Summary of the invention
In view of this, the purpose of the embodiment of the invention is to provide communication protocol deciphering method and device, realizes the decoding of communication protocol in the link, for the data in the test communications link provide foundation.
For achieving the above object, the embodiment of the invention provides following technical scheme:
A kind of communication protocol deciphering method comprises:
From the data that collect, obtain Frame;
Detect the protocol characteristic information that whether comprises default communication protocol in the described Frame;
Determine the employed protocol type of data collected according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol.
Determine that according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol the employed protocol type of data collected is specially:
Calculate the data collect and the matching rate of described default communication protocol according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol;
Protocol type according to the definite data use that is collected of described matching rate.
Described default communication protocol is one, and the protocol type that uses according to the definite data that collected of described matching rate is specially:
If described matching rate reaches the matching threshold of described default communication protocol, then definite data of being gathered have been used the communication protocol of current preset.
Described default communication protocol is a plurality of, described according to detected Frame sum and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol calculates the data collect and the matching rate of described default communication protocol is specially:
Calculate the data collect and the matching rate of described each default communication protocol according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described each default communication protocol;
The described protocol type that uses according to the definite data that collected of described matching rate is specially:
Whether the matching rate of judging each communication protocol reaches the default matching threshold of each communication protocol;
From the communication protocol matching rate that has reached matching threshold, choose the communication protocol of the communication protocol of maximum matching rate correspondence as the described data use that collects.
Describedly from the data that collect, obtain Frame and comprise:
The speed of the data that detection collects judges whether this speed surpasses default rate-valve value;
The data that speed surpassed described rate-valve value are carried out the processing of branch frame, obtain Frame;
The data that speed surpassed described rate-valve value are shunted processing earlier, carry out the branch frame again and handle after shunting is handled, and obtain Frame.
Described protocol characteristic information comprises:
At least one particular value in the Frame;
Perhaps, the particular value of at least one ad-hoc location in the Frame.
A kind of communication protocol deciphering device comprises:
Memory cell is used to store the protocol characteristic information of default communication protocol;
Divide the frame device, be used for obtaining Frame from the data that collect;
Characteristic detection unit is used for detecting the Frame that described minute frame device obtain and whether comprises the protocol characteristic information of storing in the described memory cell;
Determining unit, the sum of Frame that is used for the sum of the Frame that detects according to described characteristic detection unit and wherein comprises the protocol characteristic information of described default communication protocol are determined the employed protocol type of data that collected.
Described determining unit specifically comprises:
The matching rate computation subunit is used for calculating the current detected data and the matching rate of described default communication protocol according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol;
Determine subelement, be used for the definite employed protocol type of data that is collected of matching rate that calculates according to described matching rate computation subunit.
The communication protocol of described cell stores is one, when the described matching rate that described definite subelement calculates in described matching rate computation subunit reaches described matching threshold, determines that the data that collect have used the agreement of current coupling.
The communication protocol of storing in the described memory cell is a plurality of, then:
Described matching rate computation subunit is used to calculate the matching rate of each communication protocol;
Described definite subelement is used for judging respectively whether the matching rate of each communication protocol reaches the default matching threshold of each communication protocol; From the communication protocol comparative result that has reached matching threshold, choose the communication protocol of the communication protocols of maximum matching rate correspondence as the described data use that collects.
Described device also comprises:
Rate detecting unit is used to detect the speed of the data that collected;
Shunt is used for that speed is surpassed the data of presetting rate-valve value and shunts processing earlier;
Described minute frame device is used for that also the data after the shunting processing are carried out the branch frame and handles.
Described device also comprises:
Subscriber interface module is used to receive the decoding configuration information that the user selects.
The decoding configuration information that described user selects comprises:
Inlet flow type, shunt type, branch frame device type and protocol characteristic information type.
Described protocol characteristic information comprises:
At least one particular value in the Frame;
Perhaps, the particular value of at least one ad-hoc location in the Frame.
