Method, device and medium for seamless switching of PCAP files

Abstract

This application discloses a method, apparatus, device, and medium for seamless switching of PCAP files. The method includes: a processing system sending a file-switching command to a programmable logic unit when the storage size of the current PCAP file exceeds a preset file threshold; the programmable logic unit, in response to the file-switching command, adding a flag to the file header and adding a PCAP file header during the next frame of network data packaging; and, upon detecting a data packet containing a PCAP file header, switching the write address of the double data rate memory to the next preset alignment position and returning the effective length of the data in the previous buffer space; and the programmable logic unit initiating a burst write command corresponding to the effective data length to write boundary data into the double data rate memory. This application enables seamless switching of PCAP files, avoiding the loss or misattribution of boundary data during file switching.

Description

Technical Field

[0001] This application relates to the field of network data storage, and in particular to a method, apparatus, device and medium for seamless switching of PCAP files. Background Technology

[0002] With the rapid development of network technology, high-speed network traffic capture and analysis are playing an increasingly important role in network security monitoring, data center operation and maintenance, and communication protocol analysis. In high-speed network data acquisition and storage scenarios, it is usually necessary to store the captured network packets in the PCAP file format on storage media for subsequent offline analysis and backtracking. The PCAP file format is a widely used standard file format in the field of network packet capture. Each PCAP file contains a global header and several packet records. Each packet record includes a packet header and data content.

[0003] In high-speed network data acquisition and storage solutions based on heterogeneous platforms, the Programmable Logic (PL) is typically responsible for receiving network data packets, packaging them in PCAP format, and caching data, while the Processing System (PS) runs the operating system and is responsible for file system management and read / write control of large-capacity storage media. However, in practical applications, to facilitate file management and data backtracking, continuously captured network data needs to be split into multiple PCAP files for storage, for example, splitting according to the size of a single file. When the storage size of a single PCAP file reaches a preset threshold, file switching is required, i.e., closing the current PCAP file and creating a new PCAP file to continue writing.

[0004] In existing technologies, when a PCAP file switch is required, the PS (Power Switch) typically initiates the file-switching command, and the PL (Power Buffer) writes subsequent data to the storage area corresponding to the new file after receiving the command. However, since network data packets arrive continuously in a streaming manner, there is a time difference between the issuance of the file-switching command and the actual execution of the file switch. During this time, the PL is still writing the current data packets into the Double Data Rate (DDR) memory. If the boundary data already written to the DDR cache but not yet written to disk is not properly handled at the switch time, the data packets may be incorrectly assigned to the previous or next file, resulting in incomplete or abnormally formatted PCAP file data. Furthermore, in low-traffic scenarios, no new data packets may arrive for a long time after the file-switching command is issued, causing the file switch to be delayed, further affecting the continuity and reliability of data storage. Therefore, how to achieve seamless PCAP file switching on heterogeneous platforms and avoid boundary data loss or incorrect assignment has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application aims to propose a method, apparatus, device, and medium for seamless switching of PCAP files, which can realize seamless switching of PCAP files in high-speed data acquisition and storage based on Zynq architecture, and avoid loss of boundary data or incorrect attribution during file switching.

[0006] In a first aspect, embodiments of this application provide a seamless switching processing method for PCAP files, applied to a heterogeneous platform, the heterogeneous platform including a programmable logic terminal and a processing system terminal, the method comprising the following steps: The processing system sends a file-splitting command to the programmable logic terminal in response to the current PCAP file's storage size exceeding a preset file threshold. In response to the file-cutting instruction, the programmable logic terminal adds a flag to the file header and adds a PCAP file header during the next frame network data packaging process. When a data packet containing the PCAP file header is detected, the write address of the double data rate memory is switched to the next preset alignment position, and the effective length of the data in the previous buffer space is returned. The programmable logic terminal initiates a burst write command corresponding to the effective data length based on the effective data length, so as to write the boundary data into the double data rate memory, thereby achieving seamless switching between the previous and subsequent PCAP files.

[0007] According to some embodiments of this application, the programmable logic terminal initiates a burst write command corresponding to the valid data length based on the valid data length, including: The double data rate write module of the programmable logic terminal writes data to the double data rate memory according to a preset burst length under normal conditions. The double data rate write module responds to the file cut pulse by setting the internal register flag high; When the register flag is high, the double data rate write module determines whether the amount of data in the first-in-first-out buffer is equal to the effective length of the data. If it is equal, it generates a write double data rate command with a burst length equal to the effective length of the data.

[0008] According to some embodiments of this application, before the double data rate write module goes high in response to a file cut pulse, it further includes: When the double data rate cache processing module of the programmable logic terminal detects a data packet containing the PCAP file header, it switches the write address of the double data rate memory to the next preset alignment position, returns the effective length of the data in the previous cache space, and simultaneously sends the file cutting pulse to the double data rate write module.

