Fragmented packet processing method, processing device and storage medium

Abstract

This application provides a method, apparatus, and storage medium for processing fragmented packets, relating to the field of packet communication technology. The method includes: receiving fragmented packets and determining a target fragmentation node corresponding to the fragmented packets; storing the fragmented packets in a buffer within the target fragmentation node; triggering a fragmented packet processing event or an exception event in a set event based on the fragmented packet's tag type and the fragmented packets already stored in the buffer; and confirming that the fragmented packets have been reassembled in response to a reassembly completion notification event in the set event. This invention decouples fragmented packet processing logic from specific business requirements, specifically decoupling fragmentation processing from buffer processing, making it applicable to various scenarios. By designing an event-driven mechanism, this invention efficiently reassembles received out-of-order fragmented packets, improving the efficiency of fragmentation processing and system maintainability, while also effectively enhancing testing performance.

Description

Technical Field

[0001] This application relates to the field of message communication technology, specifically to a method, processing device, and storage medium for processing fragmented messages. Background Technology

[0002] Network traffic analysis, as a key network security and management technology, focuses on the monitoring, recording, and in-depth analysis of network data packets. This process is essentially a systematic processing of IP packets themselves. Inevitably, the system needs to handle IP fragmentation packets, which directly relates to effectively addressing complex scenarios such as out-of-order fragmentation handling, reassembly mechanisms, and non-standard retransmissions. Therefore, fragmentation processing, as a fundamental component of traffic analysis systems, directly impacts the overall system's performance and scalability.

[0003] Currently, mainstream network packet processing systems typically employ methods such as... Figure 1 The processing logic shown essentially integrates packet fragmentation with subsequent business functions (such as data flow establishment) into a continuous processing chain. Within this framework, fragmented packets are first sent to the reassembly module, where they are sorted and assembled according to their offsets and identifiers to reconstruct the original complete message. Subsequently, the system's flow establishment module can extract and analyze flow features from the reassembled message, thereby completing the creation of the data flow. While this processing model intuitively depicts the data processing lifecycle, its structural bottlenecks gradually become apparent when dealing with diverse business needs and complex network scenarios.

[0004] Specifically, the limitations of existing solutions are mainly reflected in the following aspects: First, the tight coupling between the fragmentation processing logic and other business functions such as flow establishment results in a high degree of rigidity in the overall system architecture. This design makes it difficult for the core fragmentation processing flow to evolve independently and also poses challenges to its clear interaction with other functional modules. For example, for business scenarios such as mirroring that require simultaneous access to both the original fragmented data and the reassembled complete message, the existing architecture struggles to provide a unified and flexible interface to meet such complex data requirements. Fragmentation processing not only needs to solve the caching problem when fragments arrive out of order but also needs to ensure the accuracy and integrity of the reassembly process. In this context, how to design a fragmentation processing mechanism that is both efficient and highly scalable, enabling seamless integration with different business modules, constitutes a pressing technical problem that needs to be solved. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, and storage medium for processing fragmented packets, aiming to address the difficulties and shortcomings of the prior art. This invention simplifies the main process of fragmentation processing, decouples the fragmentation packet processing logic from specific business processing requirements, thereby improving testing performance and making it applicable to more scenarios.

[0006] To achieve the above objectives, a first aspect of this application provides a method for processing fragmented packets. The method includes: receiving fragmented packets and determining a target fragmentation node corresponding to the fragmented packets; storing the fragmented packets in a buffer in the target fragmentation node; triggering a fragmented packet processing event or an exception event in a set event according to the tag type of the fragmented packets and the fragmented packets already stored in the buffer, wherein the fragmented packet processing event includes reassembling the fragmented packets, and triggering a reassembly completion notification event in the set event after the reassembly of the fragmented packets is completed; and confirming that the fragmented packets have been reassembled in response to the reassembly completion notification event.

[0007] In one embodiment, the processing method is implemented based on a fragmentation caching module and a fragmentation processing module, wherein the fragmentation processing module is used to identify the tag type of the fragmented packet, trigger the fragmentation packet processing event, and reassemble the fragmented packet; the fragmentation caching module is used to store the fragmented packet in the cache area, and execute the fragmentation packet processing event and the fragmentation cache packet processing event in the cache area.

[0008] In one embodiment, the fragmentation packet processing event further includes a fragmentation node lookup notification event and a fragmentation node creation event. Determining the target fragmentation node corresponding to the fragmented packet includes: triggering the fragmentation node lookup notification event when the fragmented packet is received, based on the fragmentation processing module; in response to the fragmentation node lookup notification event, searching for the target fragmentation node corresponding to the fragmented packet in the fragmentation node management structure; if the target fragmentation node is not found, triggering the fragmentation node creation event; and in response to the fragmentation node creation event, creating a new fragmentation node in the fragmentation node management structure as the target fragmentation node.