As seen, in embodiments of the present invention, from the data that collect, obtain Frame; Detect the protocol characteristic information that whether comprises default communication protocol in the described Frame; Determine the employed protocol type of data collected according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol, by the method that the embodiment of the invention provided, under the situation that does not have the data details, decoded the communication protocol of using in the communication data, thereby can provide guidance for the setting of follow-up test parameter, and then from the data of transmission, find our needed information.
Embodiment
The embodiment of the invention provides communication protocol deciphering method and device, for making purpose of the present invention, technical scheme and advantage clearer, below with reference to the accompanying drawing embodiment that develops simultaneously, the present invention is described in further detail.
Referring to Fig. 1, in an embodiment of the present invention, realize that the method that the embodiment of the invention provided may further comprise the steps:
Step 101: from the data that collect, obtain Frame.
T1 and E1 are the standard with high-quality conversation and transfer of data, and wherein, the T1 standard is adopted in the North America, can support the transfer of data of 24 64Kbps, and Europe and China adopt the E1 standard, can support the transfer of data of 32 64Kbps.Transfer of data with the E1 standard in the embodiment of the invention is that example describes the method that the embodiment of the invention was provided.
When link adopts the data of E1 standard transmission,, can be divided into following several transmission means according to the speed needs:
Unframe, the form of no E1 standard frame, this form directly provides physical layer services, the carrying data content.
PCM30 uses the 1-30 time slot, the data content of carrying 64Kbps*30=1920Kbps speed.
PCM31 uses the 1-31 time slot, the data content of carrying 64Kbps*31=1984Kbps speed.
N*64Kbps uses 1 or N time slot in the 1-31 time slot, the data content of carrying 64Kbps*N speed.
The sub-slots mode, 1 64Kbps time slot can be divided into 8 sub-slots, can use 1 or n sub-slots in 8 sub-slots, the data content of carrying n*8Kbps speed.For example, need 16Kbps speed, then take 2 sub-slots; Need 32Kbps speed, then take 4 sub-slots.
No matter adopt which kind of mode that data are transmitted, the data flow in each transmission channel all is continuous 0 and 1 binary data, and the content of practical communication is to be encapsulated in the Frame of link layer.Generally speaking, some are pre-specified by 0 and 1 filler of forming in transmission in the link, and for example the filler in the ABIS signaling HDLC agreement is 01111110 and continuous 51 afterwards one 0.Only in needs, just have Frame and occur, that is to say the Frame that all is by the data in the data flow of each transmission channel with and filler form.
Because the content of practical communication is to be encapsulated in the Frame of link layer, can recognize Content of Communication so Frame need be extracted just from data flow, divide frame to handle and from data flow, extract Frame exactly.
When carrying out the processing of branch frame,, reject filler wherein, for example,, reject the branch frame symbol 01111110 of wherein filling, and remove continuous 51 bits 0 afterwards ABIS signaling HDLC agreement by the content of detected transmission channel data stream.Extract Frame, thereby form data frame stream.Because this moment and do not know detected data whether really be exactly employing be ABIS signaling HDLC agreement, so current way just comes the current agreement that data adopted is decoded according to known agreement.
In other embodiments, be specially from the data that collect, obtaining Frame:
The speed of the data that detection collects judges whether this speed surpasses default rate-valve value;
The data that speed surpassed described rate-valve value are carried out the processing of branch frame, obtain Frame;
The data that speed surpassed described rate-valve value are shunted processing earlier, carry out the branch frame again and handle after shunting is handled, and obtain Frame.
Some communication protocol is transmitted data with special speed, and is more effective accurately in order to make detection, can shunt processing to the data of gathering according to the agreement characteristics of prediction in certain embodiments.
The shunting processing procedure can be divided into the data flow of 1 64Kbps n channel data stream of sub-slots mode.
For example in the data flow of 1 64Kbps, the dividing mode of sub-slots is: each byte is totally 8 bits, is numbered as 0-7, and reference numeral is that the speed of 0-7 is 8 sub-slots of 8K.
