

[0062] Sorting means arranging the captured target data packets in the order they should have been sent from the sender according to the size of the data packet sequence number.

[0063] For example, if there are three target data packets, whose serial numbers are 10, 11, and 12 respectively, the sorting operation is to arrange them in ascending order of the serial numbers so that they present the sequential relationship when they are sent from the transmitter in the data transmission link.

[0064] Reassembly is the operation of reassembling and splicing data packets that have been split, partially lost and retransmitted due to factors such as network congestion, link failure, device limitations, and configuration rules of intermediate network devices after the target data packets have been sorted based on their sequence numbers. The purpose is to restore the complete original data packet or a combination of data packets that conforms to the data transmission logic.

[0065] For example, a larger original data packet may be split into several fragmented data packets during transmission, each of which has its own serial number. By sorting the fragmented data packets according to the serial numbers and then correctly splicing them together based on their fragment-related information, such as fragment offsets, the complete original data packet or a data packet combination that conforms to the data transmission logic is obtained.

[0066] Optionally, the target data packets can be put into an ordered queue or data structure in sequence according to the serial number size of each target data packet, so that the data packets are arranged in the order of serial number from small to large, or according to the order specified by the network protocol.

[0067] Step S40: classifying the session information in the original data packet into at least one network session, and generating a data interaction record based on the network session.

[0068] The purpose of obtaining target data packets and sorting and reorganizing them is to accurately process and restore data packets that may be in various conditions during network transmission, so that they comply with the original order and integrity requirements of data transmission.

[0069] On this basis, the session information of each target data packet in the processed original data packet or data packet combination is classified into at least one network session, and a data interaction record is generated. The data interaction record can clearly show how the data is interacted during a specific network session, which is equivalent to drawing a detailed "log" for the entire network communication process, making the data interaction process on the server side no longer a "black box", but can be clearly observed and analyzed.

[0070] It should be noted that a network session refers to a process in which a series of related data interactions are carried out between two or more network entities. It has certain start and end marks, and involves specific network protocols, port numbers, source addresses, destination addresses and other elements in the entire interaction process.

[0071] The network entities mentioned here include: client and server, server and server, etc.

[0072] In this embodiment, the data packet contains the actual transmitted data and the control information used to correctly route and transmit the data in the network. Specifically, the data packet is the basic carrier of network communication. It carries the actual information in the network session. Whether it is a request, response or data transmission, it is transmitted on the network in the form of a data packet. The control information in the data packet, such as the protocol type, source and destination port numbers, source and destination IP addresses, etc., is used to ensure that the data can be correctly sent to the target network entity and processed according to the established network protocol. Therefore, by monitoring and analyzing the data packet, it can help identify the behavior pattern of the network session.

[0073] For example, when a client accesses a website server through a browser, a network session is constituted from a request initiated by the client to a response from the server, and a series of related data packet interaction processes such as the entire page loading are completed.

[0074] In this embodiment, the data interaction record is a document or data set formed by recording and collating the relevant information of the data packets involved in the network session, which is used to describe in detail how the data flows, is transmitted and interacts in a specific network session. The data interaction record usually contains a variety of information such as the sending time, receiving time, source address, destination address, protocol type, data packet size, payload data volume, etc. Through this information, the overall picture of a network session and the role of each data packet in it can be known.

[0075] Please refer to Figure 2 In the server packet capturing method of the second embodiment proposed in the present application, step S20 may further include steps S210 to S230: Step S210: Identify the protocol type of the target data packet.

[0076] The protocol type is used to distinguish different network protocols. Different network protocols are developed to meet various specific network application requirements. They each specify the format, rules, and interaction methods of data transmission in the network.

[0077] In a feasible implementation, step S210 may include steps S211 to S214: Step S211, extracting data of a preset length at the beginning of the target data packet as a segment to be matched.

[0078] Because different protocols usually set some representative fields or formats at the beginning when constructing data packets, the beginning part of the data packet usually contains key information that can quickly distinguish its protocol type.

[0079] Exemplarily, the "type" field of the Ethernet frame header can indicate whether the following data belongs to the IP protocol or the ARP protocol, etc. The "type" field value of the IP protocol is 0x0800; the "type" field value of the ARP protocol is 0x0806.

