A packet analysis device and method

Abstract

The application provides a message analysis device and method. The device comprises at least one first analysis unit and at least one second analysis unit. The first analysis unit is configured to analyze L2 layer protocol header information in a network message by using preconfigured first configuration information, and provide the analysis result to the second analysis unit. The second analysis unit is configured to analyze L2 layer above protocol header information in the network message and determine message action data corresponding to the L2 layer above protocol header information by using preconfigured second configuration information and the analysis result provided by the first analysis unit. The technical solution of the application supports analysis of a self-defined protocol, can realize programmability of network message analysis, can self-define analysis depth and level of a message, realizes deep analysis of a network message, and can also increase the throughput of network message analysis by setting multiple parallel first analysis units and second analysis units.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network message analysis, and particularly relates to a message analysis device and method. BACKGROUND

[0002] In a network device, network message analysis plays a very important role as a prerequisite for network message processing and network message forwarding behavior. With the continuous development of network technology, the following requirements are put forward for the network message analyzer:

[0003] 1) Line speed analysis to meet the growing throughput demand;

[0004] 2) Programmability to meet the analysis needs of rapidly iterating network protocols or custom network protocols;

[0005] 3) Deep analysis to provide higher level hardware offloading. SUMMARY

[0006] The present application aims to provide a message analysis device and method, which aims to solve the problem that the network message analyzer in the related art cannot simultaneously meet the high throughput, programmability and deep analysis.

[0007] According to a first aspect of the present application, a message analysis device is provided, comprising: a first analysis unit and at least one group of second analysis units; wherein,

[0008] The first analysis unit is configured to analyze L2 layer protocol header information in a network message using preconfigured first configuration information.

[0009] The second analysis unit is configured to analyze L2 layer protocol header information and above the L2 layer protocol header information in the network message using preconfigured second configuration information, and determine the message action data corresponding to the L2 layer protocol header information above; wherein the number of groups of second analysis units corresponds to the number of levels of protocol headers to be analyzed, and one group of second analysis units is used to analyze the L2 layer protocol header information of one level, and the L2 layer protocol header information above that is not identified by the second analysis unit corresponding to the previous level is analyzed by the second analysis unit corresponding to the next level.

[0010] The message analysis device of the present application is simple in structure and easy to implement, which uses the first analysis unit to analyze the L2 layer protocol header in the network message, uses the second analysis unit to analyze the L2 layer protocol header above the network message, and both use software configured information to analyze the network message, supporting the analysis of custom protocols, which can realize the programmability of network message analysis, and can customize the analysis depth and level of the message, realize the deep analysis of network message, and also can increase the throughput of network message analysis by setting multiple parallel first analysis units and second analysis units.

[0011] In some optional embodiments, the first configuration information comprises a first protocol header identification code of at least one L2 layer protocol header, a corresponding protocol header length and a software configuration code; the first parsing unit reads first header field information from a start position of a protocol header field segment of the network message, matches the first header field information with the first protocol header identification code, if there is a matched first protocol header identification code, parses L2 layer protocol header information corresponding to the matched first protocol header identification code based on the matched first protocol header identification code, the corresponding protocol header length and the software configuration code.

[0012] In this way, L2 layer protocol header parsing can be quickly implemented, and parsing of a self-defined protocol can be implemented through software configuration. The parsing process of the first parsing unit is irrelevant to specific entries of the first configuration information, and therefore has better universality.

[0013] In some optional embodiments, the first parsing unit further determines an offset position of a next protocol header based on the protocol header length corresponding to the matched first protocol header identification code, extracts next header field information based on the offset position, and matches the next header field information with the first protocol header identification code, if there is no matched first protocol header identification code, provides the next header field information and the offset position of the next protocol header to the second parsing unit corresponding to the L3 layer.

[0014] In this way, the first parsing unit can parse any L2 layer protocol header information in the network message, including self-defined protocol header information, and can also determine a software configuration code corresponding to the parsed L2 layer protocol header, so that subsequent configurable message processing and forwarding behavior can be performed on the network message based on the software configuration code.

[0015] In some optional embodiments, the second configuration information comprises at least one second protocol header identification code of a L2 layer above protocol header corresponding to a level of the second parsing unit and its corresponding protocol header software configuration information; the protocol header software configuration information comprises a protocol header length corresponding to the second protocol header identification code; the second parsing unit corresponding to the L3 layer level matches the second protocol header identification code in the second configuration information with next header domain information of a next protocol header provided by the first parsing unit, and based on the protocol header length corresponding to the matched second protocol header identification code and an offset position of the next protocol header provided by the first parsing unit, parses L2 layer above protocol header information corresponding to the matched second protocol header identification code from the network message; the second parsing unit corresponding to the L3 layer level above matches the second protocol header identification code in the second configuration information with next header domain information of a next protocol header provided by the second parsing unit corresponding to a previous level, and based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit, parses L2 layer above protocol header information corresponding to the matched second protocol header identification code from the network message.