16Kbps speed need take two sub-slots, and for example 0,1 or 2,3 or 4,5 or 6,7.
32Kbps speed need take 4 sub-slots, and for example 0,1,2,3 or 4,5,6,7.
Be treated to example with the 16Kbps shunting, its course of work is earlier the bit of 2 sub-slots of each byte correspondence in the 64Kbps data flow to be taken out, get up by arriving the sequencing assembly unit then, promptly the byte of 4 64Kbps data flow can be extracted the 16K data flow of 1 byte.It is the channel data stream of 16Kbps that data form speed after by assembly unit.
Data after the shunting are carried out frame processing in aforesaid minute more just can obtain Frame, thereby form data frame stream.
Step 102: detect the protocol characteristic information that whether comprises default communication protocol in the described Frame.
The effect of described protocol characteristic information is to comform to distinguish a certain agreement in the multi-communication protocol, and described protocol characteristic information can be at least one particular value in the described Frame, or the particular value of at least one ad-hoc location in the described Frame.
For example the characteristics of IP agreement are that the existence value is the byte of 16 system 0x45 in Frame, if so when decoding the IP agreement, can adopt particular value in the Frame as protocol characteristic information, this particular value is that value is the byte of 16 system 0x45.Accordingly, described detection is that search value is the IP packet header flag byte of the byte of 16 system 0x45 from the Frame frame head.
The characteristics of ABIS signaling are that preceding 6 of Frame first byte are specific bit value (scope 0-63), comprising feature 0 (ordinary signaling) and 63 (managing signalings).The particular value that can adopt ad-hoc location when decoding the ABIS signaling is as protocol characteristic information, and is corresponding, and described detection is whether preceding 6 of detection Frame first byte have particular value.
Step 103: determine the employed protocol type of data collected according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol.
In one embodiment, the sum of Frame of at first adding up the sum of detected Frame and wherein comprising the protocol characteristic information of described default communication protocol is determined the data of current collection and the matching rate of described default communication protocol then.
For example, protocol characteristic information corresponding to certain communication protocol, suppose that total Frame of gathering is 1000 frames, and the Frame that wherein comprises described protocol characteristic information is 945 frames, so, matching rate between the data of current collection and the described communication protocol is 945/1000=0.945, and promptly matching rate is 94.5%.
Obtain after the matching rate, the matching threshold that matching rate and this communication protocol are preset compares, if surpassed matching threshold then think that the data of current collection are the communication protocol that has adopted this protocol characteristic information correspondence.
Still continue to use top example, after the matching rate of data that obtain current collection and current communication protocol is 94.5%, the matching threshold of this matching rate and current communication protocol is compared.The matching threshold of supposing current communication protocol is 90%, so obviously, can determine that the current data that collect have used described communication protocol.
By the method that the embodiment of the invention provided, the transmission data of originally knowing nothing are carried out agreement to be decoded, thereby realized data link configuration situation is carried out detailed understanding, further extracted needed information exactly the data condition is provided from transmission for follow-up.
In actual applications; adopt the protocol characteristic information of a plurality of communication protocols that the data that collect are detected through regular meeting; referring to Fig. 2; with three pairing protocol characteristic information of communication protocol the data that collect being detected in the embodiment of the invention is example, and the situation that multi-communication protocol detects is described.For convenience, described three features protocol are first agreement, second agreement and the 3rd agreement respectively, and the pairing protocol characteristic information of each communication protocol is the first protocol characteristic information, the second protocol characteristic information respectively, and this method specifically comprises:
Step 201: detect the transmission rate of the data flow of gathering, judge that whether it surpasses rate-valve value, if do not surpass, then enters step 203; If surpass, then enter step 202.
Step 202: the data that collect are shunted processing, enter step 203 after shunting is finished dealing with.
Step 203: the data that collect are carried out the branch frame handle, obtain Frame.