[0080] Step S212: matching the to-be-matched segment with the protocol template based on feature values.

[0081] The protocol template library is a resource library that stores a variety of network protocol templates. Each protocol template describes a specific network protocol and contains key feature identification information for identifying the protocol. The feature identification information is determined based on the features presented by different protocols in the header, payload content, and other parts of the data packet.

[0082] For example, for the IP protocol, the values ​​of fields such as the version number and header length in its data packet header have a specific range or format, which can serve as characteristic identification information of the IP protocol; for the TCP protocol, the source port, destination port, sequence number and other fields in its header and the relationship between them also constitute the characteristic identification information of the TCP protocol.

[0083] In this embodiment, for the feature identification information extracted from each protocol, a data structure such as a structure, a class, etc. can be used to store the feature identification information. The feature identification information includes the fields corresponding to each feature identification information and detailed information such as its value range and format.

[0084] Exemplarily, the TCP protocol template may include a source port field, the source port field value range is 0-65535, and the format is an integer; a destination port field, the destination port field value range is 0-65535, and the format is an integer; and a sequence number field, the sequence number field value range is determined according to specific transmission requirements, and the format is an integer, etc.

[0085] For each protocol template in the protocol template library, the data in the extracted fragment to be matched is compared one by one with the field value corresponding to the feature identification information in the protocol template.

[0086] For example, if there is a version number field of the IP protocol in the protocol template, and its characteristic identification information stipulates that the version number should be 4, that is, IPv4, then check whether the field value at the corresponding position in the fragment to be matched is 4; if there is a source port field of the TCP protocol in the protocol template, and its characteristic identification information stipulates that the value range of the source port is 0-65535, then check whether the source port field value at the corresponding position in the fragment to be matched is within this value range.

[0087] Optionally, during the comparison process, for feature identification information with fixed values, in addition to checking whether the field values ​​are equal; or for feature identification information with a value range, in addition to checking whether the field value is within the value range, it is also possible to consider whether the relationship between the fields complies with the provisions of the protocol template.

[0088] For example, for the TCP protocol, in addition to checking whether the field values ​​such as the source port and the destination port meet the requirements, it is also possible to check whether the relationship between the sequence number and the confirmation number meets the specifications of the TCP protocol.

[0089] Step S213: For each of the protocol templates, the ratio of the number of successfully matched features in the to-be-matched segment to the total number of features in the protocol template is calculated to obtain a matching degree value.

[0090] By calculating the ratio of the number of successfully matched features to the total number of features in the protocol template, the similarity between the fragment to be matched and the protocol template can be quantified.

[0091] For example, suppose a TCP protocol template has a total of 10 feature identification information. After matching the feature values ​​with the to-be-matched fragments, it is found that 8 feature identification information are successfully matched. Then, according to the formula for calculating the matching degree value: matching degree value = number of successfully matched features / total number of features in the protocol template, the matching degree value = 8 / 10 = 0.8 can be obtained.

[0092] This 0.8 is the matching degree value between the to-be-matched segment and the TCP protocol template, which means that the to-be-matched segment and the TCP protocol template are 80% similar.

[0093] Step S214: When the matching degree value reaches or exceeds a preset matching threshold, the protocol type corresponding to the protocol template is determined as the protocol type of the target data packet.

[0094] In this embodiment, the setting of the matching threshold needs to be determined according to the requirements of the actual application scenario and the trade-off between the accuracy of protocol type recognition and the false positive rate. When the calculated matching degree value reaches or exceeds the preset matching threshold, the protocol type of the corresponding protocol template can be determined as the protocol type of the target data packet.

[0095] For example, if the preset matching threshold is 0.8, and the matching degree value between a certain to-be-matched segment and the TCP protocol template obtained through the previous calculation is 0.85, then it can be determined that the protocol type of the target data packet is the TCP protocol.

[0096] Step S220: According to the protocol type, a corresponding parser is selected to extract structural information of the target data packet, where the structural information includes header information and payload content.

[0097] A parser is a tool or program module that is specifically used to parse packets of a specific network protocol. According to the specifications and format requirements of the corresponding network protocol, it can go deep into the packet and accurately extract various key information, such as header information, payload content, etc.