[0009] In one embodiment, the fragment node management structure includes a hash table and a management linked list, wherein the structure of the hash table includes: the source network address, destination network address, and network identifier of the fragmented packet.

[0010] In one embodiment, the fragmentation packet processing event further includes a fragmentation out-of-order event. Triggering the fragmentation packet processing event in the set event based on the tag type of the fragmented packet and the fragmented packets in the buffer includes: determining, based on the fragmentation processing module, whether the fragmented packet is the fragmentation out-of-order packet according to the tag type of the fragmented packet and the tag type of the fragmented packets already stored in the buffer; after determining that the fragmented packet is the fragmentation out-of-order packet, triggering the fragmentation out-of-order event to tag the fragmented packet; and after determining that the fragmented packet is not the fragmentation out-of-order packet, reassembling the fragmented packet.

[0011] In one embodiment, the labeling type of the fragmented packet includes: fragment first packet, fragment middle packet, and fragment last packet, and the fragmented packet processing event further includes: fragment first packet event, fragment middle packet event, and fragment last packet event.

[0012] In one embodiment, reassembling the fragmented packets in the buffer in response to the reassembly event in the set event includes: detecting the type of the fragmented packets; if the fragmented packet is the first packet of the fragment and it is confirmed that the first packet flag on the fragment node management structure is not set, triggering the first packet event to establish a flow for the first packet of the fragment; if the fragmented packet is not the first packet of the fragment and it is confirmed that the first packet flag on the fragment node management structure is not set, triggering the out-of-order fragmentation event to buffer the fragmented packets; if the fragmented packet is not the first packet of the fragment and it is confirmed that the first packet flag on the fragment node management structure is set, triggering the middle packet fragmentation event or the end packet fragmentation event to reassemble the fragmented packets; and after the end packet fragmentation is reassembled, triggering the reassembly completion notification event.

[0013] In one embodiment, the set event further includes abnormal events, including: fragment timeout event, fragment overflow event, fragment retransmission event, and fragment error event. The processing method further includes: after triggering the abnormal event, releasing all stored fragmented packets in the cache based on the fragment caching module.

[0014] A second aspect of this application provides a fragmented packet processing system, the system comprising: a fragmentation processing module for receiving fragmented packets and determining a target fragmentation node corresponding to the fragmented packets; and a fragmentation caching module for storing the fragmented packets in a cache area of ​​the target fragmentation node, wherein the fragmentation processing module is further configured to trigger a set event based on the tag type of the fragmented packets and the fragmented packets already stored in the cache area, wherein the fragmentation packet processing event includes reassembling the fragmented packets, and triggering a reassembly completion notification event in the set event after the reassembly of the fragmented packets is completed, and the fragmentation caching module is further configured to confirm that the fragmented packets have been reassembled in response to the reassembly completion notification event.

[0015] A third aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned method for processing fragmented messages.

[0016] Through the above technical solution, this invention decouples the packet fragmentation processing logic from specific business requirements, specifically decoupling fragmentation processing from caching processing, making it applicable to various scenarios. This invention, by designing an event-driven mechanism, efficiently reassembles received out-of-order fragmented packets, improving the efficiency of fragmentation processing and the maintainability of the system, while also effectively enhancing testing performance.

[0017] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 This diagram illustrates the processing logic flow of the prior art. Figure 2 The schematic diagram illustrates a flowchart of a method for processing fragmented packets according to an embodiment of this application; Figure 3 This illustration shows a schematic diagram of the process for adding and searching shard nodes according to an embodiment of this application; Figure 4 The illustration shows a schematic diagram of the event processing flow of the first packet, last packet, and middle packet of a fragment node according to an embodiment of this application; Figure 5 This illustration schematically shows a fragmentation and reassembly process according to an embodiment of the present application; Figure 6The schematic diagram illustrates the processing flow of the sharded caching module according to an embodiment of this application; Figure 7 This schematically illustrates a structural block diagram of a fragmented message processing system according to an embodiment of this application; Figure 8 The diagram illustrates the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0020] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0021] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0022] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant laws and regulations. Furthermore, it should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0023] First, a brief introduction to existing technologies: Typical network packet processing systems include two modules: packet fragmentation processing and flow establishment. The processing logic flow is as follows: Figure 1As shown, packet fragmentation processing and flow establishment processing are typically presented as two fundamental and tightly coupled modules. However, the applicant has discovered the following problems with this approach: 1. Rigid architecture and lack of scenario adaptability. Existing technologies generally focus on the reassembly algorithm and cache management of IP fragmentation itself, but neglect a key mixed scenario: for example, IP fragmented packets with tunnel encapsulation. The flow establishment logic requires parsing the inner IP port from the reassembled packet after fragmentation and establishing the flow based on the inner IP port. Therefore, this scenario will have conflicting processing logic.