[0016] In this way, when there is a L2 layer above protocol header that cannot be recognized by the first parsing unit, the second parsing unit can be used to parse it, so that higher level parsing of the network message can be finally realized, and the L2 layer protocol header parsing and the L2 layer above protocol header parsing are respectively realized by different hardware logics, so that by setting multiple first parsing units and second parsing units running in parallel and configuring multiple MAUs, line speed parsing can be realized.

[0017] In some optional embodiments, the protocol header software configuration information further comprises an offset position and mask information of a next L2 layer above protocol header; the second parsing unit further determines a starting position of the next L2 layer above protocol header in the network message based on the offset position of the next L2 layer above protocol header corresponding to the matched second protocol header identification code, and determines a second protocol header identification code of the next L2 layer above protocol header based on the mask information of the next L2 layer above protocol header and a next header domain segment in the L2 layer above protocol header information corresponding to the matched second protocol header identification code, and parses next L2 layer above protocol header information from the network message based on the second protocol header identification code of the next L2 layer above protocol header, the second configuration information and the starting position of the next L2 layer above protocol header in the network message.

[0018] In this way, the second parsing unit can realize parsing of indefinite length L2 layer protocol headers, has higher flexibility, and can parse deeper level network messages.

[0019] According to a second aspect of the present application, a message parsing method is provided, comprising:

[0020] The first analysis unit analyzes L2 layer protocol header information in the network message by using preconfigured first configuration information.

[0021] The second analysis unit analyzes L2 layer above protocol header information in the network message and determines message action data corresponding to the L2 layer above protocol header information by using preconfigured second configuration information; the number of groups of the second analysis unit corresponds to the number of levels of protocol headers to be analyzed, and one group of the second analysis unit is used to analyze L2 layer above protocol header information of one level, and L2 layer above protocol header information that is not identified by the second analysis unit of a previous level is analyzed by the second analysis unit of a next level.

[0022] In some optional embodiments, the first configuration information includes a first protocol header identification code of at least one L2 layer protocol header, a corresponding protocol header length, and a software configuration code; the first analysis unit analyzes L2 layer protocol header information in the network message by using preconfigured first configuration information, including:

[0023] The first analysis unit reads first header field information from a start position of a protocol header field segment of the network message;

[0024] The first analysis unit matches the first header field information with the first protocol header identification code;

[0025] If there is a matched first protocol header identification code, the first analysis unit analyzes L2 layer protocol header information corresponding to the matched first protocol header identification code based on the matched first protocol header identification code, a corresponding protocol header length, and a software configuration code.

[0026] In some optional embodiments, the first analysis unit analyzes L2 layer protocol header information in the network message by using preconfigured first configuration information, and further includes:

[0027] The first analysis unit determines an offset position of a next protocol header based on a protocol header length corresponding to the matched first protocol header identification code;

[0028] The first analysis unit extracts next header field information based on the offset position and matches the next header field information with the first protocol header identification code;

[0029] If there is no matched first protocol header identification code, the first analysis unit provides analyzed L2 layer protocol header information and header field information of the next protocol header to the second analysis unit corresponding to an L3 level.

[0030] In some optional embodiments, the second configuration information comprises at least one second protocol header identification code of a L2 layer above protocol header corresponding to a level of the second parsing unit and its corresponding protocol header software configuration information; the protocol header software configuration information comprises a protocol header length corresponding to the second protocol header identification code; the second parsing unit utilizes the preconfigured second configuration information and the parsing result provided by the first parsing unit to parse the L2 layer above protocol header information in the network packet and determine the packet action data corresponding to the L2 layer above protocol header information, comprising:

[0031] The second parsing unit corresponding to the L3 level matches the next header domain information of the next protocol header provided by the first parsing unit with the second protocol header identification code in the second configuration information;

[0032] The second parsing unit corresponding to the L3 level parses the L2 layer above protocol header information corresponding to the matched second protocol header identification code from the network packet based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit;

[0033] The second parsing unit corresponding to the L3 level above matches the next header domain information of the next protocol header provided by the second parsing unit corresponding to the previous level with the second protocol header identification code in the second configuration information;

[0034] The second parsing unit corresponding to the L3 level above parses the L2 layer above protocol header information corresponding to the matched second protocol header identification code from the network packet based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit.

[0035] In some optional embodiments, the protocol header software configuration information further comprises an offset position and a mask information of the next L2 layer above protocol header; the second parsing unit utilizes the preconfigured second configuration information and the parsing result provided by the first parsing unit to parse the L2 layer above protocol header information in the network packet and determine the packet action data corresponding to the L2 layer above protocol header information, further comprising:

[0036] The second parsing unit determines the starting position of the next L2 layer above protocol header in the network packet based on the offset position of the next L2 layer above protocol header corresponding to the matched second protocol header identification code;

[0037] The second parsing unit determines the second protocol header identification code of the next L2 layer above protocol header based on the mask information of the next L2 layer above protocol header and the next protocol header domain segment in the L2 layer above protocol header information corresponding to the matched second protocol header identification code;

[0038] The second analysis unit identifies the next L2 layer or above protocol header information from the network message based on the second protocol header identification code of the next L2 layer or above protocol header, the second configuration information and the starting position of the next L2 layer or above protocol header in the network message.

