A kind of analytic method of network packet
Technical field
The present invention relates to a kind of method and apparatus of novel parsing network packet, relate in particular to a kind of analytic method and device for the complex data bag under large flow.
Background technology
Procotol minute different levels is usually developed, and every one deck is responsible for respectively different communication functions.As shown in Figure 1, according to the OSI architecture, the packet on network has been divided into to seven layers, physical layer, data link layer, network layer, transport layer, session layer, presentation layer, application layer.According to another architecture TCP/IP, the packet on network is divided into to 4 layers, comprise data link layer, network layer, transport layer, application layer.TCP/IP itself is also the combination of one group of a plurality of agreement on different levels.No matter be OSI, TCP/IP or other network models, all carry out layering by the packet on network.The output of every one deck is all the input of lower one deck, and every one deck carries out this layer protocol encapsulation (or opening) to the output data of last layer and afterwards, re-sends to lower one deck and go.
Parsing to network packet is exactly, demand according to current network equipment, packet is started successively up to resolve from bottom, until find certain layer, in this process, can obtain the relevant information of resolved layer protocol according to agreement, can to packet, carry out various operations according to these information.Because the every one deck of network packet has all comprised more than a kind of agreement, thus the parsing of network packet, be that various layers are resolved on the one hand, be the parsing to the same layer different agreement on the other hand.
It is one of basic function of various network device that packet is resolved, and is widely used in various types of communication terminal and transmission equipment, as network interface card, and router, fire compartment wall, shunting device, the various product scopes such as network acceleration card.The difference in field, also different to the requirement that packet is resolved.Some network equipments require packet is resolved to application layer, and some network equipments only need to be resolved to link layer by packet.
Parsing to network packet has parsing and the hardware based parsing based on software.From hardware device, classify, the parsing of network packet has based on traditional C PU, NP (Network Processor, be network processes), ASIC (being special chip), FPGA (Field Programmable Gate Array, i.e. FPGA (Field Programmable Gate Array) gate array) etc.
Parsing thought classification from network packet, have serial resolution data bag and two kinds of methods of parallel resolution data bag.
Based on NP resolution data bag, it is typical case's application of serial resolution data bag method.NP, when the resolution data bag, owing to adopting serial structure, can only carry out unique operation to a packet at synchronization, only, after current operation completes, just can carry out next step operation to this packet, or next packet is operated.Adopt serial approach resolution data bag, on the deep analysis packet, there is advantage, by programming, just can reach the deep analysis to packet, but because moment of serial structure can only be carried out once-through operation, so in the packet access situation of large flow, the parsing network packet that is difficult to accomplish linear speed.
Based on FPGA resolution data bag, it is typical case's application of parallel resolution data bag method.Adopt parallel method resolution data bag, parallel analytic method, often adopt a plurality of analytical capabilities modules to operate simultaneously, reach in the same moment, can do simultaneously multi-mode operation to packet, or a plurality of packets are done to multi-mode operation, can reach maximal efficiency to the parsing of packet.Therefore in massive dataflow bag access situation, also can easier reach linear speed resolution data bag, but owing to adopting multioperation synchronously to carry out, and all packets all can pass through identical operation, therefore the deep analysis ability is poor, underaction, and the packet kind that can resolve is less.
Along with the development of network, the protocol type of network packet is also increasing, and on the data with existing package level, has increased on the one hand the agreement of many newtypes, is between tradition stratum on the one hand, new data Layer occurred.Simultaneously, due to the development of optical fiber technology and the communication technology, the data traffic on network, also in continuous increase, therefore, is resolved the Capability Requirement of network packet also in raising greatly to the network equipment now.
Obviously, along with the development of technology, namely can resolve network packet by linear speed in the urgent need to a kind of, can support to resolve again the method for most of data pack protocols.
Summary of the invention
For the existing problem and shortage of above-mentioned parsing network packet method, the purpose of this invention is to provide a kind of analytic method and device of network packet.Method of the present invention can, under the prerequisite that guarantees linear speed resolution data bag, be supported to resolve the multiple types of data bag, and, after novel agreement occurring afterwards, can realize seamless upgrade to greatest extent.