[0098] Since different network protocols have differences in data packet structure, field definition, etc., different protocol types require the use of matching parsers. Only the corresponding parsers can correctly interpret the specific content of the data packets of the corresponding network protocols.

[0099] For example, taking the TCP protocol parser as an example, when the TCP protocol parser is selected, it will conduct an in-depth analysis of the target data packet. First, it identifies the various fields in the TCP protocol data packet header, such as the source port, destination port, sequence number, acknowledgment number, etc., and accurately extracts the values ​​of these fields as the header information. Then, it further determines the part of the target data packet after removing the header information, that is, the payload content, and extracts it completely.

[0100] Step S230: Based on the structure information, obtain the sequence number of the target data packet.

[0101] Different network protocols may have different definitions and locations for sequence numbers. For example, in the TCP protocol, the sequence number is located in a specific position in the packet header, usually adjacent to other important fields such as the source port and destination port. Therefore, when obtaining the sequence number, you must first determine the specific location of the sequence number in the packet based on the protocol type followed by the target packet.

[0102] Please refer to Figure 3 In the server packet capturing method of the third embodiment proposed in the present application, step S30 may further include steps S310 to S350: Step S310: traverse the target data packets and identify the target data packets with fragment identifiers.

[0103] Each target data packet has a corresponding fragment identification field in its header or other specific position, which is used to indicate that the target data packet is a fragmented data packet.

[0104] Traverse each target data packet, check whether the target data packet has a fragment identification field, and determine whether it is a target data packet with a fragment identification according to the value of the fragment identification field.

[0105] Step S320: Arrange the target data packets having the same fragment identifier in the order of the sequence numbers to obtain a target data packet sequence.

[0106] First, clarify the definition and usage rules of the sequence number of the network protocol followed by the target data packet. The sequence numbers of different protocols may differ in format, generation method, and increment rules. After determining the protocol-related sequence number rules, the sequence number size of the data packet can be used as the basis for sorting.

[0107] Optionally, a suitable data structure may be used to assist the sorting operation. Common data structures such as arrays, linked lists or queues may be used to store target data packets, and the target data packets are sorted according to their sequence numbers to obtain a sequence of target data packets.

[0108] For example, when using an array to store target data packets, you can compare the serial number sizes of adjacent data packets, and then use a sorting algorithm such as bubble sort or insertion sort to arrange them in ascending or descending order of serial numbers, where the ascending or descending order needs to be based on the requirements of the network protocol.

[0109] Exemplarily, if a linked list is used, when inserting a new target data packet, a suitable insertion position can be found according to the size of its sequence number, so that the data packets in the linked list are arranged in sequence according to the sequence number.

[0110] Exemplarily, for the queue structure, the target data packets may be queued in sequence according to the sequence number order to achieve a sorting effect.

[0111] Step S330: Detect whether the sequence numbers of adjacent target data packets in the target data packet sequence are continuous.

[0112] Checking whether the sequence numbers of adjacent target data packets in the target data packet sequence are continuous is to determine whether there is data packet loss or disorder in the sorted target data packet sequence. If the sequence numbers are continuous, it can be said that the data packets are transmitted in a normal order.

[0113] Step S340: If the sequence numbers are continuous, the relative position relationship of the fragmented target data packets in the original data packet is determined according to the fragment offset field and the total length in the fragmented target data packet.

[0114] It should be noted that the fragment offset field indicates the offset of the starting position of the fragment target data packet in the original data packet relative to the header of the original data packet, while the total length specifies the length range of the fragment target data packet itself. Through the values ​​of these two fields, the specific coverage range of the fragment target data packet in the original data packet can be calculated, thereby determining the relative position relationship of the fragment target data packet in the original data packet.

[0115] Specifically, if the fragment offset of a fragment target data packet is X bytes and the total length is Y bytes, then the starting position of the fragment target data packet in the original data packet is from the Xth byte, and the coverage range of the fragment target data packet in the original data packet is from the Xth byte to the (X+Y)th byte.

[0116] For example, a fragment target data packet with a fragment offset of 100 bytes and a total length of 200 bytes has a relative position in the original data packet starting from the 100th byte and a length of 200 bytes, that is, the coverage range is from the 100th byte to the 300th byte.