[0009] According to some embodiments of this application, it further includes: after the processing system sends the file-splitting instruction to the programmable logic terminal, it continuously queries the status flag bit of the programmable logic terminal through the Advanced Scalable Interface Bus; The status flag is low by default. When the programmable logic terminal detects a data packet containing the PCAP header, it sets the status flag high and feeds back the status flag as an indication that the file cutting instruction has been processed.

[0010] According to some embodiments of this application, after the processing system continuously queries the status flag bit of the programmable logic terminal via the Advanced Scalable Interface Bus, it further includes: After the processing system detects that the status flag has gone high, it sends a direct memory access read command to the non-volatile memory fast channel disk controller. The direct memory access read command is used to read the first-in-first-out data cached in the double data rate read module of the programmable logic terminal. The length of the direct memory access read is determined according to the effective length of the data in the previous cache space.

[0011] According to some embodiments of this application, when the programmable logic terminal detects a data packet containing the PCAP header, it switches the write address of the Double Data Rate memory to the next preset alignment position, including: The programmable logic terminal writes network data into the double data rate memory in PCAP file format according to a preset burst length; When a data packet containing the PCAP header is detected, the programmable logic terminal jumps the current write address to the next preset alignment position, and writes the data after the next preset alignment position into the double data rate memory according to the address increment rule.

[0012] According to some embodiments of this application, it also includes: After the processing system sends the file-switching instruction to the programmable logic terminal, if the programmable logic terminal does not detect a data packet containing the PCAP file header within a preset timeout period, the programmable logic terminal triggers a timeout mechanism, performs a write address switch of the double data rate memory, and returns the effective length of the data in the previous cache space.

[0013] Secondly, embodiments of this application provide a seamless PCAP file switching processing device applied to a heterogeneous platform, the heterogeneous platform including a programmable logic terminal and a processing system terminal, the device comprising: A file-splitting instruction initiation module is set on the processing system side, and is used to send a file-splitting instruction to the programmable logic side in response to the current PCAP file storage size exceeding a preset file threshold. A programmable logic processing module, located at the programmable logic terminal, is used to respond to the file cutting command by setting the file header flag position high, adding a PCAP file header during the next frame network data packaging process, and when a data packet containing the PCAP file header is detected, switching the write address of the double data rate memory to the next preset alignment position and returning the effective length of the data in the previous buffer space. The boundary data writing module, located on the programmable logic terminal, is used to initiate a burst write command corresponding to the effective data length based on the effective data length, so as to write the boundary data into the double data rate memory, thereby achieving seamless switching between the previous and subsequent PCAP files.

[0014] Thirdly, embodiments of this application provide an electronic device, the device comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the seamless switching processing method for PCAP files as described in the first aspect.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the seamless switching processing method for PCAP files as described in the first aspect.

[0016] The seamless switching processing method, apparatus, device, and medium for PCAP files in this application have at least the following beneficial effects: In this embodiment, when the processing system detects that the storage size of the current PCAP file exceeds a preset file threshold, it sends a file-switching command to the programmable logic unit (PLU). In response, the PPU adds a flag to the file header, adds the PCAP file header during the next frame of network data packaging, and, upon detecting a data packet containing the PCAP file header, switches the write address of the Double Data Rate (DFR) memory to the next preset alignment position and returns the effective data length of the previous buffer space. The PPU then initiates a burst write command corresponding to the effective data length to write the boundary data into the DFR memory. This achieves boundary data integrity protection during PCAP file switching, ensuring seamless connection between two PCAP files and preventing boundary data loss or misattribution, thereby improving the reliability and integrity of high-speed network data acquisition and storage. Furthermore, this solution is collaboratively implemented by the PPU and the processing system. The PPU is responsible for hardware-level detection and integrity processing of boundary data, while the processing system is responsible for file switching decisions and triggering. Their clear division of labor and close cooperation fully leverage the advantages of heterogeneous platform hardware-software collaborative processing.

[0017] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0018] The present application will be further described below with reference to the accompanying drawings and embodiments, wherein: Figure 1 This is a schematic diagram of the overall hardware architecture of the heterogeneous platform provided in the embodiments of this application; Figure 2 A schematic diagram of the structure of the double data rate data caching framework provided in the embodiments of this application; Figure 3 A flowchart illustrating an embodiment of the seamless switching processing method for PCAP files provided in this application; Figure 4 A schematic diagram of the structure of the seamless PCAP file switching processing device provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0020] In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0021] To address the technical problem of easy loss or misattribution of boundary data during PCAP file switching in the high-speed network data acquisition and storage process in the prior art, this application provides a seamless PCAP file switching processing method, apparatus, device, and medium. The seamless PCAP file switching processing method provided in this application is described below.