[0039] Other features and advantages of the present application will be set forth in the following description, and in part will be apparent from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by the structure particularly pointed out in the description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without any creative effort.

[0041] Figure 1 is a structural block diagram of a message analysis device according to an exemplary embodiment of the present application;

[0042] Figure 2 is a structural schematic diagram of an L2 layer protocol header in a network message according to an exemplary embodiment of the present application;

[0043] Figure 3 is a structural schematic diagram of first configuration information according to an exemplary embodiment of the present application;

[0044] Figures 4A-4C is a structural schematic diagram of second configuration information according to an exemplary embodiment of the present application;

[0045] Figure 5 is a parsing schematic diagram of a 4 layer protocol header according to an exemplary embodiment of the present application;

[0046] Figure 6 is a flow schematic diagram of a message analysis method according to an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be clearly and completely described in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the protection scope of the present application.

[0048] The network message parser in the related art often has the following problems:

[0049] 1. When the message parsing lacks programmability, the network message parser has poor scalability and cannot identify user-defined or unknown network protocol headers;

[0050] 2. When the message parsing has programmability, the implementation of the network message parser is either too complex or cannot achieve line-speed parsing;

[0051] 3. The message parsing has fixed levels, poor software controllability, lacks deep packet parsing, and cannot perform deep CPU offloading.

[0052] Based on the above analysis, referring to Figure 1 , it is shown that, for example, the present application proposes a message parsing device, comprising: a first parsing unit 101 and at least one group of second parsing units 102; wherein,

[0053] The first parsing unit 101 is configured to parse L2 layer protocol header information in a network message using preconfigured first configuration information;

[0054] The second parsing unit 102 is configured to parse L2 layer protocol header information and above L2 layer protocol header information in a network message using preconfigured second configuration information and determine message action data corresponding to the L2 layer protocol header information and above L2 layer protocol header information; wherein the number of groups of second parsing units corresponds to the number of levels of protocol headers to be parsed, and a group of second parsing units is configured to parse L2 layer protocol header information of one level, and L2 layer protocol header information and above L2 layer protocol header information of a previous level that is not recognized by the corresponding second parsing unit is handed over to a second parsing unit corresponding to a next level for parsing.

[0055] For example, the first parsing unit is configured to complete the parsing of L2 layer protocol header information (usually MAC layer), and the structure of the L2 layer protocol header in the network message is as shown in Figure 2 The L2 layer protocol header occupies a certain length from the start of the network message. The L2 layer protocol header includes source address / destination address (such as MAC address), protocol header Tag, and protocol header identification code (EtherType); wherein the protocol header Tag can be multiple, and the first 2 bytes of each protocol header Tag is the protocol header identification code corresponding thereto. In some embodiments, the L2 layer protocol header Tag can be a combination of one or more of the protocol headers such as VLAN, MPLS, SNAP, NSH, SECTAG, etc.

[0056] Exemplarily, the application extends the programmability and customization capability of the L2 layer protocol header, allowing software to pre-configure first configuration information, which can be stored in the register L2 tag ctl. The first configuration information includes relevant information required for parsing the L2 layer protocol header, such as at least a first protocol header identification code for identifying the type of L2 layer protocol header. The first parsing unit uses the first configuration information to parse the L2 layer protocol header information in the network packet, and provides the parsing result obtained to the second parsing unit corresponding to the L3 layer. The second parsing unit can include one or more groups, each group corresponding to a layer of L2 layer protocol header. If only the L3 layer needs to be parsed in actual application, only one group of second parsing unit can be set, otherwise the number of second parsing units can be set according to the number of layers to be parsed, and each group of second parsing unit is responsible for parsing a layer of L2 layer protocol header. Each group of second parsing unit can include one or more second parsing units, and the second parsing units in the same group have the same function and can be parallelly parsed to improve the parsing speed. Of course, the first parsing unit can also be set to multiple for parallel parsing of different network packets, thereby improving the packet parsing speed.

[0057] After the second parsing unit corresponding to the L3 layer receives the network packet and some parsing information of the first parsing unit, it can parse the network packet based on the second configuration information pre-configured by the software and some parsing information provided by the first parsing unit, such as the header field information and offset position of the next protocol header not identified by the first parsing unit, to parse the L2 layer protocol header information. After the second parsing unit corresponding to the L3 layer receives the network packet and some parsing information of the second parsing unit corresponding to the previous layer, it can parse the network packet based on the second configuration information pre-configured by the software and the parsing information of the second parsing unit corresponding to the previous layer, such as the relevant information of the next protocol header not identified by the second parsing unit corresponding to the previous layer, to parse the L2 layer protocol header information. Each group of second parsing unit corresponds to different second configuration information, which includes relevant information required for parsing the L2 layer protocol header corresponding to the second parsing unit, such as at least a second protocol header identification code for identifying the type of L2 layer protocol header. It can be understood that the L2 layer protocol header refers to the MAC layer protocol, including but not limited to VLAN, MPLS, SNAP, NSH, SECTAG. The L2 layer protocol header refers to the L3 layer (network layer), L4 layer (transport layer), UDP tunnel TUNNEL packet such as VXLAN, L5 layer (session layer)……etc. protocol header.