[0117] Step S350: Based on the order of the fragment offset fields and the total length, extract the valid data of the fragmented target data packets in sequence and splice them to obtain the original data packet.

[0118] Based on the order of the fragment offset fields, the valid data of the fragmented target data packets are extracted in sequence and spliced ​​to construct the data area of ​​the original data packet.

[0119] In addition to the header information, the rest of the fragmented target data packet is valid data, that is, the part that actually carries part of the data content in the original data packet. By determining the relative position of the fragmented target data packet in the original data packet, it is possible to determine which parts are valid data.

[0120] It should be noted that the header information includes the fragment offset field, total length and other information used for identification and control.

[0121] According to the order of the fragment offset field, start from the first fragment target data packet with a fragment identifier and the smallest fragment offset, and extract its valid data. Then, extract the valid data of the subsequent fragment target data packets in the order of the fragment offset from small to large. After extracting the valid data of each fragment target data packet, splice these valid data together in sequence.

[0122] In a feasible implementation manner, before step S310, steps S311 to S313 may also be included: Step S311: Calculate the expected sequence number of the target data packet based on the sequence number of the last received target data packet.

[0123] During data packet transmission, each data packet is assigned a sequence number to identify its position in the entire data stream. The sequence number is usually generated in an ascending order.

[0124] Exemplarily, assuming that the sequence number of the last received target data packet is N, and the network protocol stipulates that the value of the sequence number increments by 1 each time, then the expected sequence number of the next target data packet should be N+1.

[0125] Step S312: Compare the sequence number of the target data packet with the expected sequence number to determine whether the sequence number of the target data packet is abnormal.

[0126] The expected sequence number is the sequence number that the next data packet should have, calculated based on the sequence number of the last received target data packet according to a preset rule or algorithm. The expected sequence number is used to provide a reference standard for determining whether the sequence number of the current target data packet is normal.

[0127] If the sequence number of the current target data packet matches the expected sequence number, it means that the data packet is transmitted in the normal order; if it is inconsistent, it means that the data packet has abnormal conditions such as disorder, loss or retransmission during the transmission process.

[0128] Step S313: If the sequence number of the target data packet is inconsistent with the expected sequence number, check whether the target data packet has a sequence number jump or wraparound.

[0129] When it is found that the sequence number of the target data packet is inconsistent with the expected sequence number, it is necessary to consider whether there is a sequence number jump or wraparound.

[0130] Sequence number jump means that in the data packet transmission sequence, there is a large difference between the sequence number of the current target data packet and the expected sequence number calculated based on the normal order, which does not conform to the normal increasing or decreasing rules.

[0131] For example, the expected serial number is 60, while the actual serial number is 70, which differs by 10. Under normal serial number generation rules, such as increasing by 1 each time, such a large difference should not occur. A serial number jump may have occurred.

[0132] Sequence number wraparound is a special case of sequence number anomaly that often occurs in network protocols with a limited range of sequence number values. When the sequence number reaches its maximum value, it will start again from the minimum value when it increases again, forming a state similar to a "loop".

[0133] For example, a protocol specifies that the range of the sequence number is 0-255. When the sequence number reaches 255, the sequence number of the next data packet will become 0 if it is incremented normally. This situation will interfere with the normal judgment and processing of the data packet sequence, and special processing is required to restore the normal sequence number logic.

[0134] In a feasible implementation, step S313 may include steps S3131 to S3133: Step S3131: If there is a sequence number jump in the target data packet, determine the sequence number range of the lost data packet and request retransmission of the data packet containing the sequence number range.

[0135] When it is determined that there is a sequence number jump, the sequence number range of data packets that may be lost during transmission can be inferred by analyzing factors such as the difference between the sequence number of the target data packet and the expected sequence number and the normal sequence number increment pattern.

[0136] For example, the expected sequence number is 30, the sequence number of the current target data packet is 40, and under normal circumstances the sequence number increases by 1 each time, then the sequence number range of the lost data packets is 31 to 39. After determining the loss range, you can accurately request retransmission of these lost data packets to restore data integrity.

[0137] Step S3132: If there is a sequence number wrap in the target data packet, add the sequence number of the target data packet to the maximum possible value of the sequence number to obtain a new expected sequence number.

