CN103888449A - Method and device for packet reassembly - Google Patents
Method and device for packet reassembly Download PDFInfo
- Publication number
- CN103888449A CN103888449A CN201410079548.XA CN201410079548A CN103888449A CN 103888449 A CN103888449 A CN 103888449A CN 201410079548 A CN201410079548 A CN 201410079548A CN 103888449 A CN103888449 A CN 103888449A
- Authority
- CN
- China
- Prior art keywords
- tcp
- message
- fragment message
- chain table
- tcp session
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Computer And Data Communications (AREA)
Abstract
The invention provides a method and device for packet reassembly. The method comprises the steps of receiving a TCP fragmentation message of a HTTP message, determining a TCP session to which the HTTP message belongs according to a source IP, a target IP and a source port of the TCP fragmentation message; calculating a Hash keyword of the TCP session according to the Hash function, and linking the received TCP fragmentation message to a Hash chain table of the established TCP session according to the sequence of message serial numbers; conducting HTTP packet reassembly according to the Hash chain table corresponding to the TCP session when all TCP fragmentation messages of the TCP session are received. Therefore, the method and device for packet reassembly can solve the problem in the prior art that reassembly efficiency of the TCP fragmentation message is low.
Description
Technical field
The application relates to networking technology area, particularly relates to a kind of message recombining method and device.
Background technology
HTTP GET message is for obtaining the data message on server, therefore, at present when large data processing, major part is by filtering TCP80(TCP agreement+destination interface 80) the HTTP GET message of port, and then the HTTP GET message filtering is analyzed to understand user's demand.But TCP fragment message amount accounts for 15%-23% in HTTP GET message, want to obtain complete HTTP GET message, just need to recombinate to the TCP fragment message in the HTTP GET message receiving.
At present, TCP recombination method is normally monitored the total data of whole connection procedure in TCP transmitting procedure, and three-way handshake connects, and 4-Way Handshake disconnects.When intermediate conveyor data, because the TCP sequence number of each message meets certain ordinal relation, carry out the restructuring of TCP according to the TCP sequence number of each message.Be equivalent to a cloth bag, in the time receiving TCP three-way handshake, open cloth bag, then each message is put into cloth bag, receive when 4-Way Handshake disconnects, tie cloth bag, on this basis, in the time that TCP fragment message is recombinated, on the one hand, need to search the source IP and the object IP corresponding with the source IP of TCP fragment message of TCP fragment message, to determine corresponding TCP session; On the other hand, the TCP fragment message of each intermediate conveyor all needs repeatedly to compare the source IP and the object IP corresponding with the source IP of TCP fragment message of same TCP session, if the TCP fragment message of transmission belongs to this TCP session, the TCP fragment message of receiving is preserved; Until the whole end of transmissions of TCP fragment message, and then sort according to the TCP sequence number of each TCP fragment message, the TCP message after final output restructuring.
Visible, existing TCP recombination method is in TCP regrouping process, by traveling through multiple TCP sessions, search the source IP and the object IP corresponding with the source IP of TCP fragment message of TCP fragment message, and, in regrouping process, need multiple TCP fragment messages of the same TCP session of frequent comparison, therefore cause TCP recombination efficiency low.
Summary of the invention
The application provides a kind of message recombining method and device, to solve the low problem of TCP fragment message recombination efficiency in prior art.
In order to address the above problem, the application discloses a kind of message recombining method, comprising:
Receive the TCP fragment message of HTTP message, determine the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port;
Calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected to according to test serial number daisy chaining in the ltsh chain table of the described TCP session of having set up;
When receiving after whole TCP fragment messages of described TCP session, carry out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
Preferably, the described Hash key that calculates described TCP session according to hash function, is connected to according to test serial number daisy chaining the described TCP fragment message receiving in the ltsh chain table of the described TCP session of having set up, and comprising:
Calculate the Hash key of described TCP session according to hash function;
Judge the Hash key that whether has had described TCP session in described ltsh chain table;
If exist, the TCP fragment message receiving be inserted into according to test serial number order in the ltsh chain table of described TCP session;
If do not exist, in described ltsh chain table, insert the Hash key of described TCP session, and the described TCP fragment message receiving is linked in the ltsh chain table of described TCP session corresponding to the described Hash key of insertion.