[0058] The packet analysis device of the present application is simple in structure and easy to implement. The first analysis unit is used to analyze the L2 layer protocol header in the network packet, and one or more sets of second analysis units are used to analyze the L2 layer protocol header and deeper level protocol headers in the network packet. Both of them use software configured information to analyze the network packet, support custom protocol analysis, can realize programmable network packet analysis, and can customize the analysis depth and level of the network packet, realize deep network packet analysis, and can also increase the throughput of network packet analysis by setting multiple parallel first analysis units and second analysis units.

[0059] In some optional implementations, the first configuration information includes a first protocol header identification code of at least one L2 layer protocol header and its corresponding protocol header length and software configuration code; the first analysis unit reads the first header field information from the start position of the protocol header field segment of the network packet, matches the first header field information with the first protocol header identification code, and if there is a matching first protocol header identification code, analyzes the L2 layer protocol header information corresponding to the matching first protocol header identification code based on the matching first protocol header identification code and its corresponding protocol header length and software configuration code.

[0060] For example, the user can pre-configure all supported L2 layer protocol headers through software. The structure of the first configuration information is as shown in Figure 3 The first protocol header identification code (Ethertype), the protocol header length, and the software configuration code. The first protocol header identification code is used to identify the type of L2 layer protocol header in the network packet. The header field information of each Tag in the Tag field segment of the network packet includes the corresponding first protocol header identification code. It can be understood that the header field information of the first L2 layer protocol header carried by the network packet can be extracted from the first 2 bytes of the Tag field segment of the network packet. The protocol header length is the byte length of the L2 layer protocol header information corresponding to the first protocol header identification code in the network packet. The software configuration code is a unified code configured by the user through software for each protocol header (including L2 layer protocol headers and L2 layer protocol headers).

[0061] Exemplarily, in the process of analyzing the network message, the first analyzing unit starts to analyze the network message, and extracts first header field information in the Tag field segment from the source address / destination address of the network message (the source address / destination address is a fixed 12 bytes when the source address / destination address is a MAC address, that is, 12 bytes are skipped from the start of the network message). If there is a first protocol header identification code matched with the extracted first header field information in the first configuration information, the first L2 layer protocol header information can be extracted from the network message based on the protocol header length corresponding to the matched first protocol header identification code in the first configuration information (that is, the protocol header length bytes are extracted from the first byte in the Tag field segment), and the software configuration code corresponding to the extracted L2 layer protocol header information can also be determined from the first configuration information. It should be noted that the analysis result of the first L2 layer protocol header information includes the L2 layer protocol header information extracted from the network message and the corresponding software configuration code, because the software configuration code can be used for subsequent packet processing and packet forwarding, so that the packet processing and packet forwarding are more flexible.

[0062] In this way, the L2 layer protocol header analysis can be quickly realized, and the analysis of self-defined protocols can be realized through software configuration. The analysis process of the first analyzing unit is independent of the specific entries of the first configuration information, so the first analyzing unit has good versatility.

[0063] In some optional implementation manners, the first analyzing unit also determines the offset position of the next protocol header based on the protocol header length corresponding to the matched first protocol header identification code, extracts next header field information based on the offset position, and matches the next header field information with the first protocol header identification code. If there is no matched first protocol header identification code, the next header field information and the offset position of the next protocol header are provided to the second analyzing unit corresponding to the L3 layer.

[0064] Exemplarily, as described above, the first analyzing unit extracts the L2 layer protocol header information from the network message after identifying the L2 layer protocol header, and outputs the L2 layer protocol header information and the software configuration code corresponding to the L2 layer protocol header as the analysis result. Of course, it can be understood that the L2 layer protocol header information extracted from the network message can be part or all of the protocol header information carried by the network message, which is determined according to actual needs, and the present application does not limit this.

[0065] Exemplarily, since the protocol header length corresponding to each identifiable L2 layer protocol header is configured in the first configuration information, based on the protocol header length, the position after the protocol header length is slid from the starting position of the current identified L2 layer protocol header is the offset position of the next protocol header, so that the next header field information can be extracted from the offset position of the next protocol header, and the protocol header identification code of the next protocol header is stored in the next header field information. The first analysis unit matches the next header field information with the first protocol identification code in the first configuration information. If the matching is successful, it indicates that the next protocol header is still an L2 layer protocol header, and the L2 layer protocol header information and the corresponding software configuration code can be parsed from the network message according to the analysis method recorded in the foregoing. If the matching is unsuccessful, it indicates that the next protocol header is not an L2 layer protocol header, and needs to be parsed by the second analysis unit corresponding to the L3 layer level; at this time, the first analysis unit can at least provide the header field information and the offset position of the next protocol header to the second analysis unit corresponding to the L3 layer level, that is, in the case of unsuccessful matching, the first analysis unit provides the related analysis information of the second analysis unit corresponding to the L3 layer level at least including the header field information and the offset position of the next protocol header which are not matched.