[0138] After determining that there is a sequence number wrap, in order to restore the normal sequence number logic, the sequence number of the current target data packet needs to be added with the maximum possible value of the sequence number. This is because the sequence number wrap makes the data packet that should be at the back in the normal ascending order appear to have a smaller sequence number than the previous data packet. By adding the maximum possible value, it can be adjusted to a state that conforms to the normal ascending order.

[0139] For example, if the sequence number of a protocol ranges from 0 to 255, and the sequence number of the current target data packet is 0, then 255 is added to it to obtain a new expected sequence number of 255, where 0 indicates wraparound and 255 indicates the maximum possible value. This logically restores the sequence number to a normal increasing order.

[0140] Step S3133: Update the new expected sequence number to the sequence number of the target data packet.

[0141] The purpose of updating the sequence number of the target data packet to the new expected sequence number is to make the sequence number of the target data packet conform to the normal increasing order logic so that the data packets can be processed in the correct order when they are subsequently sorted, reassembled, etc.

[0142] It should be noted that the update operation is usually to directly modify the value of the sequence number field corresponding to the target data packet in the memory. This step requires accessing the data structure of the data packet to find the location of the sequence number field, and then assigning the new expected sequence number to the field.

[0143] For example, in some programming languages, if the data packet is stored in the form of a structure, the sequence number field can be accessed through the structure member access operator and an assignment operation can be performed.

[0144] In another feasible implementation, the data packet processing process in step S30 may further include restoring the timestamp information of the target data packet and filtering out illegal data packets.

[0145] It should be noted that timestamp information refers to a time mark that is added when a data packet is generated or passes through a specific network node, such as a network capture interface. It records the state of the data packet at a specific moment. Timestamp information is important for analyzing the transmission order and delay of data packets and judging network performance.

[0146] For example, by comparing the timestamps of different data packets, it is possible to understand which data packets are sent first and which are sent later, and whether there are abnormal time intervals during the transmission process.

[0147] Optionally, a reference point is determined as a benchmark for timestamp recovery, which can be the time when a network capture interface first captures a specific data packet, or the time when the system is started, etc.

[0148] For example, the time when the network capture interface first captures the first data packet from a specific source IP address can be used as a reference point, and this time value can be recorded as T0. For the subsequently captured data packets, the approximate timestamp of each data packet is estimated by analyzing their relative relationship with the reference point and the known network transmission characteristics. The network transmission characteristics include average transmission delay, data packet sending interval, etc.

[0149] Assume that it is known that under normal circumstances, the average interval between adjacent data packets sent from the same source IP address is Δt. When the second data packet from the source IP address is captured, if its logical sequence relationship with the first data packet on the network transmission path is known, its timestamp can be calculated as T0+Δt.

[0150] Specifically, in the normal TCP transmission process, the sequence number is incremented in a certain order, and the sender usually sends a certain number of data packets within a certain time interval. By analyzing the sequence number of the known data packet, the interval between data packets, and the transmission rules specified by the protocol, the expected timestamp of the data packet can be inferred. Then, based on the actual timestamp of the captured target data packet, it is compared with the expected timestamp, so that the timestamp of the target data packet can be corrected.

[0151] Illegal data packets refer to data packets that do not conform to normal network communication specifications or expected data formats. For example, data packets with empty data lengths in non-SYN, FIN, and RST situations are defined as illegal data packets. These data packets may appear due to network failures, malicious attacks, software errors, etc. Their existence may interfere with normal network communication processes or cause deviations in data analysis.

[0152] It should be noted that SYN means synchronization, FIN means end, and RST means reset.

[0153] In the normal process of establishing, maintaining and ending a TCP connection, the appearance of the SYN, FIN, and RST control bits and whether the data packet carries valid data and the length of the data follow a certain pattern. For example, during the TCP connection establishment phase, the data packet with the SYN flag sent by the sender usually does not carry a large amount of valid data, but the subsequent data packet sent after the connection is successfully established generally has a corresponding data length. By comparing the normal situation with the actual situation of the captured data packet, illegal data packets that do not conform to the normal pattern can be identified. Once illegal data packets are identified, they need to be filtered out in the data packet processing process to prevent them from entering the subsequent analysis or processing links.