Preferably, after the step of the described TCP fragment message that receives HTTP message, also comprise:
Utilize the TCP fragment message of circulation array storing received to described TCP session.
Preferably, utilize circulation array storing received to comprise to the step of the TCP fragment message of described TCP session:
Judge that whether described circulation array storage space is full;
If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table;
If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
Preferably, described step of carrying out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session comprises:
Order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generates described HTTP message.
In order to address the above problem, disclosed herein as well is a kind of message reconstruction unit, comprising:
Determination module, for receiving the TCP fragment message of HTTP message, determines the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port;
Set up module, for calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected to according to test serial number daisy chaining in the ltsh chain table of the described TCP session of having set up;
Recombination module, for when receiving after whole TCP fragment messages of described TCP session, carries out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
Preferably, the described module of setting up comprises:
Computing module, for calculating the Hash key of described TCP session according to hash function;
The first judge module, for judging whether described ltsh chain table has existed the Hash key of described TCP session;
The first Executive Module, if be to exist for the judged result of described the first judge module, is inserted into the TCP fragment message receiving in the ltsh chain table of described TCP session according to test serial number order;
The second Executive Module, if be used for the judged result of described the first judge module for not existing, in described ltsh chain table, insert the Hash key of described TCP session, and the described TCP fragment message receiving is linked in the ltsh chain table of described TCP session corresponding to the described Hash key of insertion.
Preferably, described determination module, also for after receiving the TCP fragment message of HTTP message, utilizes the TCP fragment message of circulation array storing received to described TCP session.
Preferably, described determination module is in the time utilizing circulation array storing received to arrive the TCP fragment message of described TCP session:
Judge that whether described circulation array storage space is full;
If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table;
If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
Preferably, recombination module is also for after carrying out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session, order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generate described HTTP message.
Compared with prior art, the application comprises following advantage:
First, in the application, calculate the Hash key of TCP session according to hash function, the TCP fragment message of reception is connected to according to test serial number daisy chaining in the ltsh chain table of the TCP session of having set up, order reads the TCP fragment message of each node in ltsh chain table corresponding to TCP session, according to the sequential combination TCP fragment message reading, generate HTTP message.Because the corresponding TCP session of TCP fragment message receiving has fixing Hash key in a Hash table, can directly find the position of the ltsh chain table of the TCP session that this TCP fragment message is corresponding by this keyword, thereby without the source IP and the object IP that repeatedly search TCP fragment message; And, determining after the TCP session that TCP fragment message is corresponding, can link in the ltsh chain table of TCP session according to the numeric order of this TCP fragment message, on the one hand without repeated multiple times comparison TCP fragment message, on the other hand, in the time of follow-up TCP fragment message output, also without sorting again, thus, greatly improve the efficiency of TCP restructuring.
Accompanying drawing explanation
Fig. 1 is the flow chart of a kind of message recombining method in the embodiment of the present application one;
Fig. 2 is the flow chart of a kind of message recombining method in the embodiment of the present application two;
Fig. 3 is the structured flowchart of a kind of message reconstruction unit in the embodiment of the present application three;
Fig. 4 is the structured flowchart of a kind of message reconstruction unit in the embodiment of the present application four.
Embodiment
For the above-mentioned purpose, the feature and advantage that make the application can become apparent more, below in conjunction with the drawings and specific embodiments, the application is described in further detail.
Embodiment mono-
With reference to Fig. 1, show the flow chart of a kind of message recombining method in the embodiment of the present application one, comprising:
Step 101: receive the TCP fragment message of HTTP message, determine the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port.