[0024] 2. Lack of interactive mechanisms and insufficient scalability. Existing solutions typically provide a single reassembled data packet to subsequent modules after fragmentation and reassembly. This unidirectional and fixed data transmission method cannot meet the mixed needs of diverse business operations. For example, the mirroring function not only requires the complete reassembled packet for content analysis, but also the original, unprocessed fragmented packets for accurate network behavior auditing. Traditional architectures struggle to simultaneously meet these two distinct data requirements within the same process.

[0025] 3. The implementation is overly complex and contains design redundancy. Current fragmentation and reassembly implementations commonly use complex data structures such as pointer arrays and bitmaps. However, considering that IP fragmentation itself does not trigger a retransmission mechanism at the network layer (retransmission is determined by the upper-layer protocol based on feedback from the receiving end, and all fragments will use a completely new IPID during retransmission), this is fundamentally different from the retransmission concept at the transport layer, leading to unnecessary complexity in its design.

[0026] This invention aims to address the aforementioned shortcomings by proposing a superior solution. Through a dual-modular design and an event-driven mechanism, it effectively improves the efficiency of fragmented processing and the maintainability of the system. Figure 2 The schematic diagram illustrates a process flow diagram of a fragmented message processing method 100 according to an embodiment of this application, which may include the following steps S110-S140.

[0027] Step S110: Receive the fragmented message and determine the target fragment node corresponding to the fragmented message; Step S120: Store the fragmented packet in the buffer of the target fragment node; Step S130: Based on the tag type of the fragmented packet and the fragmented packets already stored in the buffer, trigger the fragmented packet processing event or exception event in the set event; and Step S140: In response to the reassembly completion notification event in the set event, confirm that the fragmented packets have been reassembled.

[0028] Among them, such as Figure 7As shown, processing method 100 can be implemented based on fragmentation processing module 210 and fragmentation caching module 220. That is, the technical solution of this invention divides the entire fragmented packet processing scenario into two sub-modules: one is fragmentation processing module 210, which is used to identify the tag type of fragmented packets and trigger fragmentation packet processing events to reassemble the fragmented packets; the other is fragmentation caching module 220, which is used to store fragmented packets in a cache area and execute fragmentation packet processing events and fragmentation cache packet processing events in the cache area. The interaction between the two modules can be achieved through registration notifications. It should be noted that fragmentation processing module 210 can provide both event interfaces and data interfaces, allowing other modules to store private data they need on the fragmentation nodes. The private data memory is allocated along with the memory when the fragmentation node is requested. For example, fragmentation caching module 220 registers a block of private data on the fragmentation node to store cached packet pointer data. In addition, this solution defines 11 types of configuration events for the fragmentation processing module 210, which can be divided into two main categories: "fragmentation packet processing events" and "abnormal events." The fragmentation packet processing events include seven types: fragmentation node lookup notification event, fragmentation node creation event, fragmentation out-of-order event, fragmentation first packet event, fragmentation middle packet event, fragmentation last packet event, and reassembly completion notification event (also known as fragmentation reassembly end event). Abnormal events include four types: fragmentation timeout event, fragmentation overflow event, fragmentation retransmission event, and fragmentation error event. Specific event types are detailed later. Furthermore, other modules can also register different configuration events and their interfaces according to business needs; this application does not restrict this.

[0029] Step S110 constitutes the entry point for fragmented packet processing, and its core lies in completing the lookup or creation of fragment nodes through an event-driven mechanism. In a specific embodiment, the fragment processing module 210 triggers a preset specific event when receiving a fragmented packet. The fragment packet processing event defined in this invention may further include a fragment node lookup notification event (IPFRAG_EVT_NOTTIFY) and a fragment node creation event (IPFRAG_EVT_NEW). Specifically, the fragment node lookup notification event calls the function interface registered by other modules after the fragment node lookup is completed. The fragment node creation event calls the function interface registered by other modules after the new fragment node is created.

[0030] The detailed processing flow for adding and searching shard nodes can be found as follows: Figure 3As shown in the diagram, this technical solution uses two data structures for sharding processing: a sharding node management structure including a hash table and a management linked list, both of which are thread-level. The hash table structure includes the source network address, destination network address, and network identifier of the sharded packet. That is, the hash table of the sharding node can be constructed in the order of source IP, destination IP, and IPID. Furthermore, this invention does not limit the specific implementation of the hash table to different hash algorithms or random numbers. The management linked list is a list for managing sharding nodes. After a sharding node is created in the hash table, it is simultaneously added to the management linked list, for example, using tail insertion to place the newest node at the tail of the list. In case of a timeout, the linked list can be traversed starting from the head.