Step 204: the protocol characteristic information according to first agreement, second agreement and the 3rd agreement detects described Frame respectively.
For convenience of description, in the Frame that is detected, the frame number that comprises the first protocol characteristic information of first agreement is designated as the first agreement frame number, accordingly, the frame number that comprises the second protocol characteristic information of second agreement is designated as the second agreement frame number, corresponding to the 3rd agreement, the 3rd agreement frame number is arranged.
Step 205: the totalframes that statistics detects, and add up the first agreement frame number, the second agreement frame number and the 3rd agreement frame number respectively.
Step 206: the matching rate that calculates data and described first agreement, second agreement and the 3rd agreement of current collection respectively.
With similar in the previous embodiment, the calculating of described matching rate is: the totalframes with the described first agreement frame number, the second agreement frame number and the 3rd agreement frame number and the statistics of adding up is divided by respectively, the value that obtains is the matching rate of the current data that collect and described first agreement, second agreement and the 3rd agreement, is designated as first matching rate, second matching rate and the 3rd matching rate respectively.
Step 207: judge that whether work as first three matching rate reaches each communication protocol preset threshold value, chooses the pairing communication protocol of maximum matching rate as the employed communication protocol of the data of current collection from the matching rate that reaches predetermined threshold value.
For example, suppose that described first matching rate is 85%, second matching rate is that the 95%, the 3rd matching rate is 90%, and the matching threshold of three communication protocols is 90%, that is to say that so second matching rate and the 3rd matching rate have reached matching threshold, and second matching rate is greater than the 3rd matching rate, so, determine that the second communication agreement is the communication protocol that the data of current collection are used.
Certainly, if second matching rate and the 3rd matching rate are very approaching, for example second matching rate is that the 95%, the 3rd matching rate is 95.5%, can further increase the Additional Agreement characteristic information at the characteristics of second communication agreement and third communication agreement so second communication agreement and third communication agreement are done further differentiation; Certainly, also can determine that third communication agreement is the communication protocol of the data use of current collection according to getting maximum principle.
By the method that the embodiment of the invention provided, carrying out agreement under the situation of not transmitting data configuration situation particulars decodes, thereby realized data link configuration situation is carried out detailed understanding, further extracted needed information exactly the data condition is provided from transmission for follow-up.
Embodiment is corresponding with method, and the embodiment of the invention also is provided for the device that agreement is decoded, and referring to Fig. 3, this device comprises:
Memory cell 301 is used to store the protocol characteristic information of default communication protocol.
Described protocol characteristic information comprises: at least one particular value in the Frame; Perhaps, the particular value of at least one ad-hoc location in the Frame.
Divide frame device 302, be used for obtaining Frame from the data that collect.
Characteristic detection unit 303 is used for detecting the Frame that branch frame device obtains and whether comprises the protocol characteristic information of storing in the memory cell.
Determining unit 304, the sum of Frame that is used for the sum of the Frame that detects according to characteristic detection unit and wherein comprises the protocol characteristic information of described default communication protocol are determined the employed protocol type of data that collected.
In one embodiment, described determining unit concrete 304 comprises:
Matching rate computation subunit 3041: be used for calculating the current detected data and the matching rate of described default communication protocol according to the sum of detected Frame and the sum of Frame that wherein comprises the protocol characteristic information of described default communication protocol:
Determine subelement 3042, be used for the definite employed protocol type of data that is collected of matching rate that calculates according to described matching rate computation subunit.
When only having stored the protocol characteristic information of a communication protocol in the described memory cell 301, described definite subelement 3042 is specially:
Judge whether the subelement that described matching rate calculates reaches default matching threshold;
When described matching rate reaches described matching threshold, determine that then the data that collect have used the agreement of current coupling.
