Wireless packet capturing method, device and system, and electronic equipment
By acquiring and cacheing wireless packets in the wireless network driver module and passing them to the virtual interface for packet capture, the problem of difficulty in analyzing encrypted packets in traditional wireless packet capture is solved, and efficient fault analysis is achieved and troubleshooting costs are reduced.
Patent Information
- Application Number
- CN202510084640.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-20
- Publication Date
- 2025-04-29
AI Technical Summary
When facing encrypted wireless packet capture methods, it is difficult to perform fault analysis, resulting in high troubleshooting costs and difficulty in analysis.
By obtaining and sending messages in the wireless network driver module, copying and cacheing these messages in the wireless network driver module, adding setting header information, it is passed to the preset virtual interface, and using the packet capture tool to capture messages from the virtual interface, wireless packet capture is achieved.
It realizes recording and storing messages sent and received by wireless drivers when the wireless access point and site are working normally, reducing the cost of troubleshooting and improving the accuracy of fault analysis.
Smart Images
Figure CN119907022A_ABST
Abstract
Description
Technical Field
[0001] The present application mainly relates to the field of communication technology, and in particular to a wireless packet capture method, device, electronic equipment and system. Background Art
[0002] With the development of wireless communication technology, wireless local area network (WLAN) technology has become one of the most widely used wireless access methods. More and more devices, including computers, mobile phones, IoT embedded devices, etc., access the Internet through WLAN. In order to locate complex wireless network problems, such as abnormal drivers of routers or wireless network cards, software engineers may need to capture wireless packets. Wireless packet capture is an important means of analyzing network failures of wireless routers, wireless network cards, embedded wireless devices, etc.
[0003] Traditional wireless packet capture uses a network sniffer device to monitor the wireless packets transmitted by AP (Access Point) and STA (Station) over the air interface, and save the wireless packets persistently into files for problem location analysis. Generally, user scenarios lack wireless packet capture conditions, and technicians are required to carry Sniffer devices for on-site operation, which increases the cost of troubleshooting; on the other hand, when the AP is set with wireless encryption, the wireless packets exchanged between the AP and STA recorded by the Sniffer packet capture are also encrypted, and the encrypted wireless packets make fault analysis difficult. Summary of the invention
[0004] The purpose of the present application is to provide a wireless packet capture method, device, electronic device and system to solve the problem that traditional wireless packet capture methods have difficulty in fault analysis of encrypted wireless messages.
[0005] In a first aspect, the present application provides a wireless packet capture method, the method comprising:
[0006] In the wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path are obtained;
[0007] In the wireless network driver module, the first wireless message and the second wireless message are copied and cached respectively to obtain a first cache message and a second cache message;
[0008] Adding and setting header information to the first cache message and the second cache message respectively to obtain messages to be transmitted;
[0009] The message to be transmitted is transferred to a preset virtual interface, and a packet capture tool is used to capture the message to be transmitted from the preset virtual interface.
[0010] The above method does not rely on an independent network sniffer, and can record and store the messages received and sent by the wireless driver when the wireless access point and the wireless station work normally, thereby reducing the troubleshooting cost.
[0011] Optionally, the first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame, wherein the RX encrypted wireless frame is an encrypted wireless frame received on the receiving message processing path, and the RX plaintext wireless frame is a plaintext wireless frame after the received encrypted wireless frame is decrypted on the receiving message processing path.
[0012] Optionally, the second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame, wherein the TX plaintext wireless frame is a plaintext wireless frame to be sent on the sending message processing path, and the TX encrypted wireless frame is an encrypted wireless frame after encrypting the plaintext wireless frame to be sent on the sending message processing path.
[0013] The above method can select to store plain text or encrypted wireless message data as needed, improve the accuracy of fault analysis, and increase the success rate of troubleshooting.
[0014] Optionally, the packet capture tool includes: a tcpdump packet capture tool or a wireshark packet capture tool.
[0015] Optionally, in the wireless network driver module, the step of obtaining a first wireless message on a received message processing path and a second wireless message on a sent message processing path further includes: using a hook function to obtain the first wireless message from the received message processing path and to obtain the second wireless message from the sent message processing path.
[0016] Optionally, in the wireless network driver module, the first wireless message and the second wireless message are copied and cached respectively, and the step of obtaining a first cache message and a second cache message further includes: using a copy function to copy and cache the first wireless message and the second wireless message respectively, to obtain the first cache message and the second cache message.
[0017] Optionally, the preset virtual interface is set in a Linux kernel module.