[0066] In this way, the first analysis unit can analyze any L2 layer protocol header information in the network message, including self-defined protocol header information, and can also determine the software configuration code corresponding to the analyzed L2 layer protocol header, so that subsequent configurable message processing and forwarding behaviors can be performed on the network message based on the software configuration code.

[0067] In some optional implementation manners, the second configuration information includes at least one second protocol header identification code of an L2 layer above protocol header corresponding to the second analysis unit and protocol header software configuration information corresponding to the second protocol header identification code; the protocol header software configuration information includes a protocol header length corresponding to the second protocol header identification code; the second analysis unit corresponding to the L3 layer level matches the next header field information of the next protocol header provided by the first analysis unit with the second protocol header identification code in the second configuration information, and analyzes the L2 layer above protocol header information corresponding to the second protocol header identification code which is matched based on the protocol header length corresponding to the second protocol header identification code which is matched and the offset position of the next protocol header provided by the first analysis unit; the second analysis unit corresponding to the L3 layer level above matches the next header field information of the next protocol header provided by the second analysis unit corresponding to the previous layer level with the second protocol header identification code in the second configuration information, and analyzes the L2 layer above protocol header information corresponding to the second protocol header identification code which is matched based on the protocol header length corresponding to the second protocol header identification code which is matched and the offset position of the next protocol header provided by the first analysis unit.

[0068] Exemplarily, since the protocol header type corresponding to the L2 layer is fixed, the configuration of the first configuration information can be implemented using the structure as described above, so that the hardware resources can be saved. The type of the protocol header corresponding to the L2 layer above the second parsing unit is not fixed, in order to facilitate expansion, the application adopts the structure as shown in Figures 4A-4C Since the network message adopts a layer-by-layer encapsulation structure, the protocol header can be classified hierarchically first, such as being divided into L2-L5 (numbered 2-5, etc.), and the parsing structure of the second configuration information corresponding to each level can be as shown in Figure 4A The TCAM (Ternary Content Addressable Memory) in the MAU (Match action data unit) is used to store the second protocol header identification code of the protocol header above the L2 layer, and the nextheader field segment of the network message also carries the second protocol identification code of the corresponding protocol header. Therefore, the second parsing unit can extract the nextheader field segment from the network message, and match the second protocol header identification code in the second configuration information, so as to obtain the corresponding protocol header software configuration information, which at least includes PHDS (Protocol header defined by software) data. In order to realize the programmable processing and forwarding behavior of the parsed message, the protocol header software configuration information can also include OTS AD data. The PHDS data at least includes the protocol header length, the offset position of the next L2 layer above the protocol header, and the mask information. When fix is 1, offlen directly indicates the protocol header length, and when fix is 0, offlen indicates the offset position of the protocol header length field in the L2 layer above the protocol header. The second parsing unit can extract the protocol header length from the offset position of the network message. Coff is the unit of the protocol header length field when fix is 0, and the actual protocol header length is equal to the extracted protocol header length field multiplied by coff. If the second parsing unit does not match the second protocol header identification code matching the nextheader field segment from the corresponding second configuration information, it means that the nextheader field segment does not correspond to the protocol header in the level corresponding to the current second parsing unit, so that it can be parsed by the second parsing unit of the next level.

[0069] Exemplarily, Figure 4BThe network message also shows two structures of the L2 layer protocol header, the protocol header length of the protocol header structure 1 is fixed, for this structure, the PHDS can be configured with fix as 1, and the protocol header length is directly configured in offlen; the protocol header length of the protocol header structure 2 is not fixed, for this structure, the PHDS can be configured with fix as 0, and the offset position and length unit of the protocol header length field are configured in offlen, so that the second analysis unit calculates the protocol header length after extracting the protocol header length field from the network message in the analysis process.

[0070] Exemplarily, the OTS The AD is configured with the action priority, the belonging level, whether it is the last layer and the software configuration code of the protocol header corresponding to the second protocol header identification code, wherein the action priority is an optional item, if multiple MAUs are configured for each group of second analysis units, the multiple MAUs can be backup to each other, and in use, the MAU with the highest action priority can be used as the current effective MAU, so that the online dynamic updating of the MAU can be realized, and the modification of the second configuration information is not perceived in the analysis process of the network message. The belonging level can be L3, L4, L5, etc., which is specifically determined according to actual configuration, and is not specifically limited here. Whether it is the last layer is used to indicate whether the current L2 layer protocol header in the current network message is the last layer, if it is the last layer, the analysis can be terminated, and the analysis of the next protocol header is not needed. The software configuration code is a unified code configured for all protocol headers, as described above.

[0071] Exemplarily, after the second analysis unit of the L3 level matches the second protocol header identification code matched with the next header field information of the next protocol header provided by the first analysis unit from the second configuration information, the protocol header length of the next protocol header in the network message can be extracted from the PHDS corresponding to the second protocol header identification code, so that the L2 layer protocol header information of the next protocol header in the network message can be analyzed in combination with the offset position of the next protocol header in the network message provided by the first analysis unit. If the second analysis unit of the L3 level does not match the second protocol header identification code matched with the next header field information of the next protocol header provided by the first analysis unit from the second configuration information, or the second analysis unit corresponding to the L3 level and above does not match the second protocol header identification code matched with the nextheader field segment from the second configuration information, the information of the nextheader field segment is provided to the second analysis unit of the next level, and then the second analysis unit of the next level analyzes the protocol header of the next level based on the second configuration information of the second analysis unit of the next level and the nextheader field segment.