In TCP transmitting procedure, the TCP fragment message of the HTTP message receiving mainly comprises source IP, object IP, target MAC (Media Access Control) address and source port, can determine a TCP session under TCP fragment message according to source IP, the object IP and the source port that receive in TCP fragment message.For example: if the source IP=11 of TCP fragment message, TCP fragment message object IP=22, TCP fragment message source port=88, further, above-mentioned source IP, object IP and source port order are spliced, obtain character array 112288, can identify this TCP session with this character array.
Step 102: calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected in the ltsh chain table of the described TCP session of having set up according to test serial number daisy chaining.
Wherein, the each TCP fragment message receiving has test serial number, can be connected in the ltsh chain table of the described TCP session of having set up according to order from small to large of test serial number or daisy chaining from big to small.A Hash key is to there being the chained list of a TCP session, and multiple TCP fragment messages of this TCP session are linked in this chained list.
Step 103: when receiving after whole TCP fragment messages of described TCP session, carry out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
HTTP header starts with " GET ", afterbody with " r n r n " finish, when the TCP of TCP session fragment message exists above-mentioned mark, and the TCP fragment message that " GET " is corresponding and " r n r n " test serial number of all TCP fragment messages between the TCP fragment message of correspondence is continuous, just form complete TCP session message, can determine that whole TCP fragment messages of this TCP session receive.And then each node that order reads on this chained list is combined into complete HTTP message.
It should be noted that, a kind of message recombining method in the present embodiment one can be applied to server end.In actual applications, also can be applied to client.
Pass through the present embodiment, calculate the Hash key of TCP session according to hash function, the TCP fragment message of reception is connected to according to test serial number daisy chaining in the ltsh chain table of the TCP session of having set up, order reads the TCP fragment message of each node in ltsh chain table corresponding to TCP session, according to the sequential combination TCP fragment message reading, generate HTTP message.Because the corresponding TCP session of TCP fragment message receiving has fixing Hash key in a Hash table, can directly find the position of the ltsh chain table of the TCP session that this TCP fragment message is corresponding by this keyword, thereby without the source IP and the object IP that repeatedly search TCP fragment message; And, determining after the TCP session that TCP fragment message is corresponding, can link in the ltsh chain table of TCP session according to the numeric order of this TCP fragment message, on the one hand without repeated multiple times comparison TCP fragment message, on the other hand, in the time of follow-up TCP fragment message output, also without sorting again, thus, greatly improve the efficiency of TCP restructuring.
Embodiment bis-
With reference to Fig. 2, show the flow chart of a kind of message recombining method in the embodiment of the present application two.
A kind of message recombining method in the present embodiment comprises:
Step 201, the TCP fragment message of reception HTTP message, determines the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port.
After the step of TCP fragment message that receives HTTP message, also comprise: utilize the TCP fragment message of circulation array storing received to TCP session.
Further, the application is in order to improve the speed of depositing, adopt the mode storing received in application static memory space to the TCP fragment message of TCP session, it is large internal memory of first to file, be divided into array, then the TCP fragment message of the TCP session receiving be kept in the circulation array after separation.This circulation array is at least preserved the TCP fragment message of the system that enters in 2s.
Preferably, utilize circulation array storing received to comprise to the step of the TCP fragment message of described TCP session: to judge that whether described circulation array storage space is full; If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table;
If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
Preferably, this step comprises:
Wherein, in the time calculating the Hash key of TCP session, a kind of preferred hash function is: hash={hash*seed}+{p_key[i] }.Wherein, seed represents the hashed value seed of TCP session, * represent multiplication sign, p_key represents the character array of the TCP session being made up of object IP, source IP and source port, p_key[i] represent the pointer of TCP session character array, { the hash initial value definition in hash*seed} equals 0, and after circulation starts, { the hash value in hash*seed} is the result that last hash calculates.