When the protocol characteristic information of having stored in the described memory cell 301 more than a communication protocol, described matching rate computation subunit 3041 is used to calculate the matching rate of each communication protocol;
Described definite subelement 3042 is used for judging respectively whether the matching rate of each communication protocol reaches the default matching threshold of each communication protocol; From the communication protocol comparative result that has reached matching threshold, choose the communication protocol of the communication protocols of maximum matching rate correspondence as the described data use that collects.
In one embodiment, device shown in Figure 3 also comprises:
Rate detecting unit 305 is used to detect the speed of the data that collected.
Shunt 306 is used for speed is shunted processing earlier above the data of described rate-valve value.
Described minute frame device 302 is used for that also the data after the shunting processing are carried out the branch frame and handles.
Decode device by the agreement that the embodiment of the invention provided, the transmission data of originally knowing nothing are carried out agreement to be decoded, data link configuration situation is carried out detailed understanding, further extract needed information exactly the data condition is provided from transmission for follow-up.
Fig. 4 is the structural representation of a kind of agreement decoding device that the embodiment of the invention provided, and this agreement is decoded device based on given frame form, link protocol, upper-layer protocol, carries out many combined tests, is that criterion is carried out the agreement decoding with the optimum Match rate.
Wherein, test point 401 can be the test binding post that is used for the E1 standard, uses the mode of high-ohmic cross-connection to be connected with the coaxial cable connecting line; Also can be the mirror port that is used for SDH (Synchronous Digital Hierarchy) (SDH) transmission equipment, be connected with connection line of optic fibre.This dual mode all can be drawn tested physical signalling, is linked in the test card.
The test integrated circuit board 402 can with on the coaxial line and optical fiber in signal extraction come out, after amplifying, be reduced to digital signal, and according to the corresponding transmission protocol of E1 or SDH, therefrom decode the 2M physical layer frame of E1, and, press configuration requirement according to the standard of E1, get access to the data flow that has stream identification.
Stream identification comprises: plate card number, E1 number, timeslot number, sub-slots number or use plate card number+numbering.
Subscriber interface module 403 is used to receive the input item that the user selects, and shows test results to the user.
Wherein, the user imports options and comprises:
1, inlet flow combination, for integrated circuit board configuration module 409 provides may making up of inlet flow, it is link transmission manner on E1, comprise: E1 is that 1 Unframe, E1 are that PCM30 uses entirely, E1 is that PCM31 uses entirely, use 31 64K among the E1, if not above-mentioned possibility situation, can carry out craft and select configuration E1.Can select not use integrated circuit board in addition, only be to use a data log file to analyze.
2, shunt combination selection comprises and does not use shunt, 8K shunt, 16K shunt, 32K shunt, and configuration is not above-mentioned situation as E1, can manual configuration specify the sub-slots shunt.
3, divide frame device combination selection, comprise and do not use a minute frame device, HDLC to divide frame device, ABIS 40 minutes frame devices, NotelTrunk to divide frame device etc.
4, agreement assessor combination selection comprises not use agreement assessor, GSM voice assessor, ABIS signaling assessor, GPRS Abis assessor, ppp protocol assessor, FR agreement assessor, CiscoHDLC agreement assessor, IP bag assessor etc.
5, the E1 quantity of every batch processing.If a plurality of E1 are analyzed,, limit the E1 quantity of every batch processing based on the consideration of performance.When for example SDH155M analyzed, totally 63 E1 can 4 E1 of every batch processing, 16 batches of coprocessing.
6, every layout detects the time that needs, and generally is unit with the second.
Fig. 5 is that surface chart is selected in the input of decoding device shown in Figure 4.
Shunt module 404 makes up the data of gathering are shunted processing according to the shunt that receives from subscriber interface module.
Divide frame device module 405, according to the branch frame device combination that receives from subscriber interface module the data after shunting are carried out the branch frame and handle, certainly, handle if the data that collect need not shunting, frame device module was directly carried out the processing of branch frame to the data that collect in so described minute, obtained Frame.
Agreement assessor module 406, the Frame of receiving according to the protocol characteristic information butt joint of self storing detects, and calculates matching rate.Determine according to matching rate whether this data frame stream has used the communication protocol that self detects.