[0072] In this way, when the first analysis unit cannot identify the L2 layer protocol header, the second analysis unit can be used to analyze the L2 layer protocol header, and the L2 layer protocol header analysis and the L2 layer protocol header analysis above are realized by different hardware logics, and by setting multiple first analysis units and second analysis units running in parallel and configuring multiple MAUs, the line speed analysis can be realized.

[0073] In some optional implementations, the protocol header software configuration information further includes offset position and mask information of the next L2 layer protocol header above; the second analysis unit further determines the starting position of the next L2 layer protocol header above in the network message based on the offset position of the next L2 layer protocol header above corresponding to the matched second protocol header identification code, determines the second protocol header identification code of the next L2 layer protocol header above based on the mask information of the next L2 layer protocol header above and the next protocol header field segment in the L2 layer protocol header information corresponding to the matched second protocol header identification code, and analyzes the next L2 layer protocol header information from the network message based on the second protocol header identification code of the next L2 layer protocol header above, the second configuration information, and the starting position of the next L2 layer protocol header above in the network message.

[0074] Exemplarily, the PHDS further configures the related information of the next L2 layer protocol header above of the current L2 layer protocol header above (if the current analysis is the next protocol header not identified by the first analysis unit, the current L2 layer protocol header above is the next protocol header), such as the offset position in the network message and the mask information, based on the offset position, the second analysis unit can extract the next L2 layer protocol header information from the network message, and the mask information is used to obtain the second protocol identification code corresponding to the next L2 layer protocol header after the mask operation with the next protocol header field segment (the field segment is the next header field segment carried in the network message) in the current L2 layer protocol header information. The second analysis unit further matches the second protocol identification code corresponding to the next L2 layer protocol header with the second configuration information, and after the analysis steps as described above, the next L2 layer protocol header information can be analyzed.

[0075] In this way, the second analysis unit can realize the analysis of the indefinite length L2 layer protocol header, has higher flexibility, and can analyze deeper network message levels.

[0076] Exemplarily, taking the Ethernet message as an example, one of the implementable analysis processes of the first analysis unit and the second analysis unit on the multi-layer protocol header is as shown in Figure 5 Figure 5 ​The parsing of the 4-layer protocol header is shown, which is L2, L3, L4, and UDP tunnel protocol header. Among them, the L2 layer protocol header in the network message is parsed by one or more first parsing units, and then the L3 layer protocol header is parsed by one or more second parsing units corresponding to the L3 layer, and then the L4 layer protocol header is parsed by one or more second parsing units corresponding to the L4 layer, and finally the UDP tunnel protocol header is parsed by one or more second parsing units corresponding to the tun layer.

[0077] It should be noted that, due to the existence of a similar UDP tunnel protocol header, after the second parsing unit corresponding to the layer of such a protocol header parses such a protocol header, the network message can be provided to the first parsing unit by the current second parsing unit, and the first parsing unit starts to parse the subsequent L2 layer protocol header.

[0078] Correspondingly, referring to Figure 6 The application exemplarily provides a message parsing method in the second aspect, which comprises:

[0079] Step S601: The first parsing unit parses the L2 layer protocol header information in the network message by using the preconfigured first configuration information.

[0080] Step S602: The second parsing unit parses the L2 layer protocol header information and above in the network message by using the preconfigured second configuration information, and determines the message action data corresponding to the L2 layer protocol header information and above; wherein the number of groups of the second parsing unit corresponds to the number of layers of the protocol header to be parsed, and a group of the second parsing unit is used to parse the L2 layer protocol header information of one layer, and the L2 layer protocol header information and above which is not identified by the second parsing unit of the previous layer is parsed by the second parsing unit of the next layer.

[0081] In some optional implementation manners, the first configuration information comprises a first protocol header identification code of at least one L2 layer protocol header, and a protocol header length and a software configuration code corresponding to the first protocol header identification code; the first parsing unit parses the L2 layer protocol header information in the network message by using the preconfigured first configuration information, which comprises:

[0082] The first parsing unit reads the first header field information from the starting position of the protocol header field segment of the network message.

[0083] The first parsing unit matches the first header field information with the first protocol header identification code.

[0084] If there is a matched first protocol header identification code, the first parsing unit parses the L2 layer protocol header information corresponding to the matched first protocol header identification code based on the matched first protocol header identification code, the corresponding protocol header length and the software configuration code.

[0085] In some optional implementations, the first parsing unit parses the L2 layer protocol header information in the network message by using the preconfigured first configuration information, and further includes:

[0086] The first parsing unit determines the offset position of the next protocol header based on the protocol header length corresponding to the matched first protocol header identification code.

[0087] The first parsing unit extracts the next header field information based on the offset position, and matches the next header field information with the first protocol header identification code.