[0018] Optionally, the steps of adding and setting header information for the first cache message and the second cache message respectively are completed in the wireless network driver module.
[0019] In a second aspect, the present application provides a wireless packet capture device, the device comprising:
[0020] An acquisition module, used to acquire, in the wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path;
[0021] A copy module, used for copying the first wireless message and the second wireless message in the wireless network driver module to obtain a first cache message and a second cache message;
[0022] A cache module, used to add set header information to the first cache message and the second cache message respectively to obtain a message to be transmitted;
[0023] The packet capture module is used to transfer the message to be transmitted to a preset virtual interface, and use a packet capture tool to capture the message to be transmitted from the preset virtual interface.
[0024] In a third aspect, the present application provides an electronic device, comprising: wireless network card hardware, a wireless network driver module, a Linux kernel module, and a user space, wherein:
[0025] The wireless network card hardware is configured to transmit the received wireless message to the wireless network driver module, and to send the wireless message transmitted by the wireless network driver module;
[0026] The wireless network driver module is configured to provide a first wireless message on a received message processing path, and a second wireless message on a sent message processing path, and provide a first cache message and a second cache message obtained by copying and caching the first wireless message and the second wireless message, wherein the received message processing path represents a process of processing a received message, and the sent message processing path represents a process of processing a message to be sent;
[0027] The Linux kernel module is configured with a preset virtual interface, and the preset virtual interface is used to receive a message to be transmitted, wherein the message to be transmitted is a wireless message after setting header information is added to the first cache message and the second cache message respectively;
[0028] A packet capture program is configured in the user space, and the packet capture program is configured to capture the message to be transmitted from the preset virtual interface.
[0029] Optionally, the first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame, wherein the RX encrypted wireless frame is an encrypted wireless frame received on the receiving message processing path, and the RX plaintext wireless frame is a plaintext wireless frame after the received encrypted wireless frame is decrypted on the receiving message processing path.
[0030] Optionally, the second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame, wherein the TX plaintext wireless frame is a plaintext wireless frame to be sent on the sending message processing path, and the TX encrypted wireless frame is an encrypted wireless frame after encrypting the plaintext wireless frame to be sent on the sending message processing path.
[0031] Optionally, a hook function is configured in the wireless network driver module, and the hook function is used to obtain the first wireless message on the received message processing path and the second wireless message on the sent message processing path.
[0032] Optionally, a copy function is configured in the wireless network driver module, and the copy function is used to copy and cache the first wireless message and the second wireless message to obtain the first cache message and the second cache message.
[0033] In a fourth aspect, the present application provides a wireless packet capture system, the wireless packet capture system comprising:
[0034] Memory, used to store computer programs;
[0035] The processor is used to implement the above-mentioned wireless packet capture method steps when executing the computer program stored in the memory.
[0036] In a fifth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned wireless packet capture method steps are implemented.
[0037] For each of the above-mentioned second to fifth aspects and the technical effects that may be achieved by each of the above-mentioned aspects, please refer to the technical effects that can be achieved by the above-mentioned first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] The accompanying drawings are included to provide a further understanding of the present application. They are included and constitute a part of the present application. The accompanying drawings illustrate embodiments of the present application and together with the present specification serve to explain the principles of the present application. In the accompanying drawings:
[0039] Figure 1 It is a work flow chart of a Sniffer device running a Linux system in the prior art;
[0040] Figure 2 It is a flow chart of executing tcpdump packet capture in AP or STA mode in the prior art;
[0041] Figure 3 It is a structural schematic diagram of an electronic device provided by the present application;
[0042] Figure 4 It is a flow chart of a wireless packet capture method provided by the present application;
[0043] Figure 5 is a schematic diagram of a wireless packet capture device provided by the present application;
[0044] Figure 6 It is a schematic diagram of a wireless packet capture system provided by the present application. DETAILED DESCRIPTION
[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for the description of the embodiments. Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. Unless it is obvious from the language environment or otherwise explained, the same reference numerals in the figures represent the same structure or operation.
[0046] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.
[0047] Unless otherwise specifically stated, the relative arrangement, numerical expressions and numerical values of the parts and steps set forth in these embodiments do not limit the scope of the present application. At the same time, it should be understood that, for ease of description, the sizes of the various parts shown in the accompanying drawings are not drawn according to the actual proportional relationship. The technology, method and equipment known to those of ordinary skill in the relevant field may not be discussed in detail, but in appropriate cases, the technology, method and equipment should be considered as a part of the authorization specification. In all examples shown and discussed here, any specific value should be interpreted as being merely exemplary, rather than as a limitation. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so that once a certain item is defined in an accompanying drawing, it does not need to be further discussed in subsequent drawings.