From the function of agreement assessor module as can be known, the described agreement assessor of Fig. 4 is corresponding with detection module and determination module in the described device of Fig. 3.
Detect control module 407, select, call integrated circuit board configuration module configuration integrated circuit board according to the user who receives from subscriber interface module 403; Call shunt, divide frame device, agreement assessor module, create corresponding objects on data stream and carry out the corresponding function processing, and generate test result; Produce batch, layout, control carrying out automatically of whole process; According to testing result, generate the integrated circuit board test profile automatically.
Data recordin module 408 is used to write down input, the output content of each module, and can show that the content to being write down shows; The record data content.
Wherein, the input of each module of record, output content such as inlet flow show, shunt output shows, divides the frame device to export and shows, agreement assessor output Presentation Function is exactly the content that has shown in the corresponding record device.
And the data content of record comprises content frame that frame number, length, 16 systems show, the frame bias internal amount indication checked for convenient branch etc.
In order to carry out the integration test of ABIS, actually needing to determine that or E1 goes up the passage 16K 32K or the 64K of ABIS signaling link, this passage is to be positioned at which time slot, which sub-slots.Form testing the configuration of integrated circuit board according to above-mentioned information, the test integrated circuit board obtains the ABIS signaling data that transmits on each passage according to configuration again, carries out the analytic statistics of ABIS signaling data at last.When whether operator is difficult for providing link configuration data that link configuration data or needs checking provide correct, can use device shown in Figure 4 to carry out the decoding of upper-layer protocol and coded system.
Known ABIS signaling link speed is 64K, 32K or 16K.
User shown in Figure 5 select option can for:
Integrated circuit board is selected SDH155M test card, totally 63 E1;
20 seconds detection times of every layout;
Every batch is detected 4 E1;
The inlet flow combination only selects to use among the E1 31 64K (can not be again high speed);
The combination of sub-slots shunt is selected 16K shunt, 32K shunt and is not used three kinds of shunts;
Divide the combination of frame device, only select HDLC to divide the frame device a kind of;
The combination of agreement assessor only selects ABIS signaling assessor a kind of.
ABIS signaling assessor is differentiated the LAPD underlying protocol of ABIS, by in Frame, extracting preceding 6 bit values (scope 0-63) of first byte, it is the SAPI parameter of LAPD agreement regulation, compare with the feature 0 (ordinary signaling) and 63 (managing signalings) of ABIS signaling regulation, these two kinds in this way, think that the match is successful, otherwise think failure.And, The above results is added up.
After beginning to detect, move 16 batches, every batch of 3 layouts, every layout 20 seconds amounted to after 960 seconds, drew testing result.
After drawing testing result, use from testing result and generate the integrated circuit board configuration feature, generate E1 and link configuration file on this SDH155M automatically.
With above-mentioned configuration file, pass to the acquisition module of other monitoring arrangement, acquisition module uses this configuration, reads in data from corresponding integrated circuit board, carries out the ABIS monitoring signaling.
According to the practical application needs, above-mentioned each functional module can combination in any, and various combinations all do not influence the realization of the embodiment of the invention.
By the device that the embodiment of the invention provided, be the basis according to existing frame format, link protocol, upper-layer protocol, carry out many combined tests, be that criterion is carried out the agreement decoding with the optimum Match rate, for follow-up processing to data provides configuration information.
The present invention can describe in the general context of the computer executable instructions of being carried out by computer, for example program module.Usually, program module comprises the routine carrying out particular task or realize particular abstract, program, object, assembly, data structure or the like.Also can in distributed computing environment (DCE), put into practice the present invention, in these distributed computing environment (DCE), by by communication network connected teleprocessing equipment execute the task.In distributed computing environment (DCE), program module can be arranged in the local and remote computer-readable storage medium that comprises memory device.
The above only is a preferred implementation of the present invention; should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.