[0088] If there is no matched first protocol header identification code, the first parsing unit provides the parsed L2 layer protocol header information and the header field information of the next protocol header to the second parsing unit corresponding to the L3 layer.

[0089] In some optional implementations, the second configuration information includes at least one second protocol header identification code of the protocol header of the layer corresponding to the second parsing unit and the corresponding protocol header software configuration information; the protocol header software configuration information includes the protocol header length corresponding to the second protocol header identification code; the second parsing unit parses the protocol header information above the L2 layer in the network message and determines the message action data corresponding to the protocol header information above the L2 layer by using the preconfigured second configuration information and the parsing result provided by the first parsing unit, including:

[0090] The second parsing unit corresponding to the L3 layer matches the next header field information of the next protocol header provided by the first parsing unit with the second protocol header identification code in the second configuration information.

[0091] The second parsing unit corresponding to the L3 layer parses the protocol header information above the L2 layer corresponding to the matched second protocol header identification code from the network message based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit.

[0092] The second parsing unit corresponding to the layer above the L3 layer matches the next header field information of the next protocol header provided by the second parsing unit corresponding to the previous layer with the second protocol header identification code in the second configuration information.

[0093] The second parsing unit corresponding to the layer above the L3 layer parses the protocol header information above the L2 layer corresponding to the matched second protocol header identification code from the network message based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit.

[0094] In some optional implementation, the protocol header software configuration information further comprises offset position and mask information of the next L2 layer above protocol header; the second parsing unit parses the L2 layer above protocol header information in the network packet and determines the packet action data corresponding to the L2 layer above protocol header information by using the second configuration information and the parsing result provided by the first parsing unit, and further comprises:

[0095] The second parsing unit determines the start position of the next L2 layer above protocol header in the network packet based on the offset position of the next L2 layer above protocol header corresponding to the matched second protocol header identification code;

[0096] The second parsing unit determines the second protocol header identification code of the next L2 layer above protocol header based on the mask information of the next L2 layer above protocol header and the next protocol header field segment in the L2 layer above protocol header information corresponding to the matched second protocol header identification code;

[0097] The second parsing unit parses the next L2 layer above protocol header information from the network packet based on the second protocol header identification code of the next L2 layer above protocol header, the second configuration information and the start position of the next L2 layer above protocol header in the network packet.

[0098] The above method can be implemented by the packet parsing device provided in the above embodiments, and the specific implementation can refer to the description of the packet parsing device in the above embodiments, which will not be repeated here.

[0099] It can be understood that the circuit structure, name and parameter described in the above embodiments are only examples. Those skilled in the art can also combine and adjust the structural features of the above multiple embodiments according to the use needs, and the concept of the present application should not be limited to the specific details of the above examples.

[0100] Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A message parsing device, characterized in that, The application relates to a network packet analysis method and device. The application comprises: a first analysis unit and at least one group of second analysis units; wherein, the first analysis unit is used for analyzing L2 layer protocol header information in a network packet by using preconfigured first configuration information; the second analysis unit is used for analyzing L2 layer above protocol header information in the network packet and determining packet action data corresponding to the L2 layer above protocol header information by using preconfigured second configuration information and analysis results provided by the first analysis unit; wherein, the number of groups of the second analysis units corresponds to the number of levels of protocol headers to be analyzed, one group of second analysis units is used for analyzing L2 layer above protocol header information of one level, and L2 layer above protocol header information that is not identified by second analysis units of a previous level is analyzed by second analysis units of a next level; wherein, the second configuration information comprises at least one second protocol header identification code of L2 layer above protocol headers of a corresponding level of the second analysis unit and corresponding protocol header software configuration information; the protocol header software configuration information comprises a protocol header length corresponding to the second protocol header identification code; the second analysis unit analyzes L2 layer above protocol header information in the network packet and determines packet action data corresponding to the L2 layer above protocol header information by using preconfigured second configuration information and analysis results provided by the first analysis unit, which comprises:

2. The packet analysis device of claim 1, wherein the second analysis unit corresponding to the L3 level matches next header domain information of a next protocol header provided by the first analysis unit with second protocol header identification codes in the second configuration information, and analyzes L2 layer above protocol header information corresponding to the matched second protocol header identification codes from the network packet based on a protocol header length corresponding to the matched second protocol header identification code and an offset position of the next protocol header provided by the first analysis unit; the second analysis unit corresponding to levels above the L3 level matches next header domain information of a next protocol header provided by second analysis units corresponding to a previous level with second protocol header identification codes in the second configuration information, and analyzes L2 layer above protocol header information corresponding to the matched second protocol header identification codes from the network packet based on a protocol header length corresponding to the matched second protocol header identification code and an offset position of the next protocol header provided by the first analysis unit. The first configuration information comprises at least one first protocol header identification code of L2 layer protocol headers and corresponding protocol header lengths and software configuration codes; the first analysis unit reads first header domain information from a starting position of a protocol header domain segment of the network packet, matches the first header domain information with the first protocol header identification code, and if there is a matched first protocol header identification code, analyzes L2 layer protocol header information corresponding to the matched first protocol header identification code based on the matched first protocol header identification code, the corresponding protocol header length and the software configuration code.