The present invention is achieved in that a kind of analytic method of network packet, comprises the following steps:
1) according to the current network environment, the parallel network packet device of resolving of configuration, according to demand, call each standard agreement parsing module, and it is connected into to the Data Analysis chain
2) by the data access on circuit, by ASIC (Application Specific Integrated Circuit, be application-specific IC) complete the parsing of physical layer, serial data data stream separation on network is become to the packet of data link layer, send into the packet resolver with the form of parallel data stream
3) by the packet access data analytic thread of data link layer, according to configuration, can learn the protocol type of current data link layer, according to the data link layer protocol type, the data inclusion be processed and deposited rear output
4) according to data link layer protocol, extract the relevant information that current data packet is positioned at data link layer packet header, with the data inclusion after data link layer is resolved, synchronize and export
5) packet after the data link layer parsing is carried out to the parsing of MPLS (MultiProtocol Lable Switch, i.e. multiprotocol label switching) layer, output after according to the MPLS related protocol, the data inclusion being processed
6), according to MPLS layer related protocol, extract the relevant information in MPLS layer packet header, and, through resolving the relevant information that obtains the packet current layer, synchronize and export with the data inclusion after the MPLS layer is resolved
7) enter subsequently network layer and resolve, according to network layer protocol, packet is carried out the protocol analysis of network layer, according to the agreement of network layer, the data inclusion is processed to rear output
8), according to network layer protocol, extract the relevant information that current data packet is positioned at network layer packet header, and, through resolving the packet information that obtains out current layer, synchronize and export with the data inclusion after network layer is resolved
9) enter transport layer and resolve, according to transport layer protocol, packet is carried out the protocol analysis of transport layer, according to the agreement of transport layer, the data inclusion is processed to rear output
10), according to transport layer protocol, extract the relevant information that current data packet is positioned at transport layer packet header, and, through resolving the packet information that obtains out current layer, synchronize and export with the data inclusion after transport layer is resolved
Further, the parsing to packet comprises described each layer protocol parsing module according to agreement, and relatively whether each floor load of current data inclusion meets this analysis protocol number.
Further, the parsing to packet also comprises described each layer protocol parsing module according to agreement, according to protocol specification, extracts relevant information from the current layer header.
Further, processing to packet comprises described each layer protocol parsing module according to agreement, if the agreement of the layer that the input packet is current is consistent with analysis protocol, according to current consensus standard, extract the partial information in current layer packet header, find out simultaneously the current layer load, namely the accurate original position at former data inclusion of last layer, be not inconsistent if input agreement and the analysis protocol of packet current layer, can the resolution data bag, just relevant information is only deposited to rear output.
Further, the processing to packet also comprises described each layer protocol parsing module according to agreement, and former data inclusion is only done and deposited rear output.
Further, described each layer protocol parsing module comprises according to the relevant information in the current layer packet header of agreement extraction, current layer packet header exact length, the protocol type of current layer load (being last layer).
Further, described each layer protocol parsing module comprises through resolving the packet information that obtains current layer, the accurate zero-time of current layer load, the accurate original position in the parallel data inclusion of current layer load, the concrete agreement of current layer load.