If there is the Hash key of TCP session in ltsh chain table, before illustrating, received the TCP fragment message of this TCP session, the TCP fragment message newly receiving is linked in the chained list of this TCP session by test serial number.
If there is not the Hash key of TCP session in ltsh chain table, before illustrating, do not receive the TCP fragment message of this TCP session, need chained list corresponding to newly-built this TCP session, and then the TCP fragment message newly receiving is inserted in this chained list.
Step 203: when receiving after whole TCP fragment messages of described TCP session, carry out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
Further, preferably, the step of carrying out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session comprises: order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generate described HTTP message.
Further, be below the code of method described in the application, for the realization of method described in aid illustration the application, specific as follows:
For above hash function algorithm, experimental result shows, has greatly improved the efficiency of TCP restructuring.
In sum, a kind of message recombining method of the embodiment of the present application mainly comprises following advantage:
First, calculate the Hash key of TCP session according to hash function, the TCP fragment message of reception is connected to according to test serial number daisy chaining in the ltsh chain table of the TCP session of having set up, order reads the TCP fragment message of each node in ltsh chain table corresponding to TCP session, according to the sequential combination TCP fragment message reading, generate HTTP message.Because the corresponding TCP session of TCP fragment message receiving has fixing Hash key in a Hash table, can directly find the position of the ltsh chain table of the TCP session that this TCP fragment message is corresponding by this keyword, thereby without the source IP and the object IP that repeatedly search TCP fragment message; And, determining after the TCP session that TCP fragment message is corresponding, can link in the ltsh chain table of TCP session according to the numeric order of this TCP fragment message, on the one hand without repeated multiple times comparison TCP fragment message, on the other hand, in the time of follow-up TCP fragment message output, also without sorting again, thus, greatly improve the efficiency of TCP restructuring.
Secondly, utilize the mode of circulation array, delete the incomplete TCP fragment message receiving, utilize the TCP fragment message of circulation array storing received to TCP session, according to receiving the counter ltsh chain table of looking into described TCP session of TCP fragment message, whether the TCP fragment message of determining the indication of current array pointer according to the anti-fruit that comes to an end is in ltsh chain table; If, current array pointer is moved on to the TCP fragment message in next circulation array, if do not existed, the TCP fragment message receiving described in the TCP fragment message of current array pointer indication is replaced with, thus solve the large problem of TCP restructuring committed memory.
It should be noted that, for aforesaid embodiment of the method, for simple description, therefore it is all expressed as to a series of combination of actions, but those skilled in the art should know, the application is not subject to the restriction of described sequence of movement, because according to the application, some step can adopt other orders or carry out simultaneously.Secondly, those skilled in the art also should know, the embodiment described in specification all belongs to preferred embodiment.
Based on the explanation of said method embodiment, the application also provides the embodiment of corresponding a kind of message reconstruction unit, realizes the content described in said method embodiment.
Embodiment tri-
With reference to Fig. 3, show the structured flowchart of a kind of message reconstruction unit in the embodiment of the present application three, specifically can comprise:
Set up module 302, for calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected in the ltsh chain table of the described TCP session of having set up according to test serial number daisy chaining.
It should be noted that, a kind of message reconstruction unit in the present embodiment three can be applied to server end.In actual applications, also can be applied to client.
Pass through the present embodiment, calculate the Hash key of TCP session according to hash function, the TCP fragment message of reception is connected to according to test serial number daisy chaining in the ltsh chain table of the TCP session of having set up, order reads the TCP fragment message of each node in ltsh chain table corresponding to TCP session, according to the sequential combination TCP fragment message reading, generate HTTP message.Because the corresponding TCP session of TCP fragment message receiving has fixing Hash key in a Hash table, can directly find the position of the ltsh chain table of the TCP session that this TCP fragment message is corresponding by this keyword, thereby without the source IP and the object IP that repeatedly search TCP fragment message; And, determining after the TCP session that TCP fragment message is corresponding, can link in the ltsh chain table of TCP session according to the numeric order of this TCP fragment message, on the one hand without repeated multiple times comparison TCP fragment message, on the other hand, in the time of follow-up TCP fragment message output, also without sorting again, thus, greatly improve the efficiency of TCP restructuring.