[0154] Specifically, the control bit flag and the value of the data length field can be obtained by parsing the header information of the data packet. Then, based on these values ​​and known normal relationships, it is determined whether the data packet is an illegal data packet. The control bit flags are, for example, SYN, FIN, RST, etc.

[0155] Optionally, the filtering operation of illegal data packets is implemented by setting corresponding filtering conditions in the network capture interface or the data packet processing program on the server side.

[0156] Exemplarily, a judgment logic is set in the program. If the data packet does not have a SYN flag and the data length is empty, nor does it have a FIN flag and the data length is empty, and it does not have a RST flag and the data length is empty, then the data packet is filtered out and is not used as a target data packet for subsequent analysis and processing.

[0157] Please refer to Figure 4 In the server packet capturing method of the fifth embodiment proposed in the present application, step S40 may further include steps S410 to S460: Step S410: extracting the five-tuple information of each target data packet in the original data packet, and determining the network session identifier of each target data packet based on the five-tuple information.

[0158] It should be noted that the five-tuple information is a set of key information used to uniquely identify a network connection or network session in network communication, including source IP address, destination IP address, source port, destination port and protocol type. These five elements combined together can accurately locate and distinguish different network sessions in a complex network environment.

[0159] A network session identifier is used to mark packets belonging to the same network session. This identifier is like a "tag" that associates all packets related to a specific network session together.

[0160] Step S420: Obtain the session information of each target data packet according to the network session identifier.

[0161] The network session identifier is like a unique "marker" that classifies and divides the target data packets belonging to the same network session. Session information refers to the various detailed contents related to this session carried by each target data packet during this specific network session, such as the transmission order of the data packet in this session, the relevance of the data content it carries with the entire session topic, and the role it plays in different stages of the session.

[0162] In this embodiment, the system first searches and matches the network session identifier of each target data packet that has been extracted and determined in a database or data cache area that stores a large amount of packet capture data and related analysis records. When the target data packet records with the same network session identifier are found, the various information fields contained in these data packets are further parsed. Then, these field information is processed through data analysis algorithms and program logic, such as analyzing the data format, timestamp and other information carried by the data packet header and payload, so as to extract the specific session information of each target data packet in the network session to which it belongs.

[0163] Step S430: Classify all the session information in the original data packet into at least one network session.

[0164] Categorizing all session information of each target data packet in the original data packet into at least one network session means accurately grouping the scattered session information corresponding to the original data packet into the corresponding network session set, so that all relevant information of the same network session can be concentrated together to obtain the information group corresponding to the original data packet, and then analyzing each network session based on the information group to obtain the specific transmission situation of the original data packet in the entire network session scenario, data flow characteristics, and possible abnormal performance.

[0165] Optionally, the system uses each determined network session identifier as a key basis for classification. For each session information extracted from the target data packet, the corresponding network session identifier is compared with an existing network session classification framework. This classification framework can be a data structure constructed in memory, such as a hash table, where the key value is the network session identifier and the value is a corresponding container for storing the network session related information, such as a list.

[0166] When the network session identifier of the session information matches a network session identifier in the classification framework, the session information is added to the container corresponding to the network session identifier, thereby accurately classifying the session information into the corresponding network session.

[0167] In the process of classification, in order to ensure the accuracy of classification, a fast hash search algorithm can be used to speed up the search for matching network session identifiers and reduce processing time when performing comparison operations.

[0168] For the operation of adding session information to the corresponding container, data structures such as dynamic arrays can be used to flexibly adapt to the increasing amount of session information and ensure orderly storage of data.

[0169] Step S440: Sort the session information according to the time sequence of each target data packet arriving at the network capture interface to obtain the transmission timing of the network session.

[0170] Transmission timing refers to the sequence relationship formed by the order in which each target data packet in a network session arrives at the network capture interface. Knowing the transmission timing is crucial to understanding the data interaction process in a network session, because the transmission timing can reflect when and in what order the data is transmitted, which helps to discover anomalies in network communication, such as delays and disorder.

[0171] In this embodiment, when capturing target data packets, the timestamp of each target data packet arrival is recorded. This timestamp can be obtained through the time function provided by the operating system or the timing function of the network capture device itself.