[0022] Please refer to Figure 1This application provides a high-speed data acquisition and storage architecture based on a heterogeneous platform. The heterogeneous platform includes a Programmable Logic (PL) end and a Processing System (PS) end. Specifically, the heterogeneous platform can be a Zynq heterogeneous platform. The PL end receives network data and packages it into PCAP format, caching it in external Double Data Rate (DDR) memory. The PS end runs a Linux operating system and is responsible for file system management. The PL end and the PS end interact via an Advanced eXtensible Interface (AXI) bus. The PL end connects two Non-Volatile Memory Express (NVMe) disks as storage media via a high-speed Peripheral Component Interconnect Express (PCIE) interface. The PS end controls access to the two NVMe disks through AXI PCIE IP core memory mapping. The specific model of the Zynq device could be Zynq7045, with two DDR chips externally connected to the PS side and four DDR chips directly connected to the PL side, for a total memory size of 2GB. Each network data channel is divided into 512M address spaces.

[0023] The network data processing procedure on the PL side is as follows: The PL side instantiates a Media Access Control (MAC) IP core and converts the network data into an AXI-Stream for processing. The PL side calculates the frame length and data content, and writes them into two First In First Out (FIFO) buffers respectively. When data is found in len_fifo, it indicates that a frame of network data has been written into the FIFO, and at this time, PCAP format packing processing is initiated. The PCAP format content consists of a file header, timestamp, total length, valid length, valid data, and padding data, aligned to 64 bytes, where 64 bytes correspond to the DDR data bit width. The file header is only included at the beginning of the PCAP file. During the packing process, the PL side needs to determine the high or low state of the file header addition flag to decide whether to add a file header. The file header addition flag is high by default upon power-on, so a file header needs to be added when packing the first frame of network data. After adding the file header, the flag is set low. Subsequently, when the PS side initiates a file-switching command through the operation register, this flag will be set high. During the next frame of network data packaging, the PL side adds the file header again, and after the file header is added, this flag will be set low again.

[0024] After the four network data streams are packaged into PCAP format, they are sent to the PL-side DDR memory for caching according to a uniform memory partition. The four DDR chips have a total memory size of 2GB, with each network data stream divided into 512MB address spaces. During the generation of the DDR write command, the PL-side checks if the first 192 bytes of the PCAP data packet constitute a file header. If so, it indicates that the PCAP data packet needs to be switched to a new file for storage. At this point, the DDR write address switches to the next 2K aligned position, and the PL-side is notified of the valid length of the previous 2K space data and the new address containing the file header. If there is no data on the port after the PS-side initiates the file-switching command, there is no new data containing the file header. In this case, there is a 1-second timeout mechanism. After the timeout, the PS-side is again notified of the valid length of the previous 2K space data and the new address containing the file header. Simultaneously with the notification to the PS-side, the PL-side also sends a pulse to the DDR write module. The DDR write module generates a write DDR command with a burst length equal to the valid length of the previous 2K space data to the DDR write arbitration module, thus ensuring the integrity of the PCAP file boundary data.

[0025] Please refer to Figure 2 The DDR data caching framework consists of a DDR write module, a DDR read module, a DDR write arbitration module, a DDR read arbitration module, a DDR read-write arbitration module, and a DDR controller, supporting simultaneous four-way data caching for writing and reading. The default burst length of the DDR write module is designed to be 2KB, while the maximum transmission unit (MTU) of a network packet is 1500 bytes; therefore, a 2KB burst length can fully accommodate a network packet. When the DDR write module receives a file-splitting pulse initiated by the DDR cache processing module, it generates a write DDR command with a burst length equal to the previous 2KB valid data length and sends it to the DDR write arbitration module. The DDR read module, based on the DDR write module's write DDR address pointer exceeding 2KB of the current read DDR address pointer and the internal cache FIFO not being full, generates a 2KB data read command and sends it to the DDR read arbitration module. Data read from the DDR is cached in the PL's internal FIFO, and the PS initiates a command to notify the NVMe disk controller to perform Direct Memory Access (DMA) read / write operations on this FIFO.

[0026] The programmable logic module may also include a PCIe read address mapping module. This module connects to the DDR read module, sending a read enable signal (rd_en) to the DDR read module and receiving the read data signal (rd_data) returned by the DDR read module. The processing system can directly read data from the DDR memory of the programmable logic module through the PCIe read address mapping module, facilitating subsequent operations such as DMA writing to the NVMe disk.

[0027] It should be noted that in this embodiment, DDR is an abbreviation for Double Data Rate. For ease of description, the Double Data Rate memory will be referred to as DDR memory, the Double Data Rate write module as DDR write module, the Double Data Rate read module as DDR read module, the Double Data Rate cache processing module as DDR cache processing module, the Double Data Rate write arbitration module as DDR write arbitration module, the Double Data Rate read arbitration module as DDR read arbitration module, the Double Data Rate read and write arbitration module as DDR read and write arbitration module, and the Double Data Rate controller as DDR controller.