[0031] Specifically, step S110 may include the following steps S111-S114: Step S111: Based on the fragmentation processing module 210, a fragmentation node lookup notification event is triggered when a fragmented message is received; Step S112: In response to the fragment node lookup notification event, search for the target fragment node corresponding to the fragment packet in the fragment node management structure; Step S113: If the target shard node is not found, trigger the shard node creation event; and Step S114: In response to the shard node creation event, a new shard node is created on the shard node management structure to serve as the target shard node.

[0032] Combination Figure 3 As shown, the process first receives fragmented packets, such as IP fragments. Then, based on the source IP address of the fragment, a consistent hashing algorithm (such as CRC32) maps the data packets to different processing threads. For example, a fragment of IP address 192.168.1.1 might be hashed to thread 1, while a fragment of 10.0.0.2 might be hashed to thread 2. Next, packet preprocessing can be performed. After the fragments are distributed to the target threads, they can enter the IP fragmentation processing module for preprocessing. Then, the IP fragments can be processed. By parsing the fragment offset (such as the offset field), the position of the fragment within the original data packet is determined. For example, in IPv6 scenarios, if the fragment is in IPv6 format, the module will additionally process IPv6-specific fields (such as flow label) to ensure compatibility. The fragment node can be found from the fragment hash table based on the source IP, destination IP, and IPID (unique identifier) ​​of the fragment. The sharded hash table is constructed according to the source IP, destination IP, and IPID, supporting both IPv4 and IPv6 scenarios with consistent logic.

[0033] If the node does not exist, a new shard node needs to be requested and added to the hash table. Simultaneously, the shard node addition event (IPFRAG_EVT_NEW) is executed, calling all registered notification interfaces. The node's timestamp is updated and added to the tail of the thread's shard node management linked list. If the node exists, the shard node lookup notification event (IPFRAG_EVT_NOTIFY) is executed, returning the existing shard node. The node's timestamp is updated, the current node is removed from the linked list, and then added to the tail (preserving chronological order).

[0034] Additionally, in step S120, this technical solution directly requests a buffer when applying for a fragmentation node. For example, for a single TCP segment (i.e., the size of the packet transmitted each time by the transport layer, negotiated by the client and server during the three-way handshake), a configuration of 4096 is generally sufficient. Then, the fragmented packet is directly copied into the buffer based on its offset and length, without additional judgment.

[0035] In one embodiment, the fragmentation packet processing event in step S130 may further include a fragmentation out-of-order event (IPFRAG_EVT_DISORDER), that is, when a fragmentation out-of-order packet is received, the registered function interface of other modules is called. The fragmentation packet marking types include: fragment head packet, fragment middle packet, and fragment tail packet. The fragmentation packet processing events also include: fragment head packet event (IPFRAG_EVT_FIRST): when a fragment head packet is received, the registered function interface of other modules is called; fragment middle packet event (IPFRAG_EVT_MID): when a fragment middle packet is received, the registered function interface of other modules is called; fragment tail packet event (IPFRAG_EVT_LAST): when a fragment tail packet is received, the registered function interface of other modules is called; fragment reassembly completion event (IPFRAG_EVT_FIN): also known as the reassembly completion notification event, when fragment reassembly is complete, the registered function interface of other modules is called. The event processing for the fragment node head packet, tail packet, and middle packet is as follows: Figure 4 As shown, specifically, step S130 may include: Step S131: Based on the fragmentation processing module 210, determine whether the fragmented message is a fragmented out-of-order message according to the tag type of the fragmented message and the tag type of the fragmented messages already stored in the buffer. Step S132: After determining that the fragmented packet is a fragmented out-of-order packet, a fragmentation out-of-order event is triggered, and the fragmented packet is marked; and Step S133: After determining that the fragmented packet is not a fragmented out-of-order packet, the fragmented packet is reassembled.

[0036] In addition, the above-mentioned setting events may also include abnormal events, so the processing method 100 of the present invention may further include: step S150, after an abnormal event is triggered, releasing all stored fragmented packets in the cache based on the fragmented cache module 220.

