CN111124948A

Movatterモバイル変換

Info

Publication number: CN111124948A
Application number: CN201911230053.1A
Authority: CN
Inventors: 高宇
Original assignee: Beijing Coretek Systems Technology Co ltd; Kyland Technology Co Ltd
Current assignee: Beijing Coretek Systems Technology Co ltd; Kyland Technology Co Ltd
Priority date: 2019-12-04
Filing date: 2019-12-04
Publication date: 2020-05-08

Abstract

Translated fromChinese

本发明提供嵌入式系统的网络数据抓包方法及系统、存储介质，包括：获取网络层接收和/或发送的数据；根据网络协议类型过滤从网络层获取的数据；将过滤后的数据进行格式化，以获取目标格式的数据；采用多级任务对应多级缓存区的方式对所述目标格式的数据进行存储；不同级别的任务对应不同级别的缓存区；其中，至少某一级任务对应的缓存区存储完整的目标格式的数据；以及至少某一级任务对应的缓存区存储所述目标格式的数据的标识信息；其中，根据所述标识信息能够获取所述目标格式数据；将所述标识信息写入到硬盘文件中。由上，本申请可以在不影响网络收发速率的情况下，稳定高效的网络抓包，实现既能避免丢包，又不导致网速变慢。

The invention provides a network data packet capturing method, system and storage medium of an embedded system, including: obtaining data received and/or sent by a network layer; filtering data obtained from the network layer according to a network protocol type; formatting the filtered data to obtain the data in the target format; the data in the target format is stored in the way that multi-level tasks correspond to multi-level cache areas; tasks at different levels correspond to cache areas at different levels; wherein, at least one level of tasks corresponding to The cache area stores the data in the complete target format; and the cache area corresponding to at least a certain level of tasks stores the identification information of the data in the target format; wherein, the target format data can be obtained according to the identification information; The information is written to the hard disk file. From the above, the present application can capture network packets stably and efficiently without affecting the transmission and reception rate of the network, so as to avoid packet loss without slowing down the network speed.

Description

Network data packet capturing method and system of embedded system and storage medium

Technical Field

The invention relates to the technical field of network packet capturing, in particular to a network data packet capturing method and system of an embedded system and a storage medium.

Background

The packet capturing is often used for network data interception, and by analyzing captured messages, network safety can be checked accordingly, and operation and maintenance personnel or other engineers can be helped to quickly locate problems and analyze failure causes and the like.

At present, when an embedded system performs network packet capturing, either packet is lost or packet capturing can cause network speed to slow. Therefore, how to implement a stable and efficient network packet capturing function without affecting the network transceiving rate becomes an urgent problem to be solved.

Disclosure of Invention

In view of the above, the main objective of the present invention is to provide a method, a system, and a storage medium for capturing a packet of network data of an embedded system, so as to solve the problem of packet loss or network speed slowing in the prior art.

The application provides a network data packet capturing method of an embedded system, which comprises the following steps:

acquiring data received and/or transmitted by a network layer;

filtering data obtained from the network layer according to a network protocol type;

formatting the filtered data to obtain data in a target format;

storing the data in the target format in a mode that a multi-level task corresponds to a multi-level cache region; wherein, tasks of different levels correspond to cache regions of different levels; the cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; the target format data can be acquired according to the identification information;

and writing the identification information of the data in the target format into a hard disk file.

Therefore, the data in the target format is stored in a mode that the multi-level tasks correspond to the multi-level cache mechanism. The cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; the target format data can be acquired according to the identification information; further, only the identification information of the data in the target format is written into the hard disk file. Under the condition of not influencing the network receiving and sending rate, the network packet capturing can be stable and efficient, and the packet loss can be avoided, and the network speed is not slowed down.

Preferably, the storing the data in the target format in a manner that the multi-level tasks correspond to the multi-level cache regions includes:

executing a primary task, and adding the data in the target format into a primary buffer area;

and after the primary task is processed, executing a secondary task, and storing the identification information of the data in the target format in the primary buffer area into a secondary buffer area.