[0028] Based on the above hardware architecture, this application provides a method for seamless switching of PCAP files, the method comprising: When the storage size of the current PCAP file exceeds the preset file threshold, the processing system sends a file-splitting command to the programmable logic terminal. In response to the file cut command, the programmable logic terminal sets the header flag high, adds the PCAP header during the next frame network data packaging process, and when a data packet containing a PCAP header is detected, switches the write address of the double data rate memory to the next preset alignment position and returns the effective length of the data in the previous buffer space. The programmable logic terminal initiates a burst write command corresponding to the valid data length to write boundary data into the double data rate memory, thereby achieving seamless switching between the previous and next PCAP files.

[0029] The following is combined Figure 3 This application provides a detailed description of the seamless PCAP file switching method provided in its embodiments. Please refer to... Figure 3 The seamless switching process for PCAP files specifically includes the following steps: In step S101, the PL end packages network data according to the PCAP format and sends it to the DDR write module.

[0030] Specifically, the PL receives Ethernet data frames from the network and converts the network data into an AXI-Stream stream for processing via the MAC IP core. The PL calculates the frame length of each data frame and writes the frame length and data content into two FIFOs respectively. When data is found in the len_fifo, it indicates that a complete frame of network data has been written into the FIFO, at which point the PL initiates PCAP format packetization. The PCAP format consists of a header, timestamp, total length, valid length, valid data, and padding data, aligned to 64 bytes, where 64 bytes corresponds to the data width of the DDR. It should be noted that 64-byte alignment means that each PCAP data packet is packaged in multiples of 64 bytes, so the starting address of each PCAP data packet is also aligned to 64 bytes. Since four DDR chips are connected to the PL externally, and the data width of the DDR controller user interface is 512 bits, or 64 bytes, each PCAP data packet is aligned to 64 bytes and then sent to the DDR buffer for convenient address management. During the PCAP packetization process, the PL (Portable Logic Controller) calculates the length of the header and valid data, then pads the data in multiples of 64 bytes. The padded data serves as filler data. The PL sends the packaged PCAP data packet to the DDR write module. The DDR write module normally writes data to the external DDR in 2KB bursts, with the write pointer changing according to the actual amount of data written to the DDR. The DDR read module checks if the write pointer has exceeded the current DDR read address by 2KB and if the internal FIFO buffer is not yet full. When both conditions are met, the DDR read module reads 2KB of data from the DDR.

[0031] In step S102, the PS terminal checks the length of the write pointer every preset time interval. If the write pointer changes, DMA read is initiated.

[0032] Specifically, the PS (Power Supply) checks the length of the write pointer every 50 milliseconds. The write pointer is stored in a specific register on the PL (Power Supply) end, and the PS reads the value of this register via the AXI bus. If the write pointer changes, it indicates that there is new cached data in the DDR, and the PS sends a command to the NVMe disk controller to initiate a DMA read operation. The DMA reads data from the DDR read module's internal cache FIFO, generating the first PCAP file, which is stored on the NVMe disk. The offset address range for the DMA read is 0 to 512M, with each channel being 512M. The length of the DMA read is determined by the length of the write pointer change, but cannot exceed the actual change. The amount of data read by the NVMe disk controller's DMA is counted using the read pointer, which is also stored in a specific register on the PL end and read by the PS via the AXI bus. The read pointer always follows the DDR write pointer, and the size of one round of read and write pointers is 512M. Before each DMA read command to the NVMe disk controller, the PS checks the current positions of the write and read pointers. If the write pointer is greater than the read pointer, it indicates that there is still data that has not been written to the disk, and the PS initiates a DMA read command to the NVMe disk controller. The length of a single DMA read cannot exceed the number of times the write pointer exceeds the read pointer, to ensure the validity of the DMA read data. After the DMA is complete, the NVMe disk controller will notify the PS via an interrupt.

[0033] In step S103, the PS terminal determines whether the storage size of the first PCAP file exceeds the preset file threshold. If it does, a file-switching command is initiated.

[0034] Specifically, the PS terminal monitors the storage size of the currently being written PCAP file in real time. When the PS terminal determines that the storage size of the first PCAP file exceeds a preset file threshold, such as exceeding 256MB, the PS terminal sends a file switching command to the PL terminal. This file switching command is transmitted to the PL terminal by writing a specific register on the PL terminal via the AXI bus. That is, the PS terminal writes a specific value to a specified register address on the PL terminal via the AXI bus to notify the PL terminal to perform a file switching operation.

[0035] In step S104, the PL end responds to the file cutting command by adding a flag to the file header and adding a PCAP file header during the next frame network data packaging process.

[0036] Specifically, after receiving the file-splitting instruction written to the register by the PS via the AXI bus, the PL (Plug and Switch) terminal sets the header addition flag high. The header addition flag is an internal register status bit of the PL terminal. This flag is high by default upon power-on, is set low by the PL terminal after the header is added, and is set high again upon receiving the file-splitting instruction. After the header addition flag is set high, the PL terminal checks the high / low status of this flag during the PCAP packetization process of the next frame of network data. Since the flag is high, the PL terminal adds the PCAP header during the PCAP packetization process of the next frame of network data. After adding the header, the flag is set low again.