[0037] The abnormal events can include: Fragmentation timeout event (IPFRAG_EVT_TIMEOUT): When a fragment node times out, the function interface registered by other modules is called. Fragmentation overflow event (IPFRAG_EVT_OVERFLOW): When the fragment node's length or packet count exceeds the expected value, the function interface registered by other modules is called. Fragmentation retransmission event (IPFRAG_EVT_PANIC): For example, retransmission of the first or last fragment packet is considered abnormal. As mentioned above, retransmission will not occur if the previous segment is complete; all fragments corresponding to this segment will be retransmitted, and their IPIDs will be different. Therefore, if a first or last packet with the same IPID appears, it can be considered abnormal. The function interface registered by other modules is executed. Fragmentation error event (IPFRAG_EVT_ERR): The IPfrag flag on the received PKT is incorrect; it is neither first, nor last, nor mid. Therefore, it is considered an erroneous packet. It should be explained that the deletion operation for a shard node includes deleting the shard node from the hash table and deleting the shard node from the management list, thereby freeing up the shard node's memory.

[0038] Combination Figure 4 As shown, the fragmentation process needs to be determined step by step in the following steps: 1. Shard node overflow detection: Determine if the number of packets received by the current shard node exceeds the configured maximum number of packets. If yes, trigger a shard node overflow event, perform a deletion operation, and return; otherwise, proceed to the next step.

[0039] 2. Perform shard node statistics, accumulate the number of packets and bytes of shard nodes, complete the statistics, and proceed to the next step.

[0040] 3. First packet processing for each fragment: determine if the current fragment is the first packet. If so, check if the first packet flag on the fragment node is set. If it is set, trigger the fragment node exception event (IPFRAG_EVT_PANIC), perform the deletion operation, and return. If not set, set the first packet flag bit to trigger the fragment first packet event (IPFRAG_EVT_FIRST) and proceed to the next step.

[0041] 4. If the current fragment is not the first packet, it is necessary to check whether the first packet flag on the fragment node has been set; If not, it is an out-of-order packet, and fragmentation and out-of-order processing is performed. If it is an out-of-order packet, the number of bytes in the out-of-order packet is counted, and a fragmentation and out-of-order event (IPFRAG_EVT_DISORDER) is triggered to proceed to the next step.

[0042] 5. If the first packet flag is already set on the fragment node, proceed to the fragment tail packet processing and determine if the current fragment is the tail packet. If so, check if the tail packet flag is already set on the fragment node. If it is set, trigger the fragment node exception event (IPFRAG_EVT_PANIC), perform the deletion operation, and return. Otherwise, if not set, calculate the payload length of the IP fragment node (tail offset + payload length), set the tail packet flag, trigger the fragment tail packet event (IPFRAG_EVT_LAST), and proceed to the next step.

[0043] 6. If the current fragment is not the tail packet, proceed to the fragmentation intermediate packet processing to determine if it is an intermediate packet; if it is an intermediate packet, trigger the fragmentation intermediate event (IPFRAG_EVT_MID) and proceed to the next step.

[0044] 7. If it is not an intermediate packet, proceed with exception handling. That is, if the fragment is neither the first packet, the last packet, nor an intermediate packet, trigger the fragmentation error event (IPFRAG_EVT_ERROR), perform the deletion operation, and return.

[0045] In addition, after the reassembly event is triggered in step S133, the specific reassembly process of the fragmented packets is as follows: Figure 5 As shown, this describes the specific implementation of step S140 from step S130. Specifically, the reassembly of fragmented packets in step S140 may include: Step S141: If the fragmented packet is the first fragmented packet and it is confirmed that the first packet flag on the fragmented node management structure is not set, trigger the first fragmented packet event and establish a flow for the first fragmented packet. Step S142: If the fragmented packet is not the first packet of the fragment and the first packet flag on the fragment node management structure is not set, trigger the fragmented out-of-order event and cache the fragmented packet. Step S143: If the fragmented packet is not the first fragment packet and the first packet flag on the fragmentation node management structure is confirmed to be set, trigger the fragmentation intermediate packet event or the fragmentation tail packet event to reassemble the fragmented packet; and Step S144: After the fragment tail packet is reassembled, trigger the reassembly completion notification event (fragment reassembly end event).

[0046] Combination Figure 5 As shown, fragment reassembly needs to be determined step by step according to the following steps: 1. First, the Layer 3 load received by the IP shard nodes in the shard node management structure is accumulated. If the accumulated result exceeds the configured maximum load value, a shard node overflow event (IPFRAG_EVT_OVERFLOW) is triggered, a deletion operation is performed, and the process returns.

[0047] 2. If reassembly is supported, check if the current packet's offset plus payload length is greater than the reassembly buffer size. If so, trigger an overflow event and delete the node. Otherwise, continue processing. Copy the current packet's IP header and payload to the buffer according to the offset plus length.