[0048] In the description of this application, "multiple" is understood to be "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.
[0049] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously. At the same time, other operations may be added to these processes, or one or more operations may be removed from these processes.
[0050] The following is a brief introduction to the design concept of the embodiments of the present application.
[0051] Traditional wireless packet capture uses Sniffer devices to monitor wireless packets transmitted by AP and STA on the air interface. To capture wireless packets in Linux system, you need to set the network card or wireless device to Monitor (wireless monitor) mode, and use tools such as tcpdump (network data collection and analysis tool) and wireshark (network packet analysis software) to capture packets. Among them, Monitor mode requires the support of the wireless driver corresponding to the network card or wireless device.
[0052] The working method of using Sniffer device to capture wireless packets under Linux system is as follows Figure 1 , set the wireless driver device of the network card wlan0 to Monitor mode. In Monitor mode, the device does not send packets to the outside, but only passively monitors the wireless packets transmitted on the air interface. After the wireless driver receives the 802.11 wireless packets transmitted on the air interface, it adds the radiotap header information, which mainly includes the radio frequency information when receiving, such as signal strength, channel, timestamp, and wireless modulation mode. The wireless driver uploads the wireless message filled with the radiotap header to the Linux kernel, because the Linux kernel has registered the ptype_all virtual protocol callback hook function on each network card interface transceiver path. The user-state processes tcpdump and wireshark can obtain these link layer messages through the PF_PACKET type socket. In Monitor mode, since the network card does not send packets to the outside, tcpdump only captures the wireless messages on the wireless interface receiving path.
[0053] Wireless devices that need to be debugged or troubleshooted usually work in AP or STA mode and cannot capture wireless packets in monitor mode while providing wireless services normally. Therefore, Sniffer devices can only be completed using independent devices other than AP and STA. In user scenarios, wireless packet capture generally requires technicians to perform on-site operations, which increases debugging costs. Since Sniffer devices directly capture air interface packets, if the AP device has wireless encryption turned on, the data frames and some management frames transmitted over the air interface are encrypted, so the wireless packets stored in the Sniffer device are also encrypted. Wireless encrypted packets will make it difficult to debug certain wireless problems.
[0054] In addition to independent Sniffer devices to capture packets, you can also use tcpdump on the Linux system to capture packets on the wireless interface of a running AP or STA. Figure 2 As shown in the figure, in AP or STA mode, the RX (Receive) message and TX (Transmit) message copied by tcpdump from the kernel network driver hook point of wlan0 are 802.3 wired frames, not 802.11 wireless frames. This is because on the wireless receiving path, the 802.11 wireless frame is converted into an 802.3 wired frame after being decrypted, and then captured by the PF_PACKET socket; on the wireless transmitting path, the 802.3 wired frame is captured before being converted into an 802.11 wireless frame. Therefore, this method cannot capture 802.11 wireless messages, but only 802.3 wired frames.
[0055] In addition, the management frames and control frames received and sent by wireless devices cannot be obtained through tcpdump. This shows that tcpdump can only capture the converted 802.3 wired frames, but cannot capture 802.11 wireless management frames, control frames, and data frames, which has limited effect on wireless debugging.
[0056] In order to solve the above technical problems, the present application provides a wireless packet capture method, which creates a virtual interface in the Linux kernel module to realize the selection of capturing and storing wireless encrypted frames or wireless plaintext frames according to different debugging needs, and can be directly run on the AP or STA device to be debugged, and the normal wireless communication of the device is not affected during packet capture.
[0057] The method provided in the embodiments of the present application is further described in detail below in conjunction with the accompanying drawings.
[0058] See also Figure 3 As shown, an electronic device provided in an embodiment of the present application includes: wireless network card hardware, a wireless network driver module, a Linux kernel module, and a user space.
[0059] In the electronic device provided in the embodiment of the present application, the wireless network card hardware is configured to transmit the received wireless message to the wireless network driver module and to send the wireless message transmitted by the wireless network driver module. It is worth noting that the received wireless message and the sent wireless message are both 802.11 wireless frames.