[0037] In step S105, when the PL detects a data packet containing a PCAP header, it switches the DDR write address to the next preset alignment position and returns the effective length of the data in the previous cache space.

[0038] Specifically, the DDR cache processing module on the PL side continuously checks whether the input data packets contain a PCAP header. Once a data packet containing a PCAP header is detected, the DDR cache processing module switches the DDR write address to the next 2K aligned position and returns the effective length of the data in the previous 2K space and the new address containing the header data, notifying the PS side in the form of a flag. Address management is handled by the DDR cache processing module. The total DDR memory size is 2GB, with each channel occupying 512MB. After the write address reaches the end, it starts again from the beginning address. After the PCAP data packet enters this module, it generates a command containing the write DDR address and write DDR data according to the address incrementing rule and sends it to the DDR write module. When a PCAP data packet containing header information is found, the write DDR address does not change according to the incrementing rule, but jumps to the next 2K start position of the current DDR write address. Subsequent data will be written to DDR at this 2K start position according to the address incrementing rule, without causing address conflicts between the data before and after the file split.

[0039] In step S106, the PL terminal initiates a burst write command corresponding to the valid data length to write the boundary data into the DDR.

[0040] Specifically, the DDR cache processing module, while returning the valid data length, also initiates a file-splitting pulse to the DDR write module. Under normal conditions, the DDR write module writes data to the DDR in 2KB bursts. When the DDR write module receives the file-splitting pulse, it internally defines a register variable flag, which is set high. After the DDR write command enters the DDR write module, it is first buffered in the FIFO, and then the generation of a burst write command is managed by the state machine. By default, the burst is 2KB. The DDR write module state machine determines whether the amount of data in the FIFO is greater than or equal to 2KB. If this condition is met, a burst write command is generated. When the file-splitting pulse arrives, the internal register flag is set high. Once this flag is high, the DDR write module state machine's condition changes to whether the amount of data in the FIFO is equal to the valid data length of the previous 2KB space. If the amount of data in the FIFO is equal to this valid length, the DDR write module generates a write DDR command with a burst length equal to this valid data length and sends it to the DDR write arbitration module. Whether the resend write command is executed immediately after the file cut pulse is sent or after the current data packet is written depends on the current data volume in the FIFO. When the data flow is large, the FIFO has a large amount of buffered data, and it will queue up until the data in the current FIFO is written in 2K burst lengths before execution. When the data flow is small, the FIFO has less than 2K of data, and the resend write command will be executed immediately after receiving the file cut pulse.

[0041] In step S107, the PL terminal sets the status flag high, and the PS terminal clears the flag and starts DMA read after detecting that the status flag has become high.

[0042] Specifically, the status flag is a register status bit on the PL side, which is low by default. After the PS side initiates a file-switching command, it continuously queries this register status bit via the AXI bus. Upon receiving the file-switching command, the PL side sets the file header flag high, adding the file header when assembling the next frame of network data packets. The DDR cache processing module continuously checks whether the input data packets contain file headers; once a data packet containing a file header is detected, it sets the status flag high. After the PS side detects that the status flag is high, it indicates that the PL side's file-switching processing is complete. The PS side writes a value to a specific register on the PL side via the AXI bus, clearing the status flag. Then, the PS side initiates a DMA read command to the NVMe disk controller. The DMA read length is aligned to the previous 2K space position, and the data is written to the NVMe disk according to the valid length, completing the storage processing of the first PCAP file. Finally, the data following the file is switched to the new file storage, thus completing the entire process of switching from the current file storage to the next file storage.

[0043] In some implementations, the programmable logic terminal initiates a burst write command corresponding to the valid data length, including: the double data rate write module of the programmable logic terminal writes data to the double data rate memory according to a preset burst length under normal conditions; the double data rate write module responds to the file cut pulse by setting the internal register flag high; when the register flag is high, the double data rate write module determines whether the amount of data in the first-in-first-out buffer is equal to the valid data length, and if it is equal, it generates a write double data rate command with a burst length equal to the valid data length.

[0044] Specifically, under normal conditions, the DDR write module writes data to the DDR in bursts of 2KB. When the DDR write module receives a file-splitting pulse from the DDR cache processing module, it internally sets a register variable flag high. After a DDR write command enters the DDR write module, it is first buffered in the FIFO, and then the generation of a burst write command is managed by a state machine. By default, the burst is 2KB. The DDR write module state machine checks if the amount of data in the FIFO is greater than or equal to 2KB. If it does, a burst write command is generated. When the file-splitting pulse arrives, the internal register flag goes high. Once this flag is high, the DDR write module state machine's condition changes to whether the amount of data in the FIFO is equal to the effective length of the previous 2KB space. If the amount of data in the FIFO is equal to this effective length, the DDR write module generates a write DDR command with a burst length equal to this effective length and sends it to the DDR write arbitration module. Whether the resend write command is executed immediately after the file-splitting pulse or after the current data packet is written depends on the current amount of data in the FIFO. When the data flow is large, the FIFO caches a large amount of data, which will queue up and wait until the data in the current FIFO is written in 2KB bursts before execution. When the data flow is small, the FIFO contains less than 2KB of data, and upon receiving a file switch pulse, a resend write command will be executed immediately. This method ensures the integrity of boundary data in DDR during file switching, preventing data loss.