[0048] 3. Next, perform flag check to examine the flags on the fragmentation nodes: determine if the `flag` flag on the IP fragmentation node is set, if the `first` flag is set, if the `last` flag is set, and if the required length of the record on the IP fragmentation node matches the received length. For example, the `first_flag` flag indicates whether it is the first fragmentation packet. The `last_flag` flag indicates whether it is the last fragmentation packet. Length verification: compare the record length (`recorded_len`) with the actual length (`received_len`). If they do not match, return directly.

[0049] 4. If yes, it means that the first and last packet flags are both set and have the same length, indicating that reassembly is complete. Save the header, the start position of the packet payload, and the packet length of the reassembled content to a thread variable for subsequent business use; set the reassembly end flag and execute the registered reassembly end event. Perform the fragment node deletion operation (delete the IP fragment node from the linked list, delete the IP fragment node from the hash table, remove the node from both the linked list and the hash table, release memory, and return).

[0050] Accordingly, the sharded caching module 220 provided by this invention also supports multiple types of events, and the specific processing flow is as follows: Figure 6 As shown. The first type is fragmentation packet processing events, which are the same as those supported by fragmentation processing module 210. The fragmentation caching module 220 supports the following fragmentation processing event types: First Fragment Packet Event (IPFRAG_EVT_FIRST): When the first fragment packet is received, the registered function interface of other modules is called; Middle Fragment Packet Event (IPFRAG_EVT_MID): When the middle fragment packet is received, the registered function interface of other modules is called; Last Fragment Packet Event (IPFRAG_EVT_LAST): When the last fragment packet is received, the registered function interface of other modules is called. The second type is cache packet processing events, which may include: Fragment Cache Packet Processing Event (IPFRAGCACHE_EVT_PKT): When the first fragment packet is received, it is determined whether there is a cache packet on the fragment node. If there is a cache packet, the cache packet processing event registered by other modules is executed.

[0051] Continue as Figure 6 As shown, the processing of fragmented cache packets includes: registering private data in the fragment processing module 210 through the fragmented cache module 220; and saving cached packet node information (including quantity, pkt pointer, length, and offset) on the fragment nodes. The fragmented cache module 220 registers the following fragmented event types: registering notification events, saving fragment nodes and obtaining cached data pointers in the registered function implementation; registering fragmented out-of-order events, calculating offsets and lengths in the registered function implementation; saving out-of-order packets to the fragmented cache array; updating packet reference counts and updating cached packet statistics counts; registering timeout events, exception events, overflow events, and error events; and releasing cached packet-related data when an exception is returned.

[0052] In summary, this invention essentially divides the entire sharding function into two sub-modules: a sharding processing module and a sharding caching module, which can interact through interface registration. The beneficial technical effects of this invention include: 1. Simplified Main Process and Decoupling of Business Functions. By decoupling the fragmentation packet processing logic from specific business requirements, the system only needs to execute the corresponding event interface based on the fragmentation tag after receiving a fragmented packet. For example, the requirement to parse the inner IP port after tunnel packet reassembly can be achieved by registering the IPFRAG_EVT_FIN event. This processing logic is completely isolated from the main process. This design significantly improves code maintainability, allowing changes to business logic without modifying the core processing flow.

[0053] 2. Decoupling of Sharding and Caching: Sharding cache packet processing is implemented through the registration of sharding processing events, which are specifically responsible for the caching management of out-of-order packets. The caching module independently maintains the shard storage state (such as a hash table + linked list structure), and the processing module only notifies the caching module to perform specific operations through event interfaces (such as IPFRAG_EVT_DISORDER). The responsibilities of the two are clearly separated, avoiding the logical coupling problems in traditional solutions.

[0054] 3. Optimization of Fragmentation and Flow Establishment Timing. A phased processing architecture is adopted, with the fragmentation processing module (module 210) prioritizing fragment reassembly, followed by analysis of the reassembled data by the flow establishment module. This timing design ensures data integrity before executing business logic (such as traffic analysis), making it particularly suitable for scenarios such as tunnel packets that require reassembly before parsing.

[0055] 4. Performance Improvement Verification. Actual testing shows that this solution has a significant performance advantage over traditional implementations that combine fragmentation and flow establishment logic. By reducing redundant judgments and optimizing memory management (such as pre-allocating buffers), the context switching overhead is reduced based on an event-driven mechanism. Compared to logic that typically processes fragmentation and flow establishment together, actual test performance is higher, and this performance improvement is particularly noticeable in high-speed network environments.