[0060] The wireless network driver module is configured to provide a first wireless message on a received message processing path and a second wireless message on a sent message processing path. The received message processing path, referred to as the RX path, represents the process of processing the received message, such as Figure 3 In the figure, the process of 802.11 frame reception → 802.11 frame decryption → 802.11 frame conversion to 802.3 frame (wireless frame conversion to wired frame) is represented as the receive message processing path; the send message processing path, referred to as the TX path, represents the process of processing the message to be sent, such as Figure 3 In the example, the process of 802.3 frame conversion to 802.11 frame (wired frame conversion to wireless frame) → 802.11 frame encryption → 802.11 frame sending represents the message sending processing path.
[0061] In an embodiment of the present application, the first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame, wherein the RX encrypted wireless frame is an encrypted wireless frame received on a receiving message processing path, such as an encrypted 802.11 wireless frame; the RX plaintext wireless frame is a plaintext wireless frame after decrypting an encrypted wireless frame received on the receiving message processing path, such as a plaintext wireless frame after decrypting an encrypted 802.11 wireless frame. The second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame, wherein the TX plaintext wireless frame is a plaintext wireless frame to be sent on a sending message processing path, such as an 802.11 wireless frame before encryption on the TX path; the TX encrypted wireless frame is an encrypted wireless frame after encrypting a plaintext wireless frame to be sent on a sending message processing path, such as an encrypted 802.11 wireless frame after encrypting an 802.11 wireless frame on the TX path.
[0062] The wireless network driving module is further configured to provide a first cache message and a second cache message obtained by copying and caching the first wireless message and the second wireless message.
[0063] The Linux kernel module is configured with a preset virtual interface, such as Figure 3 The monitor0 message receiving interface in the preset virtual interface is used to receive the message to be transmitted, and the message to be transmitted is a wireless message after the set header information is added to the first cache message and the second cache message respectively.
[0064] A packet capture program is configured in the user space, and the packet capture program is configured to capture the message to be transmitted from the preset virtual interface.
[0065] The wireless network driver module is also configured with a hook function, and the hook function is used to obtain the first wireless message on the received message processing path and the second wireless message on the sent message processing path.
[0066] The wireless network driver module is also configured with a copy function, which is used to copy and cache the first wireless message and the second wireless message to obtain the first cache message and the second cache message. The copy function can be but not limited to the skb_copy (socket cache copy) function, and the copy method can be a deep copy, which can avoid conflicts with the wlan0 message processing flow in the Linux kernel module, because the normal message processing flow of wlan0 may modify the message content.
[0067] Based on the above electronic device, the present application embodiment provides a wireless packet capture method, see Figure 4 As shown, the specific process is as follows:
[0068] Step 401: In a wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path are obtained;
[0069] In the embodiment of the present application, the received message processing path represents the process of processing the received message, which can be referred to as the RX path; the sent message processing path represents the process of processing the message to be sent, which can be referred to as the TX path.
[0070] The first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame. The RX encrypted wireless frame is an encrypted wireless frame received on the RX path, such as Figure 3 In the example, the encrypted wireless frame is obtained before the "802.11 frame decryption" step. The RX plaintext wireless frame is the plaintext wireless frame after the encrypted wireless frame received on the RX path is decrypted. For example, Figure 3 In the figure, the plaintext wireless frame is after the "802.11 frame decryption" step and before the "802.11 frame to 802.3 frame" step.
[0071] The second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame. The TX plaintext wireless frame is a plaintext wireless frame to be sent on the TX path, such as Figure 3 In the process of converting 802.3 frames to 802.11 frames, the plaintext wireless frame is the encrypted wireless frame after the plaintext wireless frame to be sent is encrypted on the TX path. For example, Figure 3 In the encrypted wireless frame after the "802.11 frame encryption" step.
[0072] In an embodiment of the present application, hook functions are added to the RX path and the TX path, and the first wireless message and the second wireless message are obtained through the hook functions.
[0073] The specific contents of the captured first wireless message and the second message can be selected according to the debugging requirements. You can choose to capture only plaintext frames or encrypted frames, or you can choose to capture both plaintext frames and encrypted frames, thereby realizing the capture of wireless messages at different positions of the wireless driver.
[0074] Step 402: In the wireless network driver module, the first wireless message and the second wireless message are copied and cached respectively to obtain a first cache message and a second cache message;
[0075] In the embodiment of the present application, after the first wireless message and the second wireless message are captured, a copy function is used to copy and cache the first wireless message and the second wireless message respectively to obtain a first cache message and a second cache message.