Embodiment tetra-
With reference to Fig. 4, show the structured flowchart of a kind of message reconstruction unit in the embodiment of the present application four.A kind of message reconstruction unit in the present embodiment comprises:
Further, determination module, also for after receiving the TCP fragment message of HTTP message, utilizes the TCP fragment message of circulation array storing received to described TCP session.
Further, the application is in order to improve the speed of depositing, adopt the mode storing received in application static memory space to the TCP fragment message of TCP session, it is large internal memory of first to file, be divided into array, then the TCP fragment message of the TCP session receiving is kept in the circulation array after separation, this circulation array is at least preserved the TCP fragment message of the system that enters in 2s.
Preferably, described determination module, in the time utilizing circulation array storing received to arrive the TCP fragment message of described TCP session, judges that whether described circulation array storage space is full; If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table; If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
Set up module 402, for calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected in the ltsh chain table of the described TCP session of having set up according to test serial number daisy chaining.
Preferably, the described module of setting up comprises:
The first judge module 4022, for judging whether described ltsh chain table has existed the Hash key of described TCP session; If exist, carry out the first Executive Module 4023, if do not exist, carry out the second Executive Module 4024.
The first Executive Module 4023, if be to exist for the judged result of described the first judge module, is inserted into according to test serial number order the TCP fragment message receiving in the ltsh chain table of described TCP session.
If there is the Hash key of TCP session in ltsh chain table, before illustrating, received the TCP fragment message of this TCP session, the TCP fragment message newly receiving is linked in the chained list of this TCP session by test serial number.
The second Executive Module 4024, if be used for the judged result of described the first judge module for not existing, in described ltsh chain table, insert the Hash key of described TCP session, and the described TCP fragment message receiving is linked in the ltsh chain table of described TCP session corresponding to the described Hash key of insertion.
If there is not the Hash key of TCP session in ltsh chain table, before illustrating, do not receive the TCP fragment message of this TCP session, need chained list corresponding to newly-built this TCP session, and then the TCP fragment message newly receiving is inserted in this chained list.
Further, preferably, recombination module also reads the TCP fragment message of each node of ltsh chain table corresponding to described TCP session for carry out the order afterwards of HTTP message restructuring according to ltsh chain table corresponding to TCP session, according to TCP fragment message described in the sequential combination reading, generate described HTTP message.
In sum, a kind of message reconstruction unit of the embodiment of the present application mainly comprises following advantage:
First, calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected to according to test serial number daisy chaining in the ltsh chain table of the described TCP session of having set up, order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generate described HTTP message.Because the corresponding TCP session of TCP fragment message receiving has fixing Hash key in a Hash table, can directly find the position of the ltsh chain table of the TCP session that this TCP fragment message is corresponding by this keyword, thereby without the source IP and the object IP that repeatedly search TCP fragment message; And, determining after the TCP session that TCP fragment message is corresponding, can link in the ltsh chain table of TCP session according to the numeric order of this TCP fragment message, on the one hand without repeated multiple times comparison TCP fragment message, on the other hand, in the time of follow-up TCP fragment message output, also without sorting again, thus, greatly improve the efficiency of TCP restructuring.
Secondly, utilize the mode of circulation array, delete the incomplete TCP fragment message receiving, utilize the TCP fragment message of circulation array storing received to TCP session, according to receiving the counter ltsh chain table of looking into described TCP session of TCP fragment message, whether the TCP fragment message of determining the indication of current array pointer according to the anti-fruit that comes to an end is in ltsh chain table; If, current array pointer is moved on to the TCP fragment message in next circulation array, if do not existed, the TCP fragment message receiving described in the TCP fragment message of current array pointer indication is replaced with, thus solve the large problem of TCP restructuring committed memory.