[0056] Additionally, in one embodiment, such as Figure 7 As shown, a fragmented packet processing system 200 is provided, which may include a fragmentation processing module 210 for receiving fragmented packets and determining the target fragmentation node corresponding to the fragmented packets; and a fragmentation caching module 220 for storing the fragmented packets in the cache of the target fragmentation node. The fragmentation processing module 210 is further configured to trigger a fragmentation packet processing event or an exception event in a set event according to the tag type of the fragmented packets and the fragmented packets already stored in the cache. The fragmentation packet processing event includes reassembling the fragmented packets, and after the reassembly of the fragmented packets is completed, triggering a reassembly completion notification event in the set event. The fragmentation caching module 220 is further configured to confirm that the fragmented packets have been reassembled in response to the reassembly completion notification event in the set event.

[0057] In one embodiment, the fragmentation processing module is used to identify the tag type of the fragmented packet, trigger the fragmentation packet processing event, and reassemble the fragmented packet. The fragmentation caching module is used to store the fragmented packet in the cache area and execute the fragmentation packet processing event and the fragmentation cache packet processing event in the cache area.

[0058] In one embodiment, the fragmentation packet processing event further includes a fragmentation node lookup notification event and a fragmentation node creation event. The fragmentation processing module 210 is further configured to perform the following: triggering the fragmentation node lookup notification event when the fragmented packet is received; in response to the fragmentation node lookup notification event, searching for a target fragmentation node corresponding to the fragmented packet on the fragmentation node management structure; if the target fragmentation node is not found, triggering the fragmentation node creation event; and in response to the fragmentation node creation event, creating a new fragmentation node on the fragmentation node management structure as the target fragmentation node.

[0059] In one embodiment, the fragment node management structure includes a hash table and a management linked list, wherein the structure of the hash table includes: the source network address, destination network address, and network identifier of the fragmented packet.

[0060] In one embodiment, the fragmentation packet processing event further includes a fragmentation out-of-order event, and the fragmentation processing module 210 is further configured to: determine whether the fragmented packet is the fragmentation out-of-order packet based on the tag type of the fragmented packet and the tag type of the fragmented packets already stored in the buffer; after determining that the fragmented packet is the fragmentation out-of-order packet, trigger the fragmentation out-of-order event to tag the fragmented packet; and after determining that the fragmented packet is not the fragmentation out-of-order packet, reassemble the fragmented packet.

[0061] In one embodiment, the labeling type of the fragmented packet includes: fragment first packet, fragment middle packet, and fragment last packet, and the fragmented packet processing event further includes: fragment first packet event, fragment middle packet event, and fragment last packet event.

[0062] In one embodiment, the fragment caching module 220 is further configured to: detect the type of the fragmented packet; if the fragmented packet is the first fragment packet and it is confirmed that the first packet flag on the fragment node management structure is not set, trigger the first fragment packet event to establish a flow for the first fragment packet; if the fragmented packet is not the first fragment packet and it is confirmed that the first packet flag on the fragment node management structure is not set, trigger the fragmented out-of-order event to cache the fragmented packet; if the fragmented packet is not the first fragment packet and it is confirmed that the first packet flag on the fragment node management structure is set, trigger the fragmented intermediate packet event or the fragmented tail packet event to reassemble the fragmented packet; and after the fragmented tail packet is reassembled, trigger the reassembly completion notification event.

[0063] In one embodiment, the set event further includes abnormal events, including: fragment timeout event, fragment overflow event, fragment retransmission event, and fragment error event. The fragment cache module 220 is also used to: after triggering the abnormal event, release all stored fragment packets in the cache area.

[0064] Other beneficial effects of the fragmented message processing system 200 of the present invention can be found in the above description of the fragmented message processing method 100, and will not be repeated here.

[0065] This invention also provides a machine-readable storage medium storing instructions that cause a machine to execute the fragmented message processing method described above.

[0066] This invention provides a processor for running a program, wherein the program is executed to perform: the fragmented packet processing method as described above.

[0067] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown in the figure, the computer device may include a processor A01, a network interface A02, a display screen A04, an input device A05, and a memory (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory may include internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A06. The network interface A02 is used for communication with external terminals via a network connection. When the computer program is executed by the processor A01, it implements the fragmented message processing method described above. The display screen A04 may be a liquid crystal display (LCD) or an e-ink display. The input device A05 may be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0068] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0069] In one embodiment, the fragmented packet processing method provided in this application can be implemented as a computer program, which can be implemented in the form of, for example... Figure 8 The method runs on the computer device shown. The computer device's memory can store various program modules that constitute the fragmented packet processing method. The computer program, composed of the various program modules, causes the processor to execute the various steps of the fragmented packet processing method of the various embodiments of this application described in this specification.

[0070] In one embodiment, this application also provides a computer program product that, when executed on a data processing device, is adapted to execute a program that initializes the various steps of the above-described method.