[0172] Step S450: Recording the payload data volume information of each target data packet in the network session; It should be noted that the payload data volume information includes the payload length of a single target data packet and the cumulative payload data volume during the entire network session. The payload data volume information includes two parts: one is the payload length of a single target data packet, that is, the length of the application layer data actually carried after removing the header information from the data packet; the other is the cumulative payload data volume during the entire network session, which is obtained by accumulating the payload lengths of all target data packets in the network session. This information can reflect the amount of data transmission in the entire network session.

[0173] In this embodiment, the starting position and the ending position of the payload part in the target data packet are determined according to the network protocol format followed by the target data packet. Usually, the part after the header information of the data packet is the payload part.

[0174] For example, in an IP protocol data packet, the length of the IP header is fixed or can be determined by the header length field of the header, and the payload portion is the portion starting from after the IP header to the end of the data packet.

[0175] In this embodiment, the payload length of a single target data packet can be obtained by calculating the number of bytes of the payload portion. The length can be determined using a byte count function provided by a programming language or by calculating the difference between the start position and the end position of the payload portion.

[0176] For the cumulative amount of payload data during the entire network session, after calculating the payload length of each target data packet, the payload length of each target data packet is sequentially accumulated into the accumulator through an accumulator variable.

[0177] Step S460: Generate the data interaction record based on the transmission timing and the payload data volume information.

[0178] The data interaction record can be a text file, database record or other data storage form. Its content mainly includes basic information of the network session, such as the network session identifier, detailed information of the target data packets arranged in transmission time sequence, such as the arrival time, source IP address, destination IP address, protocol type, payload length, etc. of each data packet, and summary information of the entire network session, such as the cumulative payload data volume.

[0179] Specifically, first, a record structure is created in the data storage medium to store various information of the data interaction record. Then, the network session identifier is written into the corresponding position of the record structure. Next, according to the determined transmission timing, the detailed information of the target data packet, such as arrival time, source IP address, destination IP address, protocol type, payload length, etc., is written into the record structure one by one. Finally, the summary information such as the cumulative payload data volume of the entire network session is also written into the record structure to complete the generation of the data interaction record. The data interaction record generated in this way can show in detail how the data flows, transmits and interacts in a specific network session, providing a strong basis for network communication analysis.

[0180] The present application provides a server packet capture device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the server packet capture method in the above-mentioned embodiment 1.

[0181] Reference below Figure 5 , which shows a schematic diagram of the structure of a server packet capture device suitable for implementing the embodiment of the present application. The server packet capture device in the embodiment of the present application may include various hardware and software components for implementing the scheduling method of the inspection task. Figure 5 The server packet capture device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0182] like Figure 5As shown, the server packet capture device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the server packet capture device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the server packet capture device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a server packet capture device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0183] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0184] The server packet capture device provided by the present application adopts the server packet capture device method in the above embodiment, which can solve the technical problem of how to improve the transparency of the server-side data interaction process. Compared with the prior art, the beneficial effects of the server packet capture device provided by the present application are the same as the beneficial effects of the server packet capture method provided by the above embodiment, and the other technical features in the server packet capture device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0185] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0186] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0187] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the server packet capturing method in the above-mentioned embodiment.

[0188] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0189] The computer-readable storage medium may be included in the server packet capture device; or may exist independently without being assembled into the server packet capture device.

[0190] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the server packet capture device, the server packet capture device: obtains a target data packet on the network interface of the server; parses the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet; sorts the target data packets based on the sequence number and reassembles the sorted target data packets to obtain original data packets; classifies the session information in the original data packet into at least one network session, and generates a data interaction record based on the network session.

[0191] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0192] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0193] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0194] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned server packet capture method, and can solve the technical problem of how to improve the transparency of the server-side data interaction process. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the server packet capture method provided by the above-mentioned embodiment, and will not be repeated here.

[0195] An embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned server packet capture method when executed by a processor.

[0196] The computer program product provided by the present application can solve the technical problem of how to improve the transparency of the server-side data interaction process. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiment of the present application are the same as the beneficial effects of the server packet capture method provided by the above embodiment, which will not be repeated here.