For device embodiment, because it is substantially similar to embodiment of the method, so description is fairly simple, relevant part is referring to the part explanation of embodiment of the method.
A kind of message recombining method and the device that above the application are provided, be described in detail, applied principle and the execution mode of specific case to the application herein and set forth, the explanation of above embodiment is just for helping to understand the application's method and core concept thereof; , for one of ordinary skill in the art, according to the application's thought, all will change in specific embodiments and applications, in sum, this description should not be construed as the restriction to the application meanwhile.
Claims (10)
1. a message recombining method, is characterized in that, comprising:
Receive the TCP fragment message of HTTP message, determine the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port;
Calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected to according to test serial number daisy chaining in the ltsh chain table of the described TCP session of having set up;
When receiving after whole TCP fragment messages of described TCP session, carry out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
2. method according to claim 1, it is characterized in that, the described Hash key that calculates described TCP session according to hash function, is connected to according to test serial number daisy chaining the described TCP fragment message receiving in the ltsh chain table of the described TCP session of having set up, and comprising:
Calculate the Hash key of described TCP session according to hash function;
Judge the Hash key that whether has had described TCP session in described ltsh chain table;
If exist, the TCP fragment message receiving be inserted into according to test serial number order in the ltsh chain table of described TCP session;
If do not exist, in described ltsh chain table, insert the Hash key of described TCP session, and the described TCP fragment message receiving is linked in the ltsh chain table of described TCP session corresponding to the described Hash key of insertion.
3. method according to claim 1, is characterized in that, after the step of the described TCP fragment message that receives HTTP message, also comprises:
Utilize the TCP fragment message of circulation array storing received to described TCP session.
4. method according to claim 3, is characterized in that, utilizes circulation array storing received to comprise to the step of the TCP fragment message of described TCP session:
Judge that whether described circulation array storage space is full;
If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table;
If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
5. method according to claim 1, is characterized in that, described step of carrying out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session comprises:
Order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generates described HTTP message.
6. a message reconstruction unit, is characterized in that, comprising:
Determination module, for receiving the TCP fragment message of HTTP message, determines the TCP session under described HTTP message according to source IP, the object IP of TCP fragment message and source port;
Set up module, for calculate the Hash key of described TCP session according to hash function, the described TCP fragment message receiving is connected to according to test serial number daisy chaining in the ltsh chain table of the described TCP session of having set up;
Recombination module, for when receiving after whole TCP fragment messages of described TCP session, carries out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session.
7. device according to claim 6, is characterized in that, the described module of setting up comprises:
Computing module, for calculating the Hash key of described TCP session according to hash function;
The first judge module, for judging whether described ltsh chain table has existed the Hash key of described TCP session;
The first Executive Module, if be to exist for the judged result of described the first judge module, is inserted into the TCP fragment message receiving in the ltsh chain table of described TCP session according to test serial number order;
The second Executive Module, if be used for the judged result of described the first judge module for not existing, in described ltsh chain table, insert the Hash key of described TCP session, and the described TCP fragment message receiving is linked in the ltsh chain table of described TCP session corresponding to the described Hash key of insertion.
8. device according to claim 6, is characterized in that, described determination module, also for after receiving the TCP fragment message of HTTP message, utilizes the TCP fragment message of circulation array storing received to described TCP session.
9. device according to claim 8, is characterized in that, described determination module is in the time utilizing circulation array storing received to arrive the TCP fragment message of described TCP session:
Judge that whether described circulation array storage space is full;
If, according to receiving the counter ltsh chain table of looking into described TCP session of described TCP fragment message, the TCP fragment message receiving described in if the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end, not in described ltsh chain table, replaces with the TCP fragment message of current array pointer indication; If the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is in described ltsh chain table, current array pointer is moved on to the TCP fragment message in next circulation array, until the TCP fragment message of determining current array pointer indication according to the anti-fruit that comes to an end is not in described ltsh chain table;
If not, directly the TCP fragment message of described TCP session is stored to described circulation array.