[0071] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0073] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0074] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The functional steps specified in one or more boxes.

[0075] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0076] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0077] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0078] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0079] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0080] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing fragmented packets, characterized in that, The processing method includes: Receive fragmented packets and determine the target fragment node corresponding to the fragmented packets; The fragmented packets are stored in the buffer of the target fragment node; Based on the tag type of the fragmented packet and the fragmented packets already stored in the buffer, a fragmented packet processing event or an exception event in the set events is triggered. The fragmented packet processing event includes reassembling the fragmented packet, and after the reassembly of the fragmented packet is completed, a reassembly completion notification event in the set events is triggered. In response to the reassembly completion notification event, confirm that the fragmented packets have been reassembled.

2. The processing method according to claim 1, characterized in that, The processing method is implemented based on a fragmented caching module and a fragmented processing module. The fragmentation processing module is used to identify the tag type of the fragmented packet, trigger the fragmented packet processing event, and reassemble the fragmented packet. The fragmented caching module is used to store the fragmented packets in the cache area, and to execute the fragmented packet processing event and the fragmented cache packet processing event in the cache area.

3. The processing method according to claim 2, characterized in that, The fragmentation packet processing events also include fragmentation node lookup notification events and fragmentation node creation events. The determination of the target fragment node corresponding to the fragmented message includes: Based on the fragmentation processing module, the fragmentation node lookup notification event is triggered when the fragmented message is received; In response to the fragment node lookup notification event, the target fragment node corresponding to the fragment packet is searched in the fragment node management structure; If the target shard node is not found, trigger the shard node creation event; and In response to the shard node creation event, a new shard node is created on the shard node management structure to serve as the target shard node.

4. The processing method according to claim 3, characterized in that, The sharding node management structure includes a hash table and a management linked list. The hash table structure includes: the source network address, destination network address, and network identifier of the fragmented packet.

5. The processing method according to claim 2, characterized in that, The fragmentation processing events also include fragmentation out-of-order events. The step of triggering the fragment packet processing event in the set event according to the tag type of the fragmented packet and the fragmented packets in the buffer includes: Based on the fragmentation processing module, it determines whether the fragmented packet is a fragmented out-of-order packet according to the tag type of the fragmented packet and the tag type of the fragmented packets already stored in the buffer. After determining that the fragmented packet is a fragmented out-of-order packet, the fragmented out-of-order event is triggered to mark the fragmented packet; and After determining that the fragmented packet is not an out-of-order fragmented packet, the fragmented packet is reassembled.

6. The processing method according to claim 2 or 5, characterized in that, The fragmented message marking types include: fragment header packet, fragment middle packet, and fragment tail packet. The fragmentation packet processing events also include: the first fragmentation packet event, the middle fragmentation packet event, and the last fragmentation packet event.

7. The processing method according to claim 6, characterized in that, The reassembly of the fragmented packets includes: Detect the type of the fragmented message; If the fragmented packet is the first packet of the fragment and the first packet flag on the fragment node management structure is not set, the first packet event of the fragment is triggered to establish a flow for the first packet of the fragment. If the fragmented packet is not the first packet of the fragment and it is confirmed that the first packet flag on the fragment node management structure is not set, a fragmentation out-of-order event is triggered, and the fragmented packet is cached. If the fragmented packet is not the first packet of the fragment and it is confirmed that the first packet flag on the fragment node management structure is set, trigger the fragmentation intermediate packet event or the fragmentation tail packet event to reassemble the fragmented packet; and After the fragment tail packet is reassembled, the reassembly completion notification event is triggered.

8. The processing method according to claim 2, characterized in that, The abnormal events include: fragment timeout events, fragment overflow events, fragment retransmission events, and fragment error events. The processing method further includes: after the abnormal event is triggered, releasing all stored fragmented packets in the cache area based on the fragmented cache module.

9. A fragmented message processing system, characterized in that, The processing system includes: A fragmentation processing module is used to receive fragmented packets and determine the target fragment node corresponding to the fragmented packets; and The fragment caching module is used to store the fragmented packets in the cache area of ​​the target fragment node. The fragmentation processing module is further configured to trigger a fragmentation packet processing event or an exception event in a set event based on the tag type of the fragmented packet and the fragmented packets already stored in the buffer. The fragmentation packet processing event includes reassembling the fragmented packet, and triggering a reassembly completion notification event in the set event after the reassembly of the fragmented packet is completed. The fragment caching module is also used to respond to the reassembly completion notification event and confirm that the fragmented packets have been reassembled.

10. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the method of processing fragmented packets according to any one of claims 1 to 8.

Images