[0076] Specifically, the skb_copy function can be used to perform deep copies of the first wireless message and the second wireless message respectively to obtain the first cache message and the second cache message. The deep copy can avoid conflicts with the wlan0 message processing flow in the Linux kernel module, because the normal message processing flow of wlan0 may modify the message content. The use of deep copy can improve the accuracy of the cache message, so as to improve the accuracy of subsequent fault analysis.
[0077] Step 403: Adding and setting header information to the first cache message and the second cache message respectively to obtain a message to be transmitted;
[0078] Specifically, setting header information is added to the first cache message and the second cache message respectively, and the setting header information is specifically radiotap header information.
[0079] It should be noted that generally only the RX path has RF information related to wireless message reception, such as received signal strength, wireless channel, wireless modulation mode, timestamp, etc. The first cached message is the message on the RX path. Therefore, only the radiotap header information added to the first cached message contains RF information such as received signal strength, wireless channel, wireless modulation mode, timestamp, etc. For the second cached message on the TX path, it only needs to meet the radiotap header information format.
[0080] Step 404: the message to be transmitted is delivered to the preset virtual interface, and a packet capture tool is used to capture the message to be transmitted from the preset virtual interface.
[0081] In the embodiment of the present application, the preset virtual interface is set in the Linux kernel module. Specifically, in the Linux kernel module, the alloc_etherdev function is used to create and initialize a virtual network interface, which can be recorded as monitor0, and the device type is set to ARPHRD_IEEE80211_RADIOTAP. Here, monitor0 is a memory virtual device and does not require physical hardware support.
[0082] The message to be transmitted is received through the created virtual interface, and then in the user space, the message of the virtual interface is captured using a packet capture tool, and the 802.11 wireless message at the real wireless interface (ie, wlan0) can be obtained.
[0083] It is worth noting that the packet capture tools used include but are not limited to: tcpdump or wireshark packet capture tools.
[0084] The wireless packet capture method provided in the embodiment of the present application does not rely on a separate Sniffer device, and can be directly run on the AP or STA device to be debugged. The normal wireless communication of the device is not affected when the packet is captured, and wireless encrypted frames or wireless plaintext frames can be captured and stored according to different debugging needs, or wireless encrypted frames or wireless plaintext frames can be stored at the same time. The method can be combined with remote debugging, uploading the captured packet data to the cloud or exporting it locally, etc., to facilitate engineers to remotely troubleshoot and reduce debugging costs.
[0085] Based on the same inventive concept, the present application also provides a wireless packet capture device to solve the problem that the traditional wireless packet capture method has difficulty in fault analysis of encrypted wireless messages, and achieves the goal of not relying on independent network sniffers. When the wireless access point and the wireless station are working normally, the wireless driver can be captured and stored to reduce the cost of troubleshooting and improve the accuracy of fault analysis. Figure 5 As shown, the device comprises:
[0086] An acquisition module 501 is used to acquire, in a wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path;
[0087] A copy module 502, configured to copy the first wireless message and the second wireless message in the wireless network driver module to obtain a first cache message and a second cache message;
[0088] A cache module 503, used to add and set header information to the first cache message and the second cache message respectively to obtain a message to be transmitted;
[0089] The packet capture module 504 is used to transfer the message to be transmitted to the preset virtual interface, and use a packet capture tool to capture the message to be transmitted from the preset virtual interface.
[0090] Based on the same inventive concept, a wireless packet capture system is also provided in the embodiment of the present application. The wireless packet capture system can realize the functions of the aforementioned wireless packet capture device. Figure 6 , the wireless packet capture system comprises:
[0091] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.
[0092] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the wireless packet capture method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.
[0093] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.
[0094] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0095] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the wireless packet capture method disclosed in the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.
[0096] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0097] By programming the processor 601, the code corresponding to the wireless packet capture method described in the above embodiment can be fixed into the chip, so that the chip can execute the wireless packet capture method when running. Figure 4 The steps of the wireless packet capture method of the embodiment shown are as follows: How to design and program the processor 401 is a technology well known to those skilled in the art and will not be described in detail here.
[0098] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the wireless packet capture method discussed above.
[0099] In some possible implementations, various aspects of the wireless packet capture method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a device, the program code is used to enable the control device to execute the steps of the wireless packet capture method according to various exemplary implementations of the present application described above in this specification.
[0100] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0102] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0104] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A wireless packet capture method, characterized in that: The method comprises: In the wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path are obtained; In the wireless network driver module, the first wireless message and the second wireless message are copied and cached respectively to obtain a first cache message and a second cache message; Adding and setting header information to the first cache message and the second cache message respectively to obtain messages to be transmitted; The message to be transmitted is transferred to a preset virtual interface, and a packet capture tool is used to capture the message to be transmitted from the preset virtual interface.