Therefore, in order to prevent the influence on the data acquisition or the network transmission/reception efficiency when the file is written, the invention is provided with the primary task and the secondary task and the primary buffer and the secondary buffer. In addition, zero copy is carried out on the data in the secondary task, and only the identification information of the data in the target format is stored in the secondary buffer area, so that the CPU resource is effectively saved.

Preferably, the identification information includes at least one of: storage address, index identification.

Therefore, the identification information may be the above information or other identification of the data in the target format, and the identification information is used to obtain the data in the target format, so that the identification of the data in the target format can be obtained according to the above information.

Preferably, the acquiring data received and/or sent by the network layer includes:

in the function of transmitting and/or receiving data of the network card, the original data of the network data frame is obtained by intercepting the data of the descriptor buffer area of the network card.

Preferably, the target format is a PCAP format; wherein the step C comprises:

adding a standard PCAP data header format in front of the filtered data to obtain data in the PCAP format;

wherein the PCAP data header format comprises: packet capturing time and length information of the original data packet.

Preferably, the raw data comprises: protocol family type and user data of the network;

wherein the network protocol type includes at least one of: TIPC protocol, UDP protocol and TCP protocol.

The present application further provides a packet capturing system for implementing the packet capturing method, including:

the acquisition module is used for acquiring data received and/or sent by a network layer;

the filtering module is used for filtering the data acquired from the network layer according to the type of the network protocol;

the formatting processing module is used for formatting the filtered data to acquire data in a target format;

the storage execution module is used for storing the data in the target format in a mode that a multi-level task corresponds to a multi-level cache mechanism; wherein, tasks of different levels correspond to cache regions of different levels; the cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; the target format data can be acquired according to the identification information;

and the writing module is used for writing the identification information of the data in the target format into a hard disk file.

Therefore, the data in the target format is stored in a mode that the multi-level tasks correspond to the multi-level cache mechanism. Under the condition of not influencing the network receiving and sending rate, the network packet capturing can be stable and efficient, and the packet loss can be avoided, and the network speed is not slowed down.

Preferably, the storage execution module includes:

the first storage execution submodule is used for adding the data in the target format to a primary buffer area in a primary task;

and the second storage execution submodule is used for storing the identification information of the target format in the primary buffer area into a secondary buffer area in a secondary task after the primary task is processed.

The present application also relates to a computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, implements the steps of the above-mentioned method for packet capture of network data.

In summary, compared with the closest prior art, the invention has the following beneficial effects: the invention provides a method, a system and a storage medium for capturing network data of an embedded system. The cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; the target format data can be acquired according to the identification information; further, only the identification information of the data in the target format is written into the hard disk file. Under the condition of not influencing the network receiving and sending rate, the network packet capturing can be stable and efficient, and the packet loss can be avoided, and the network speed is not slowed down.

Drawings

FIG. 1 is a flow chart of a network data packet capturing method of an embedded system according to the present invention;

FIG. 2 is a flow chart of a network data packet capturing method of the embedded system according to the present invention;

fig. 3 is a schematic structural diagram of a network data packet capturing system of the embedded system according to the present invention.

Detailed Description

Preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only for explaining the technical principle of the present invention, and are not intended to limit the scope of the present invention.

It should be noted that the terms "first" and "second" in the description of the present invention are used for convenience of description only and do not indicate or imply relative importance of the devices, elements or parameters, and therefore should not be construed as limiting the present invention.

Fig. 1 is a schematic diagram of main steps of an embodiment of a network data packet capturing method of an embedded system of the present invention. As shown in fig. 1, the packet capture method of the present embodiment includes steps S101 to S104:

step S101, data received and/or sent by a network layer is obtained.

Specifically, in the function of transmitting and/or receiving data of the network card, the original data of the network data frame is obtained by intercepting the data of the descriptor buffer area of the network card. Wherein, the original data mainly comprises: protocol family type of the network and user data, etc.

And step S102, filtering the data acquired from the network layer according to the type of the network protocol. And filtering the data content of the packet capture through the judgment of the network protocol type. Wherein the network protocol types include: one or more of TIPC, UDP and TCP.

And step S103, formatting the filtered data to obtain data in a target format.