[0045] In some implementations, before the double data rate write module sets its internal register flag high in response to the file cut pulse, the double data rate buffer processing module at the programmable logic side switches the write address of the double data rate memory to the next preset alignment position and returns the effective length of the data in the previous buffer space when it detects a data packet containing a PCAP header, while simultaneously initiating a file cut pulse to the double data rate write module.

[0046] Specifically, the DDR cache processing module continuously checks whether the input data packet contains a PCAP header. Once a data packet containing a PCAP header is detected, the DDR cache processing module switches the DDR write address to the next 2K aligned position and returns the valid data length of the previous 2K space and the new address containing the header data, notifying the PS end in the form of a flag. Simultaneously, while returning the valid data length, the DDR cache processing module also initiates a file-switching pulse to the DDR write module. Address management is handled by the DDR cache processing module. The total DDR memory size is 2GB, with each channel occupying 512MB. After the write address reaches the end, it starts again from the beginning address. After the PCAP data packet enters this module, it generates a command containing the write DDR address and write DDR data according to the address incrementing rule and sends it to the DDR write module. When a PCAP data packet containing header information is detected, the write DDR address does not change according to the incrementing rule, but jumps to the next 2K starting position of the current DDR write address. Subsequent data will be written to DDR at this 2K starting position according to the address incrementing rule, without causing address conflicts between data before and after the file-switching. Using the above method, address switching and file cutting pulses can be triggered in a timely manner when the file header is detected, ensuring the correct processing of boundary data.

[0047] In some implementations, the seamless switching method for PCAP files further includes: after the processing system sends a file-switching command to the programmable logic terminal, it continuously queries the status flag bit of the programmable logic terminal through the Advanced Scalable Interface Bus; the status flag bit is low by default, and when the programmable logic terminal detects a data packet containing a PCAP file header, it sets the status flag bit high and feeds back the status flag bit as an indication that the file-switching command has been processed.

[0048] Specifically, the status flag is a register status bit on the PL side, which is low by default. After the PS side initiates a file cut command, it continuously queries this register status bit via the AXI bus. Upon receiving the file cut command, the PL side sets the file header flag high, adding the file header when assembling the next frame of network data packets. The DDR cache processing module continuously checks whether the input data packets contain a file header; once a data packet containing a file header is detected, it sets the status flag high. After the PS side detects that the status flag is high, it indicates that the PL side's file cut processing is complete. The PS side then writes a value to a specific register on the PL side via the AXI bus, clearing the status flag. In this way, the PS side can promptly obtain the completion status of the PL side's file cut processing, thereby accurately controlling the timing of subsequent DMA read operations.

[0049] In some implementations, after the processing system continuously queries the status flag of the programmable logic terminal via the Advanced Scalable Interface Bus, the process further includes: after the processing system detects that the status flag has gone high, it initiates a direct memory access read command to the non-volatile memory fast channel disk controller; the direct memory access read command is used to read the first-in-first-out data cached in the double data rate read module of the programmable logic terminal, and the length of the direct memory access read is determined according to the effective length of the data in the previous cache space.

[0050] Specifically, after the PS detects that the status flag has gone high, it initiates a DMA read command to the NVMe disk controller. The DMA reads data from the DDR read module's internal cache FIFO, generating a PCAP file which is stored on the NVMe disk. The length of the DMA read is determined by the length of the write pointer change, but cannot exceed the actual change. The amount of data read by the NVMe disk controller via the DMA is tracked by the read pointer, which always follows the DDR write pointer. Before each DMA read command, the PS checks the current positions of the write and read pointers. If the write pointer is greater than the read pointer, it indicates that data has not yet been written to disk, and the PS initiates the DMA read command. The DMA read length is aligned to the previous 2KB space position, and the data is written to the NVMe disk according to the valid length. This method ensures that boundary data is accurately written to the NVMe disk after a file switch, guaranteeing the integrity and correctness of the PCAP file.

[0051] In some implementations, when the programmable logic terminal detects a data packet containing a PCAP header, it switches the write address of the Double Data Rate Memory to the next preset alignment position. This includes: the programmable logic terminal writing network data into the Double Data Rate Memory in PCAP file format according to a preset burst length; when a data packet containing a PCAP header is detected, the programmable logic terminal jumps the current write address to the next preset alignment position, and writes the data after the next preset alignment position into the Double Data Rate Memory according to the address increment rule.