2. The method according to claim 1, characterized in that The first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame, wherein the RX encrypted wireless frame is an encrypted wireless frame received on the received message processing path, and the RX plaintext wireless frame is a plaintext wireless frame after the received encrypted wireless frame is decrypted on the received message processing path.
3. The method according to claim 1, characterized in that The second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame, wherein the TX plaintext wireless frame is a plaintext wireless frame to be sent on the sending message processing path, and the TX encrypted wireless frame is an encrypted wireless frame after the plaintext wireless frame to be sent is encrypted on the sending message processing path.
4. The method according to claim 1, characterized in that The packet capture tool includes: a tcpdump packet capture tool or a wireshark packet capture tool.
5. The method according to claim 1, characterized in that In the wireless network driver module, the steps of obtaining a first wireless message on a received message processing path and a second wireless message on a sent message processing path further include: A hook function is used to obtain the first wireless message from the received message processing path, and to obtain the second wireless message from the sent message processing path.
6. The method according to claim 1, characterized in that In the wireless network driver module, the first wireless message and the second wireless message are copied and cached respectively, and the step of obtaining the first cache message and the second cache message further includes: The first wireless message and the second wireless message are copied and cached respectively by using a copy function to obtain the first cache message and the second cache message.
7. The method according to any one of claims 1 to 6, characterized in that: The preset virtual interface is set in the Linux kernel module.
8. The method according to claim 7, characterized in that The steps of adding and setting header information for the first cache message and the second cache message are respectively completed in the wireless network driver module.
9. A wireless packet capture device, characterized in that: include: An acquisition module, used to acquire, in the wireless network driver module, a first wireless message on a received message processing path and a second wireless message on a sent message processing path; A copy module, used for copying the first wireless message and the second wireless message in the wireless network driver module to obtain a first cache message and a second cache message; A cache module, used to add set header information to the first cache message and the second cache message respectively to obtain a message to be transmitted; The packet capture module is used to transfer the message to be transmitted to a preset virtual interface, and use a packet capture tool to capture the message to be transmitted from the preset virtual interface.
10. An electronic device, characterized in that: include: Wireless network card hardware, wireless network driver module, Linux kernel module, and user space, among which, The wireless network card hardware is configured to transmit the received wireless message to the wireless network driver module, and to send the wireless message transmitted by the wireless network driver module; The wireless network driver module is configured to provide a first wireless message on a received message processing path, and a second wireless message on a sent message processing path, and provide a first cache message and a second cache message obtained by copying and caching the first wireless message and the second wireless message, wherein the received message processing path represents a process of processing a received message, and the sent message processing path represents a process of processing a message to be sent; The Linux kernel module is configured with a preset virtual interface, and the preset virtual interface is used to receive a message to be transmitted, wherein the message to be transmitted is a wireless message after setting header information is added to the first cache message and the second cache message respectively; A packet capture program is configured in the user space, and the packet capture program is configured to capture the message to be transmitted from the preset virtual interface.
11. The electronic device according to claim 10, characterized in that: The first wireless message includes an RX encrypted wireless frame and / or an RX plaintext wireless frame, wherein the RX encrypted wireless frame is an encrypted wireless frame received on the received message processing path, and the RX plaintext wireless frame is a plaintext wireless frame after the received encrypted wireless frame is decrypted on the received message processing path.
12. The electronic device according to claim 10, characterized in that: The second wireless message includes a TX plaintext wireless frame and / or a TX encrypted wireless frame, wherein the TX plaintext wireless frame is a plaintext wireless frame to be sent on the sending message processing path, and the TX encrypted wireless frame is an encrypted wireless frame after the plaintext wireless frame to be sent is encrypted on the sending message processing path.
13. The electronic device according to claim 10, characterized in that: The wireless network driver module is configured with a hook function, and the hook function is used to obtain the first wireless message on the received message processing path and the second wireless message on the sent message processing path.
14. The electronic device according to claim 10, characterized in that: The wireless network driver module is configured with a copy function, and the copy function is used to copy and cache the first wireless message and the second wireless message to obtain the first cache message and the second cache message.
15. The electronic device according to any one of claims 10 to 14, characterized in that: The wireless network driving module is further configured to add set header information to the first cache message and the second cache message respectively to obtain the message to be transmitted.
16. A wireless packet capture system, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 8 when executing a computer program stored in the memory.
17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 8 are implemented.