A kind of resolver of network packet comprises:
The Data Analysis chain, comprise each standard agreement analyzing sub-module, series connection by individual standard agreement analyzing sub-module, be linked to be a data analytic thread, the Data Analysis chain can be all the flowing water work simultaneously of standard agreement analyzing sub-module, only need the disposal ability of each standard agreement analyzing sub-module can reach linear speed, whole Data Analysis chain just can reach the linear speed of network packet is processed;
The data link layer parsing module, one of standard agreement parsing module, complete the protocol analysis of packet volume data link layer, comprises the original position of finding out the data link layer load, obtain the concrete agreement of data link layer load, simultaneously these information and date inclusions are synchronously exported;
MPLS layer parsing module, one of standard agreement parsing module, complete the protocol analysis of data inclusion MPLS layer, comprises the original position of finding out the load of MPLS layer, obtains the concrete agreement of MPLS layer load, simultaneously these information and date inclusions synchronously exported;
The network layer parsing module, one of standard agreement parsing module, complete the protocol analysis of packet volume grid layer, comprises the original position of finding out the network layer load, obtains the concrete agreement of network layer load, simultaneously these information and date inclusions synchronously exported;
The transport layer parsing module, one of standard agreement parsing module, complete the protocol analysis of data inclusion transport layer, comprises the original position of finding out the transport layer load, obtains the concrete agreement of transport layer load, simultaneously these information and date inclusions synchronously exported;
The present invention is by connection that each standard agreement analyzing sub-module is contacted, form a data analytic thread, and all standard agreement submodules are all in concurrent working, thereby reach the network packet of labyrinth is successively resolved on the one hand, guaranteed again on the other hand the linear speed to network packet.The present invention simultaneously or the device of an opening, can in existing Data Analysis chain, add meet New Deal the standard agreement analyzing sub-module, thereby reach the correct parsing to the New Deal packet.
Compared with prior art, good effect of the present invention is:
Analytic method of the present invention can be realized the linear speed of network packet is resolved, and can support to greatest extent to resolve the multiple types of data bag simultaneously, and along with the novel agreement constantly occurred later, the present invention can realize seamless upgrade.
The accompanying drawing explanation
Fig. 1 is osi model data processing structure schematic diagram;
Fig. 2 is data processing structure schematic diagram of the present invention;
Fig. 3 is Data Analysis chain structure schematic diagram of the present invention;
Fig. 4 is the interface schematic diagram of standard agreement analyzing sub-module of the present invention;
Fig. 5 is standard agreement analyzing sub-module inter-process flow chart of the present invention.
Embodiment
Below in conjunction with drawings and embodiments, the present invention is explained in further detail:
As shown in Figure 2, at first to the packet access, by fore device, the ground floor of complete paired data bag, the i.e. parsing of physical layer immediately.In physical layer, transmission be all the signal of telecommunication or light signal, although comprised all data inclusion contents, these signals are all passing to the other end from an end of high speed serialization.The present invention does not comprise the network packet of physical layer is resolved the parsing of network packet.Directly by the chip of asic chip or user's design voluntarily, the physical layer of network packet is resolved, the data inclusion is resolved to data link layer by physical layer, the data inclusion be take to bag and be unit, complete from serial bit stream, extracting.But these front-end chips must meet relevant protocol type, these protocol types are according to different transmission network bandwidths, and network routing device, switch are different.
Entering parallel packet of resolving the network packet device, is that to wrap be unit, and with the access of parallel bus pattern, and the flow of packet determines by packet highway width and the frequency of access, and 2 multiply each other is the data packet flow of access.
Due to access to plant is the parallel data stream according to frequency change, therefore also need several signals by each packet from parallel continuously data flow, identifying and separate, these signals comprise: SOP (Start of Packet, be the start mark of packet), the original position that means packet, when this signal is effective, mean that the parallel data stream of current time is the beginning of this packet; EOP (End of Packet, the i.e. end mark of packet), the end position of expression current data packet, when this signal is effective, mean that the parallel data road stream of current time is the ending of packet; And between SOP and EOP, be exactly the inclusion content of packet.
As shown in Figure 3, before the packet access device, can, according to the data pack protocol kind that will support, according to the network packet hierarchical structure, each standard agreement analyzing sub-module be connected into to a data analytic thread.
As shown in Figure 4, the signal of each standard agreement analyzing sub-module is all consistent, therefore also be free to be connected into the Data Analysis chain, and, in case need, support New Deal, only need, in existing Data Analysis chain, according to the residing level of New Deal, insert the protocol analysis submodule that meets interface standard and get final product.
As shown in Figure 3, because being has adopted cascaded structure, therefore protocol analysis submodule of every increase in analytic thread, the packet kind that the Data Analysis chain can be resolved will double.And because each protocol analysis submodule is concurrent working, therefore as long as its minimum disposal ability reaches linear speed, whole Data Analysis chain just can be resolved packet by linear speed.