[0197] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

[0198] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0199] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0200] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A server packet capture method, characterized in that: The server packet capturing method comprises: Get the target data packet on the server's network interface; Parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet; Based on the sequence number, sorting the target data packets and reorganizing the sorted target data packets to obtain original data packets; The session information in the original data packet is classified into at least one network session, and a data interaction record is generated based on the network session.

2. The server packet capture method according to claim 1, characterized in that: Before the step of obtaining the target data packet on the network interface of the server, the method further includes: Capture the data packets interacting with the server through the network capture interface; The data packets that meet the preset filtering rules are selected as the target data packets.

3. The server packet capture method according to claim 1, characterized in that: The step of parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet comprises: Identify the protocol type of the target data packet; Extracting the structural information of the target data packet through a parser corresponding to the protocol type; Based on the structural information, the sequence number of the target data packet is obtained.

4. The server packet capture method according to claim 3, characterized in that: The step of identifying the protocol type of the target data packet further comprises: Extracting data of a preset length at the beginning of the target data packet as a fragment to be matched; Perform feature value matching between the to-be-matched fragment and the protocol template; For each of the protocol templates, calculating the ratio of the number of features that are successfully matched in the to-be-matched segment to the total number of features in the protocol template, and obtaining a matching degree value; When the matching degree value reaches or exceeds a preset matching threshold, the protocol type corresponding to the protocol template is determined as the protocol type of the target data packet.

5. The server packet capture method according to claim 1, characterized in that: The step of parsing the target data packet to determine the protocol type of the target data packet and the sequence number of the target data packet further includes: Traversing the target data packets and identifying the target data packets with fragment identifiers; Arranging the target data packets having the same fragment identifier in the order of the sequence numbers to obtain a target data packet sequence; Detecting whether the sequence numbers of adjacent target data packets in the target data packet sequence are continuous; If the sequence numbers are continuous, determining the relative position relationship of the fragment target data packets in the original data packet according to the fragment offset field and the total length in the fragment target data packet; Based on the order of the fragment offset fields and the total length, the valid data of the fragmented target data packets are extracted in sequence and spliced ​​together to obtain the original data packet.

6. The server packet capture method according to claim 5, characterized in that: Before the step of traversing the target data packet and identifying the target data packet with the fragment identifier, the method includes: Calculating an expected sequence number of the target data packet based on the sequence number of the target data packet that was received last; Comparing the sequence number of the target data packet with the expected sequence number to determine whether the sequence number of the target data packet is abnormal; If the sequence number of the target data packet is inconsistent with the expected sequence number, the target data packet is checked for sequence number jump or wrap.

7. The server packet capturing method according to claim 6, characterized in that: If the sequence number of the target data packet is inconsistent with the expected sequence number, the step of checking whether the target data packet has a sequence number jump or wraparound also includes: If there is a sequence number jump in the target data packet, determining the sequence number range of the lost data packet, and requesting retransmission of the data packet containing the sequence number range; If the target data packet has a sequence number wraparound, adding the sequence number of the target data packet to the maximum possible value of the sequence number to obtain a new expected sequence number; The new expected sequence number is updated as the sequence number of the target data packet.

8. The server packet capturing method according to claim 1, characterized in that: The step of classifying the session information in the original data packet into at least one network session and generating a data interaction record based on the network session further includes: Extracting five-tuple information of each of the target data packets in the original data packet, and determining a network session identifier of each of the target data packets based on the five-tuple information; According to the network session identifier, the session information of each target data packet is obtained; Classifying all the session information in the original data packet into at least one of the network sessions; According to the time sequence of each of the target data packets arriving at the network capture interface, the session information is sorted to obtain the transmission timing of the network session; Recording the payload data volume information of each target data packet in the network session; The data interaction record is generated based on the transmission timing and the effective load data volume information.

9. A server packet capture device, characterized in that: The server packet capturing device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the server packet capturing method according to any one of claims 1 to 8.

10. A computer storage medium, characterized in that: The computer storage medium is a computer-readable storage medium, and a computer program is stored on the computer storage medium. When the computer program is executed by a processor, the steps of the server packet capturing method according to any one of claims 1 to 8 are implemented.

Images