In this embodiment, the target format is a PCAP format. Step S103 specifically includes: and adding a standard PCAP data head format in front of the filtered data to obtain the data in the PCAP format so as to conveniently view the data content by using a packet capturing tool on a desktop platform. The PCAP data header format comprises: the time of packet capturing, the length of the original data packet and the like.

And step S104, storing the data in the target format into a hard disk file by adopting a mechanism that the multi-level tasks correspond to the multi-level cache regions.

Specifically, for example, the tasks are divided into multiple levels of tasks according to the level of the tasks, and the tasks at different levels correspond to buffers at different levels, respectively. And after the processing of the previous-stage task is finished, processing the next-stage task. And when executing the next-level task, switching the data of the buffer corresponding to the previous-level task into the second-level buffer in a zero-copy manner, where zero-copy means that data is not copied, and only putting identification information (such as a storage address, an index identification, or an identification from which the data in the target format can be obtained) of the data in the target format into the buffer corresponding to the next-level task, and then writing information stored in the buffer into a file. The method is beneficial to preventing the influence on the acquisition of data or the network sending and receiving efficiency when the file is written.

Step S105, writing the identification information of the data in the target format into a hard disk file.

Example two

As shown in fig. 2, the network data packet capturing method of the embedded system of this embodiment includes steps S201 to S207:

step S201, data received and/or transmitted by the network layer is acquired.

Step S202, filtering the data acquired from the network layer according to the type of the network protocol. And filtering the data content of the packet capture through the judgment of the network protocol type. Wherein the network protocol types include: one or more of TIPC, UDP and TCP.

And step S203, formatting the filtered data to obtain data in a target format.

And step S204, executing a primary task, and adding the data in the target format into a primary buffer area. And adding the acquired data into a primary buffer queue in a primary task to prevent the loss of network data, wherein the task does not operate on the data.

Step S205, determining whether the primary task is completed. If yes, step S206 is executed, and if no, the process returns to step S204.

Step S206, executing a secondary task, and storing a storage address corresponding to the data in the target format in the primary buffer area into the secondary buffer area.

Step S207, writing the storage address corresponding to the data in the target format stored in the secondary buffer area into a file.

In this embodiment, a secondary task (a first-stage task, a second-stage task) and a secondary buffer (a first-stage buffer, a second-stage buffer) are provided, which is beneficial to preventing the data acquisition or the network transmission and reception efficiency from being affected when a file is written in. Therefore, the method and the device can realize stable and efficient network packet capturing without influencing the network receiving and sending rate, and can not only realize no packet loss, but also avoid the network speed from slowing down.

EXAMPLE III

Based on the packet capturing method provided in the first embodiment and the second embodiment, the present application further provides a network data packet capturing system of an embedded system, including:

an obtainingmodule 301, configured to obtain data received and/or sent by a network layer;

afiltering module 302, configured to filter data obtained from the network layer according to a network protocol type;

aformatting processing module 303, configured to format the filtered data to obtain data in a target format;

and thestorage executing module 304 is configured to store the data in the target format in a manner that multiple levels of tasks correspond to multiple levels of cache mechanisms. Wherein, tasks of different levels correspond to cache regions of different levels; the cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; and acquiring the target format data according to the identification information.

Wherein thestorage executing module 304 includes:

and the second storage execution submodule is used for storing the identification information of the data in the target format in the primary buffer area into a secondary buffer area in a secondary task after the primary task is processed.

Awriting module 305, configured to write the identification information of the data in the target format into a file.

Example four

The present application further provides a storage medium having a computer program stored thereon, wherein the computer program is configured to implement the steps of the method for packet capture of network data according to the first or second embodiment when executed by a processor.

In summary, compared with the closest prior art, the invention has the following beneficial effects: the invention provides a network data packet capturing method, a system and a storage medium of an embedded system. The cache region corresponding to at least one level of task stores complete data in a target format; the cache region corresponding to at least one level of task stores the identification information of the data in the target format; the target format data can be acquired according to the identification information; further, only the identification information of the data in the target format is written into the hard disk file. Under the condition of not influencing the network receiving and sending rate, the network packet capturing can be stable and efficient, and the packet loss can be avoided, and the network speed is not slowed down.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.