Parallel data stream, together with SOP, in the parameter synchronization access data analytic threads such as EOP, at first enters the data link layer parsing module.Due to before incoming data stream, specified the protocol type of data link layer, therefore, at first module can find according to SOP the original position of data link layer packets, secondly according to the data link layer package head format, find out the protocol type of data link layer load, by signal pr_1, export, simultaneously according to known data link layer packet header length, find out data link layer load original position, by output signal cut_lab_1=1, mark the initial time of load, by output signal cut_start_1, mark the accurate initial bit loaded in parallel data stream, finally the data flow of access module and above-mentioned signal and SOP and EOP are synchronizeed and exported.
Data flow and resolved hierarchical information from data link layer parsing module output, input MPLS layer parsing module, mpls protocol is independent of between data link layer and network layer.At first the MPLS module will input protocol number pr_1 and mpls protocol comparison, if inconsistent, illustrate that the packet current layer is not MPLS layer data bag, will be from the parameter signal pr_1 of up-stream module (data link layer parsing module), cut_lab_1, the value of cut_start_1 remains untouched and deposits to pr_2, cut_lab_2, cut_start_2, together with overall data bag starting and ending position, data flow is synchronously output together.If consistent, illustrate that input packet current layer is MPLS layer data bag, by cut_lab_1, cut_start_1, the MPLS parsing module can accurately be found out the accurate original position of MPLS, according to mpls protocol, can find out on the one hand accurate zero-time and the original position of its load, by cut_lab_2, cut_start_2 output, on the one hand, by configuration, can learn the protocol type of MPLS load, by pr_2, export.Finally, the data flow of access module is deposited afterwards and export simultaneously with above-mentioned signal.
Data flow and resolved hierarchical information and enter subsequently the network layer parsing module.The network layer parsing module will input agreement pr_2 and network layer protocol number compares, if inconsistent, illustrate that the packet current layer is not network layer, therefore will be from the protocol signal pr_2 of up-stream module (MPLS parsing module), cut_lab_2, cut_start_2, remain untouched and deposit to pr_3, cut_lab_3, cut_start_3, with packet original position and end position, synchronization of data streams output.If consistent, illustrate that input packet current layer is the packet of network layer, therefore, pass through cut_lab_2, cut_start_2 can find accurate zero-time and the original position of network layer, on the one hand, and according to network layer protocol, can, from network layer packet header, obtaining network layer load protocol type, export by signal pr_3; On the one hand, can be from network layer packet header, obtaining the concrete length in network layer packet header, and, according to length, find out accurate zero-time and the original position of network layer load, and by signal cut_lab_3, cut_start_3 output; Finally, the data flow of access module is synchronizeed and exported with above-mentioned signal.
Data flow and resolved hierarchical information and finally enter the transport layer parsing module.The transport layer parsing module will input agreement pr_3 and transport layer protocol number compares, if inconsistent, illustrate that the packet current layer is not transport layer, therefore will be from the protocol signal pr_3 of up-stream module (network layer parsing module), cut_lab_3, cut_start_3, remain untouched and deposit to pr_4, cut_lab_4, cut_start_4, with packet original position and end position, synchronization of data streams output.If consistent, illustrate that input packet current layer is the packet of transport layer, therefore, by cut_lab_3, cut_start_3 can find accurate zero-time and the original position of transport layer, then according to the transport layer packet header length from obtaining transport layer packet header, accurately mark zero-time and the original position of transport layer load, by signal cut_lab_4, cut_start_4 output, synchronization of data streams last and access module is exported.
By said process, apparatus of the present invention have just completed once complete parsing to packet, and packet is output after resolving, and transfers to follow-up device and be further processed.In apparatus of the present invention, due to the operation of each standard agreement submodule independent parallel, so the above operating process all can move at synchronization, improved the ability of linear speed handle packet.And the present invention is the device of an opening, can hold standard compliant New Deal analyzing sub-module, as Fig. 4, shown in Figure 5.And can, without the adding or reduce the standard agreement analyzing sub-module of any obstacle, bring great convenience to the user on the data with existing analytic thread.