[0052] Specifically, the total DDR memory size is 2GB, with each channel occupying 512MB. The write address restarts from the beginning address after reaching the end. When a PCAP data packet enters this module, it generates a command containing the write DDR address and write DDR data according to an address incrementing pattern, and sends it to the DDR write module. When a PCAP data packet containing file header information is detected, the write DDR address does not change according to the incrementing pattern, but instead jumps to the next 2KB starting position of the current DDR write address. Subsequent data is written into DDR at this 2KB starting position according to the address incrementing pattern. In this way, the starting data of a new file can be written to a preset aligned address position, facilitating address management and data alignment during subsequent DMA reads, while preventing address conflicts between data before and after the file split.

[0053] In some implementations, the seamless switching method for PCAP files further includes: after the processing system sends a file switching instruction to the programmable logic terminal, if the programmable logic terminal does not detect a data packet containing a PCAP file header within a preset timeout period, the programmable logic terminal triggers a timeout mechanism, performs a write address switch of the double data rate memory, and returns the effective length of the data in the previous cache space.

[0054] Specifically, timeout refers to the PL not detecting a data packet containing a file header within one second after the PS initiates a file-switching command. According to the PL's file-switching processing flow, after the PS initiates the command, the file header addition flag is set high. The next network data packet will then have a file header added, and the PL will immediately detect the data packet containing the file header. If no data is detected, it means there is no data on the port within one second after the PS initiates the command, or the preceding FIFO has cached a lot of data that cannot be processed in time. During the one-second timeout, only whether the data packet contains a file header is checked. Data without a file header but cached in the preceding module's FIFO will continue to be processed. The preceding module is not affected by the one-second timeout and will continue to receive and cache new network data. After the timeout is triggered, the PL immediately performs a DDR write address switch and returns the valid length. Whether the data received during the timeout belongs to the previous or next file depends on whether it was data processed before or after the DDR write address switch triggered by the timeout. Data processed before the DDR write address switch belongs to the previous file, while data processed after the DDR write address switch belongs to the next file. Whether data generated by the port at the time of the switch belongs to the previous or next file has little impact on user experience, as long as the two files are seamlessly connected. Through this timeout mechanism, seamless storage write-to-disk switching can be achieved even under very low traffic conditions.

[0055] It should be noted that the seamless switching method for PCAP files provided in this application is completed synchronously and coordinated between the PL and PS ends. This method is applicable to high-speed data acquisition and storage products based on the Zynq architecture. The switching conditions of this method are simple and flexible. As long as the size of a single PCAP file is exceeded, the PS end can initiate the switch, and the PL end ensures the integrity of the boundary data, resulting in seamless connection between the two files. The PCAP files are packaged and aligned to 64 bytes, which greatly improves the effective utilization of the NVMe disk, and the proportion of invalid data stored on the disk is very small. A timeout mechanism is adopted to achieve seamless switching of storage to disk even under very low traffic conditions.

[0056] Based on the seamless switching processing method for PCAP files provided in the above embodiments, this application also provides a specific implementation of the seamless switching processing device for PCAP files.

[0057] like Figure 4 As shown, the seamless PCAP file switching processing device 200 provided in this application embodiment may include: The file-cutting instruction initiation module 201 is set on the processing system side and is used to send a file-cutting instruction to the programmable logic side in response to the current PCAP file storage size exceeding the preset file threshold. The programmable logic processing module 202, located at the programmable logic terminal, is used to respond to the file cutting command, set the file header flag position high, add the PCAP file header during the next frame network data packaging process, and when a data packet containing a PCAP file header is detected, switch the write address of the double data rate memory to the next preset alignment position and return the effective length of the data in the previous buffer space. The boundary data writing module 203 is located on the programmable logic side and is used to initiate a burst write command corresponding to the effective length of the data according to the effective length of the data, so as to write the boundary data into the double data rate memory and realize seamless switching between the previous and subsequent PCAP files.

[0058] The PCAP file seamless switching processing device 200 of this application embodiment is used to execute the PCAP file seamless switching processing method in the above embodiment. Its specific processing procedure is the same as the PCAP file seamless switching processing method in the above embodiment, and will not be described in detail here.

[0059] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0060] The electronic device may include a processor 301 and a memory 302 storing computer program instructions.

[0061] Specifically, the processor 301 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0062] Memory 302 may include mass storage for data or instructions. For example, and not limitingly, memory 302 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 302 may include removable or non-removable (or fixed) media. Where appropriate, memory 302 may be internal or external to an electronic device. In a particular embodiment, memory 302 is a non-volatile solid-state memory.

[0063] In some embodiments, memory 302 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0064] The processor 301 reads and executes computer program instructions stored in the memory 302 to implement any of the seamless PCAP file switching processing methods in the above embodiments.

[0065] In one example, the electronic device may also include a communication interface 303 and a bus 310. For example, Figure 5 As shown, the processor 301, memory 302, and communication interface 303 are connected through bus 310 and complete communication with each other.

[0066] The communication interface 303 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0067] Bus 310 may include hardware, software, or both. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 310 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0068] Furthermore, in conjunction with the seamless PCAP file switching processing method in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the seamless PCAP file switching processing methods in the above embodiments.

[0069] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0070] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0071] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0072] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0073] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for seamless switching of PCAP files, characterized in that, Applied to heterogeneous platforms, wherein the heterogeneous platform includes a programmable logic terminal and a processing system terminal, the method includes the following steps: The processing system sends a file-splitting command to the programmable logic terminal in response to the current PCAP file's storage size exceeding a preset file threshold. In response to the file-cutting instruction, the programmable logic terminal adds a flag to the file header and adds a PCAP file header during the next frame network data packaging process. When a data packet containing the PCAP file header is detected, the write address of the double data rate memory is switched to the next preset alignment position, and the effective length of the data in the previous buffer space is returned. The programmable logic terminal initiates a burst write command corresponding to the effective data length based on the effective data length, so as to write the boundary data into the double data rate memory, thereby achieving seamless switching between the previous and subsequent PCAP files.

2. The seamless switching processing method for PCAP files according to claim 1, characterized in that, The programmable logic terminal initiates a burst write command corresponding to the valid data length based on the valid data length, including: The double data rate write module of the programmable logic terminal writes data to the double data rate memory according to a preset burst length under normal conditions. The double data rate write module responds to the file cut pulse by setting the internal register flag high; When the register flag is high, the double data rate write module determines whether the amount of data in the first-in-first-out buffer is equal to the effective length of the data. If it is equal, it generates a write double data rate command with a burst length equal to the effective length of the data.

3. The seamless switching processing method for PCAP files according to claim 2, characterized in that, Before the double data rate write module responds to the file cut pulse and sets the internal register flag high, it also includes: When the double data rate cache processing module of the programmable logic terminal detects a data packet containing the PCAP file header, it switches the write address of the double data rate memory to the next preset alignment position, returns the effective length of the data in the previous cache space, and simultaneously sends the file cutting pulse to the double data rate write module.

4. The seamless switching processing method for PCAP files according to claim 1, characterized in that, Also includes: After the processing system sends the file-splitting instruction to the programmable logic terminal, it continuously queries the status flag bit of the programmable logic terminal through the Advanced Scalable Interface Bus. The status flag is low by default. When the programmable logic terminal detects a data packet containing the PCAP header, it sets the status flag high and feeds back the status flag as an indication that the file cutting instruction has been processed.

5. The seamless switching processing method for PCAP files according to claim 4, characterized in that, After the processing system continuously queries the status flags of the programmable logic terminal via the Advanced Scalable Interface Bus, it also includes: After the processing system detects that the status flag has gone high, it sends a direct memory access read command to the non-volatile memory fast channel disk controller. The direct memory access read command is used to read the first-in-first-out data cached in the double data rate read module of the programmable logic terminal. The length of the direct memory access read is determined according to the effective length of the data in the previous cache space.

6. The seamless switching processing method for PCAP files according to claim 1, characterized in that, When the programmable logic terminal detects a data packet containing the PCAP header, it switches the write address of the double data rate memory to the next preset alignment position, including: The programmable logic terminal writes network data into the double data rate memory in PCAP file format according to a preset burst length; When a data packet containing the PCAP header is detected, the programmable logic terminal jumps the current write address to the next preset alignment position, and writes the data after the next preset alignment position into the double data rate memory according to the address increment rule.

7. The seamless switching processing method for PCAP files according to claim 1, characterized in that, Also includes: After the processing system sends the file-switching instruction to the programmable logic terminal, if the programmable logic terminal does not detect a data packet containing the PCAP file header within a preset timeout period, the programmable logic terminal triggers a timeout mechanism, performs a write address switch of the double data rate memory, and returns the effective length of the data in the previous cache space.

8. A seamless PCAP file switching processing device, characterized in that, Applied to a heterogeneous platform, the heterogeneous platform including a programmable logic terminal and a processing system terminal, the device includes: A file-splitting instruction initiation module is set on the processing system side, and is used to send a file-splitting instruction to the programmable logic side in response to the current PCAP file storage size exceeding a preset file threshold. A programmable logic processing module, located at the programmable logic terminal, is used to respond to the file cutting command by setting the file header flag position high, adding a PCAP file header during the next frame network data packaging process, and when a data packet containing the PCAP file header is detected, switching the write address of the double data rate memory to the next preset alignment position and returning the effective length of the data in the previous buffer space. The boundary data writing module, located on the programmable logic terminal, is used to initiate a burst write command corresponding to the effective data length based on the effective data length, so as to write the boundary data into the double data rate memory, thereby achieving seamless switching between the previous and subsequent PCAP files.

9. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the seamless switching processing method for PCAP files as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the seamless switching processing method for PCAP files as described in any one of claims 1-7.

Images