10. device according to claim 6, it is characterized in that, recombination module is also for after carrying out the restructuring of HTTP message according to ltsh chain table corresponding to described TCP session, order reads the TCP fragment message of each node in ltsh chain table corresponding to described TCP session, according to TCP fragment message described in the sequential combination reading, generate described HTTP message.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410079548.XA CN103888449A (en) | 2014-03-05 | 2014-03-05 | Method and device for packet reassembly |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410079548.XA CN103888449A (en) | 2014-03-05 | 2014-03-05 | Method and device for packet reassembly |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103888449A true CN103888449A (en) | 2014-06-25 |
Family
ID=50957169
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410079548.XA Pending CN103888449A (en) | 2014-03-05 | 2014-03-05 | Method and device for packet reassembly |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103888449A (en) |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104253863A (en) * | 2014-09-15 | 2014-12-31 | 重庆邮电大学 | Hadoop platform and distributed processing programming model-based TCP (transport control protocol) dataflow reassembly method |
| CN105743728A (en) * | 2014-12-11 | 2016-07-06 | 杭州迪普科技有限公司 | Method and apparatus for guaranteeing sequence of data blocks |
| CN105939297A (en) * | 2015-10-26 | 2016-09-14 | 杭州迪普科技有限公司 | TCP message reassembling method and TCP message reassembling device |
| CN108011850A (en) * | 2017-12-18 | 2018-05-08 | 北京百度网讯科技有限公司 | The recombination method and device of data packet, computer equipment and computer-readable recording medium |
| CN111083075A (en) * | 2019-12-20 | 2020-04-28 | 盛科网络（苏州）有限公司 | Method for processing message by multi-core SoC and SoC applying same |
| CN112583936A (en) * | 2020-12-29 | 2021-03-30 | 上海阅维科技股份有限公司 | Method for recombining transmission conversation flow |
| CN112600809A (en) * | 2020-12-08 | 2021-04-02 | 阿米华晟数据科技(江苏)有限公司 | Session resource management method, device, equipment and storage medium |
| CN113114472A (en) * | 2021-03-01 | 2021-07-13 | 北京信息科技大学 | Authentication method and system based on message hash chain |
| CN115022069A (en) * | 2022-06-20 | 2022-09-06 | 武汉思普崚技术有限公司 | IP fragment message recombination method and device for network attack detection |
| CN115190090A (en) * | 2022-07-12 | 2022-10-14 | 国泰君安证券股份有限公司 | TCP stream recombination behavior monitoring processing method, system, device, processor and storage medium based on hash table and queue structure |
| CN115811504A (en) * | 2022-11-16 | 2023-03-17 | 芯启源（南京）半导体科技有限公司 | DPU device for realizing IP fragment message recombination and IP fragment message recombination method |
-
2014
- 2014-03-05 CN CN201410079548.XA patent/CN103888449A/en active Pending
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104253863B (en) * | 2014-09-15 | 2017-07-28 | 重庆邮电大学 | A kind of TCP flow recombination method based on Hadoop platform and distributed treatment programming model |
| CN104253863A (en) * | 2014-09-15 | 2014-12-31 | 重庆邮电大学 | Hadoop platform and distributed processing programming model-based TCP (transport control protocol) dataflow reassembly method |
| CN105743728A (en) * | 2014-12-11 | 2016-07-06 | 杭州迪普科技有限公司 | Method and apparatus for guaranteeing sequence of data blocks |
| CN105939297A (en) * | 2015-10-26 | 2016-09-14 | 杭州迪普科技有限公司 | TCP message reassembling method and TCP message reassembling device |
| CN105939297B (en) * | 2015-10-26 | 2019-03-15 | 杭州迪普科技股份有限公司 | A kind of TCP message recombination method and device |
| CN108011850B (en) * | 2017-12-18 | 2021-08-17 | 北京百度网讯科技有限公司 | Data packet reassembly method and apparatus, computer device, and readable medium |