3. The packet analysis device of claim 2, wherein, The first analysis unit also determines the offset position of the next protocol header based on the protocol header length corresponding to the matched first protocol header identification code, extracts the next header field information based on the offset position, and matches the next header field information with the first protocol header identification code. If there is no matched first protocol header identification code, the next header field information and the offset position of the next protocol header are provided to the second analysis unit corresponding to the L3 level.

4. The packet analysis device of claim 1, wherein The protocol header software configuration information further includes the offset position and mask information of the next L2 layer or above protocol header; the second analysis unit further determines the starting position of the next L2 layer or above protocol header in the network message based on the offset position of the next L2 layer or above protocol header corresponding to the matched second protocol header identification code, determines the second protocol header identification code of the next L2 layer or above protocol header based on the mask information of the next L2 layer or above protocol header and the next protocol header field segment in the L2 layer or above protocol header information corresponding to the matched second protocol header identification code, and analyzes the next L2 layer or above protocol header information from the network message based on the second protocol header identification code of the next L2 layer or above protocol header, the second configuration information, and the starting position of the next L2 layer or above protocol header in the network message.

5. A method of parsing a message, the method comprising: Comprise: The first analysis unit analyzes the L2 layer protocol header information in the network message by using the pre-configured first configuration information; The second analysis unit analyzes the L2 layer or above protocol header information in the network message and determines the message action data corresponding to the L2 layer or above protocol header information by using the pre-configured second configuration information and the analysis result provided by the first analysis unit; wherein the number of groups of the second analysis unit corresponds to the number of levels of the protocol header to be analyzed, and one group of the second analysis unit is used to analyze the L2 layer or above protocol header information of one level, and the L2 layer or above protocol header information that is not identified by the second analysis unit of the previous level is analyzed by the second analysis unit of the next level; The second configuration information includes the second protocol header identification code of at least one L2 layer or above protocol header of the corresponding level of the second analysis unit and the corresponding protocol header software configuration information; the protocol header software configuration information includes the protocol header length corresponding to the second protocol header identification code; the second analysis unit analyzes the L2 layer or above protocol header information in the network message and determines the message action data corresponding to the L2 layer or above protocol header information by using the pre-configured second configuration information and the analysis result provided by the first analysis unit, which comprises: The second analysis unit corresponding to the L3 level matches the next header field information of the next protocol header provided by the first analysis unit with the second protocol header identification code in the second configuration information; The second analysis unit corresponding to the L3 level analyzes the L2 layer or above protocol header information corresponding to the matched second protocol header identification code from the network message based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first analysis unit. The second parsing unit corresponding to the L3 level above matches the next head domain information of the next protocol header provided by the second parsing unit corresponding to the previous level with the second protocol header identification code in the second configuration information; The second parsing unit corresponding to the L3 level above parses the L2 layer above protocol header information corresponding to the matched second protocol header identification code from the network message based on the protocol header length corresponding to the matched second protocol header identification code and the offset position of the next protocol header provided by the first parsing unit.

6. The packet parsing method of claim 5, wherein, The first configuration information includes at least one first protocol header identification code of the L2 layer protocol header, the corresponding protocol header length and the software configuration code; The first parsing unit parses the L2 layer protocol header information in the network message by using the pre-configured first configuration information, including: The first parsing unit reads the first head domain information from the starting position of the protocol header domain segment of the network message; The first parsing unit matches the first head domain information with the first protocol header identification code; If there is a matched first protocol header identification code, the first parsing unit parses the L2 layer protocol header information corresponding to the matched first protocol header identification code based on the matched first protocol header identification code, the corresponding protocol header length and the software configuration code.

7. The packet parsing method of claim 6, wherein, The first parsing unit parses the L2 layer protocol header information in the network message by using the pre-configured first configuration information, including: The first parsing unit determines the offset position of the next protocol header based on the protocol header length corresponding to the matched first protocol header identification code; The first parsing unit extracts the next head domain information based on the offset position and matches the next head domain information with the first protocol header identification code; If there is no matched first protocol header identification code, the first parsing unit provides the parsed L2 layer protocol header information and the head domain information of the next protocol header to the second parsing unit corresponding to the L3 level.

8. The packet parsing method of claim 5, wherein, The protocol header software configuration information further includes the offset position and the mask information of the next L2 layer above protocol header; the second parsing unit parses the L2 layer above protocol header information in the network message and determines the message action data corresponding to the L2 layer above protocol header information by using the pre-configured second configuration information and the parsing result provided by the first parsing unit, further including: The second parsing unit determines the starting position of the next L2 layer above protocol header in the network message based on the offset position of the next L2 layer above protocol header corresponding to the matched second protocol header identification code; The second parsing unit determines the second protocol header identification code of the next L2 layer above protocol header based on the mask information of the next L2 layer above protocol header and the next protocol header domain segment in the L2 layer above protocol header information corresponding to the matched second protocol header identification code; The second parsing unit parses the next L2 layer above protocol header information from the network message based on the second protocol header identification code of the next L2 layer above protocol header, the second configuration information and the starting position of the next L2 layer above protocol header in the network message.

Images