| CN108011850A (en) * | 2017-12-18 | 2018-05-08 | 北京百度网讯科技有限公司 | The recombination method and device of data packet, computer equipment and computer-readable recording medium |
| CN111083075A (en) * | 2019-12-20 | 2020-04-28 | 盛科网络（苏州）有限公司 | Method for processing message by multi-core SoC and SoC applying same |
| CN111083075B (en) * | 2019-12-20 | 2022-01-11 | 苏州盛科通信股份有限公司 | Method for processing message by multi-core SoC and SoC applying same |
| CN112600809A (en) * | 2020-12-08 | 2021-04-02 | 阿米华晟数据科技(江苏)有限公司 | Session resource management method, device, equipment and storage medium |
| CN112583936A (en) * | 2020-12-29 | 2021-03-30 | 上海阅维科技股份有限公司 | Method for recombining transmission conversation flow |
| CN113114472A (en) * | 2021-03-01 | 2021-07-13 | 北京信息科技大学 | Authentication method and system based on message hash chain |
| CN115022069A (en) * | 2022-06-20 | 2022-09-06 | 武汉思普崚技术有限公司 | IP fragment message recombination method and device for network attack detection |
| CN115022069B (en) * | 2022-06-20 | 2024-04-26 | 武汉思普崚技术有限公司 | IP fragment message recombination method and device for network attack detection |
| CN115190090A (en) * | 2022-07-12 | 2022-10-14 | 国泰君安证券股份有限公司 | TCP stream recombination behavior monitoring processing method, system, device, processor and storage medium based on hash table and queue structure |
| CN115811504A (en) * | 2022-11-16 | 2023-03-17 | 芯启源（南京）半导体科技有限公司 | DPU device for realizing IP fragment message recombination and IP fragment message recombination method |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103888449A (en) | Method and device for packet reassembly | |
| CN109242500B (en) | Block chain transaction validity verification method and device and storage medium | |
| Emek et al. | Stone age distributed computing | |
| JP6716727B2 (en) | Streaming data distributed processing method and apparatus | |
| CN1842764B (en) | Computer-aided parallelizing method and system of computation graphs | |
| CN108959370B (en) | Community discovery method and device based on entity similarity in knowledge graph | |
| CN104283723B (en) | Network access log processing method and processing device | |
| CN102722585B (en) | Browser type identification method, device and system | |
| CN104917680B (en) | For executing the computer system of the parallel hash of stream of packets | |
| CN110235162B (en) | Block chain system data processing method and block generation method | |
| US10050881B2 (en) | Method and apparatus for transmitting and receiving data in communication system | |
| CN113489583B (en) | Data processing method and device in multi-party privacy intersection and electronic equipment | |
| CN110659905B (en) | Transaction verification method, device, terminal equipment and storage medium | |
| EP2930903A2 (en) | Secure collection synchronization using matched network names | |
| CN110597922A (en) | Data processing method, device, terminal and storage medium | |
| US10567399B2 (en) | Fragmented malware hash lookup in cloud repository | |
| CN106294627A (en) | Data managing method and data server | |
| CN110990897A (en) | File fingerprint generation method and device | |
| CN110417787A (en) | A kind of data processing method, device, client and storage medium | |
| CN114003775A (en) | Graph data processing and querying method and system | |
| CN103457976A (en) | Data downloading method and system | |
| CN116432190B (en) | Method and device for detecting unauthorized access of interface, computer equipment and storage medium | |
| CN108076149A (en) | Session keeping method and device | |
| CN116668135A (en) | Block chain consensus method, system and device participated in by mobile edge equipment | |
| CN111367916A (en) | Data storage method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination |