CN106293888A - The packet capturing of data, deposit method and the packet capturing of data, deposit device - Google Patents
The packet capturing of data, deposit method and the packet capturing of data, deposit device Download PDFInfo
- Publication number
- CN106293888A CN106293888A CN201510303068.1A CN201510303068A CN106293888A CN 106293888 A CN106293888 A CN 106293888A CN 201510303068 A CN201510303068 A CN 201510303068A CN 106293888 A CN106293888 A CN 106293888A
- Authority
- CN
- China
- Prior art keywords
- packet
- thread
- deposit
- capturing
- internal memory
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Abstract
The invention discloses the packet capturing of a kind of data, deposit method and the packet capturing of data, deposit device.Wherein, the packet snapping method of these data includes: capture the first packet from network interface；In the first packet captured, add identification information, obtain the second packet；And by the second packet write internal memory.The present invention solves in correlation technique owing to packet capturing thread is when application lock, if now deposit thread is taking lock, at this moment packet capturing thread needs to wait deposit thread release lock, cause the packet now flowing through network interface do not have crawled to and cause the technical problem of packet loss and owing to lock itself belongs to the resource of operating system, make packet capturing thread need the consuming time when application lock or release lock, cause the packet during this period of time flowing through network interface not grab and cause the technical problem of packet loss.
Description
Technical field
The present invention relates to computer realm, in particular to the grabbing of packet capturing, deposit method and data of a kind of data
Bag, deposit device.
Background technology
In the related, capture packet (such as IP bag) from network interface and be saved in hard disk, then analyzing these numbers
According to bag, it it is a kind of common means of numerical analysis.As it is shown in figure 1, it is logical between acquisition server 1 ' and the Internet 2 '
Crossing network interface 11 ' and transmit data, acquisition server 1 ' can gather the data of network interface 11 ' and be saved in hard disk 12 '
For subsequent analysis.
Wherein, in the related, it is provided that two kinds of " packet capturing-> deposit " schemes, be respectively as follows: single-threaded scheme and
Dual-thread scheme.
For single-threaded scheme, thread needs circulation to perform " packet capturing-> deposit " this process.The shortcoming of this programme exists
In: when being carrying out deposit operation when thread, the packet now flowing through network interface cannot crawled arrive, and causes packet loss.
For dual-thread scheme, two lines journey shares same internal memory, as it is shown in figure 1, the lock of employing operating system (or
Person's mutexes, semaphore etc.) mechanism synchronizes the two lines journey read-write operation to internal memory.Wherein, packet capturing thread is from net
Mouth captures packet, then applies for lock, it is thus achieved that after lock, packet is write in internal memory 13 ', discharge lock the most again；
Deposit thread then first to file lock, it is thus achieved that after lock, from internal memory 13 ' read data packet, then packet is saved in hard disk
In, discharge lock the most again.Its idiographic flow is as shown in Figure 2.The shortcoming of this programme is: on the one hand, packet capturing thread
Application lock when, if now deposit thread is taking lock, at this moment packet capturing thread needs to wait that deposit thread is released
Putting lock, the packet now flowing through network interface cannot crawled arrive, and causes packet loss；On the other hand, due to lock (or mutually
Scold body, semaphore etc.) itself belong to the resource of operating system, packet capturing thread, when application lock or release lock, needs consumption
Time-consuming, the packet during this period of time flowing through network interface cannot crawled arrive, and causes packet loss.
For above-mentioned problem, effective solution is the most not yet proposed.
Summary of the invention
Embodiments provide the packet capturing of a kind of data, deposit method and the packet capturing of data, deposit device, so that
Solve less in correlation technique owing to packet capturing thread is when application lock, if now deposit thread is taking lock, at this moment grab
Envelope curve journey need wait deposit thread release lock, cause the packet now flowing through network interface do not have crawled to and cause and lose
Bag technical problem and owing to lock itself belongs to the resource of operating system so that packet capturing thread application lock or release lock
Time need the consuming time, cause the packet during this period of time flowing through network interface not grab and cause the technology of packet loss
Problem.
An aspect according to embodiments of the present invention, it is provided that the packet snapping method of a kind of data, including: capture from network interface
First packet；In the first packet captured, add identification information, obtain the second packet；And by above-mentioned
Two packet write internal memories.
Further, packet capturing thread captures above-mentioned first packet from above-mentioned network interface；Above-mentioned packet capturing thread is in above-mentioned crawl
The first packet in add above-mentioned identification information, obtain above-mentioned second packet；And above-mentioned packet capturing thread is by above-mentioned
Second packet writes above-mentioned internal memory.
Further, after above-mentioned second packet is write above-mentioned internal memory by above-mentioned packet capturing thread, above-mentioned packet snapping method
Also include: above-mentioned packet capturing thread judges whether to terminate thread；If above-mentioned packet capturing thread is judged to terminate thread, then tie
Bundle；If and/or above-mentioned packet capturing thread judges not terminate thread, the most above-mentioned packet capturing thread captures the 3rd from above-mentioned network interface
Packet.
Another aspect according to embodiments of the present invention, additionally provides a kind of deposit method of data, including: from internal memory
Reading the second packet, above-mentioned second packet is to the addition of identification information in the first packet captured from network interface
Packet；And the second packet read is stored to hard disk.
Further, deposit thread reads above-mentioned second packet from above-mentioned internal memory；And above-mentioned deposit thread is by upper
The second packet stating reading stores to above-mentioned hard disk.
Further, after deposit thread reads above-mentioned second packet from above-mentioned internal memory, above-mentioned deposit method is also
Including: whether above-mentioned deposit thread is the data read first according to above-mentioned second packet of above-mentioned identification information judgment
Bag；If it is the data read first that above-mentioned deposit thread goes out above-mentioned second packet according to above-mentioned identification information judgment
Bag, then perform above-mentioned deposit thread and the second packet of above-mentioned reading stored the step to above-mentioned hard disk；And/or such as
It is not the packet read first that the most above-mentioned deposit thread goes out above-mentioned second packet according to above-mentioned identification information judgment,
Then deposit thread reads the 3rd packet from above-mentioned internal memory.
Further, before the second packet of above-mentioned reading is stored to above-mentioned hard disk by above-mentioned deposit thread, above-mentioned
Deposit method also includes: above-mentioned deposit thread deletes above-mentioned identification information, after being processed from above-mentioned second packet
Packet, wherein, the second packet after above-mentioned process is stored to above-mentioned hard disk by above-mentioned deposit thread.
Another aspect according to embodiments of the present invention, it is provided that the packet capturing device of a kind of data, including: packet capturing unit,
For capturing the first packet from network interface；Adding device, for adding identification information in the first packet captured,
Obtain the second packet；And writing unit, for by above-mentioned second packet write internal memory.
Further, above-mentioned packet capturing unit is additionally operable to so that packet capturing thread captures above-mentioned first packet from above-mentioned network interface；
Above-mentioned adding device is additionally operable to so that above-mentioned packet capturing thread adds above-mentioned identification information in the first packet of above-mentioned crawl,
Obtain above-mentioned second packet；And above-mentioned writing unit is additionally operable to so that above-mentioned packet capturing thread is by above-mentioned second packet
Write above-mentioned internal memory.
Another further aspect according to embodiments of the present invention, additionally provides the deposit device of a kind of data, including: read unit,
For reading the second packet from internal memory, above-mentioned second packet is to add in the first packet captured from network interface
The packet of identification information；And memory element, for the second packet read is stored to hard disk.
In embodiments of the present invention, the packet being adopted as capturing adds the mode of identification information, by capturing from network interface
First packet；In the first packet captured, add identification information, obtain the second packet；And by the second number
According to bag write internal memory, reach to avoid using lock to cause the purpose of packet packet loss, lost it is achieved thereby that reduce data
The technique effect of bag rate, and then solve owing to packet capturing thread is when application lock in correlation technique, if now depositing line
Journey is taking lock, and at this moment packet capturing thread needs to wait deposit thread release lock, causes the packet now flowing through network interface
Do not have crawled to and cause the technical problem of packet loss and owing to lock itself belongs to the resource of operating system so that packet capturing line
Journey needs the consuming time when application lock or release lock, causes the packet during this period of time flowing through network interface not grabbed
Get and cause the technical problem of packet loss.
Accompanying drawing explanation
Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the application, this
Bright schematic description and description is used for explaining the present invention, is not intended that inappropriate limitation of the present invention.At accompanying drawing
In:
Fig. 1 is the network topological diagram of the packet capturing/deposit of a kind of data according to prior art；
Fig. 2 is the flow chart of the dual-thread packet capturing/deposit method of a kind of data according to prior art；
Fig. 3 is the flow chart of the packet snapping method of a kind of data according to embodiments of the present invention；
Fig. 4 is the flow chart of the deposit method of a kind of data according to embodiments of the present invention；
Fig. 5 is the schematic diagram of the grabbing device of a kind of data according to embodiments of the present invention；And
Fig. 6 is the schematic diagram of the deposit device of a kind of data according to embodiments of the present invention.
Detailed description of the invention
In order to make those skilled in the art be more fully understood that the present invention program, below in conjunction with in the embodiment of the present invention
Accompanying drawing, is clearly and completely described the technical scheme in the embodiment of the present invention, it is clear that described embodiment
It is only the embodiment of a present invention part rather than whole embodiments.Based on the embodiment in the present invention, ability
The every other embodiment that territory those of ordinary skill is obtained under not making creative work premise, all should belong to
The scope of protection of the invention.
It should be noted that term " first " in description and claims of this specification and above-mentioned accompanying drawing, "
Two " it is etc. for distinguishing similar object, without being used for describing specific order or precedence.Should be appreciated that this
Sample use data can exchange in the appropriate case, in order to embodiments of the invention described herein can with except
Here the order beyond those illustrating or describing is implemented.Additionally, term " includes " and " having " and they
Any deformation, it is intended that cover non-exclusive comprising, such as, contain series of steps or the process of unit, side
Method, system, product or equipment are not necessarily limited to those steps or the unit clearly listed, but can include the clearest
List or for intrinsic other step of these processes, method, product or equipment or unit.
Before elaborating the present invention, first following term is explained in detail:
Thread refers to an entity in process, and the ultimate unit independently dispatched by system and assign, thread oneself is not
Having system resource, the different threads of same process shares the resource of this process.
Lock refers to a kind of thread synchronization mechanism that operating system provides.Different threads is being written and read behaviour to same resource
When making, in order to ensure the integrity of data, it is possible to lock can be used and synchronize.A certain thread reads (or writing)
First to file lock before resource, discharges lock after reading (or writing) complete resource again.
Memcopy function is a built-in function of C Plus Plus, for memory copying, such as, by the data in internal memory A
Copy in internal memory B.This function has atomicity, when performing this function, it is possible to ensure now only have this thread behaviour
Make internal memory A and internal memory B, thus ensure the integrity of the data of internal memory A and internal memory B.It addition, memcopy function is only
It is only several a small amount of cpu instructions, performs ultrahigh in efficiency.
Embodiment 1
According to embodiments of the present invention, it is provided that the embodiment of the method for the packet snapping method of a kind of data, it should be noted that
Can perform in the computer system of such as one group of computer executable instructions in the step shown in the flow chart of accompanying drawing,
And, although show logical order in flow charts, but in some cases, can be suitable be different from herein
Step shown or described by sequence execution.
Fig. 3 is the flow chart of the packet snapping method of a kind of data according to embodiments of the present invention, as it is shown on figure 3, the method
Comprise the steps:
Step S302, captures the first packet from network interface；
Step S304, adds identification information in the first packet captured, obtains the second packet；And
Step S306, by the second packet write internal memory.
During enforcement, acquisition server performs packet in a thread and captures task, i.e. first captures from mutually from network interface
First packet of networking, then in the first packet captured, add identification information to obtain the second packet, then
This second packet is write in the internal memory of this acquisition server；Afterwards, acquisition server performs in another thread
Packet deposit task, i.e. first reads aforesaid second packet, then the second packet storage that will read from internal memory
To hard disk.Wherein, identification information is the character string that can uniquely identify the second packet, such as, can be numbering etc..
That is, acquisition server captures packet from network interface in a thread, then the packet for capturing adds volume
Number information is to be packaged into a new data packets, thus new data packets is write in internal memory, and then acquisition server is at this
In thread, circulation performs these steps；It is (the most aforementioned that acquisition server reads the packet in internal memory in another thread
New data packets), and detect the numbering of this packet, if not yet read before the packet of this numbering, then by it
It is stored in hard disk；If read before the packet of this numbering, then ignore this packet, then gather service
Device circulates these steps of execution in this thread.
On the one hand, shorter than packet capturing operation due to deposit operation so that packet capturing thread is just when packet capturing, it is possible to ensure
Deposit thread has the packet deposit that packet capturing thread last is captured by time enough；On the other hand, memcopy
Data in internal memory A, as memory copying function, are copied in internal memory B by function, and this operation has atomicity, holds
During this function of row, it is possible to ensure now only have this thread at operation internal memory A and internal memory B, thus ensure internal memory A and interior
Deposit the integrity of the data of B.Another further aspect, memcopy function only has several a small amount of cpu instructions, performs
Ultrahigh in efficiency.Therefore, compared with the common packet capturing/deposit method in correlation technique, the employing embodiment of the present invention can be big
Reducing greatly packet loss, the such as network interface in high capacity and use the embodiment of the present invention, packet loss is about the 1/100 of commonsense method.
It should be noted that memcopy function is the function of C Plus Plus, it can also use the near order of other Languages
Realize.
By the embodiment of the present invention, reach to avoid using lock to cause the purpose of packet packet loss, it is achieved thereby that fall
The technique effect of low data packetloss rate.
Alternatively, in embodiments of the present invention, aforesaid step S302 can be to adopt to the executive agent of step S306
Packet capturing thread in collection server, i.e. packet capturing thread captures the first packet from network interface；Packet capturing thread is the captured
One packet adds identification information, obtains the second packet；And packet capturing thread is by the second packet write internal memory.
Accordingly, while packet capturing thread loops performs packet capturing the step that is stored in internal memory by the packet of crawl, deposit
Thread loops performs read data packet the step that is copied in hard disk from internal memory.
So, acquisition server can perform packet capturing operation and deposit operation respectively in two threads, and does not does mutually
Disturb, i.e. maintain the integrity of data in EMS memory, reduce again packet loss.
Still optionally further, after packet capturing thread is by the second packet write internal memory, above-mentioned packet snapping method can also wrap
Include:
S2, packet capturing thread judges whether to terminate thread；
S4, if packet capturing thread is judged to terminate thread, then terminates；And/or
S6, if packet capturing thread judges not terminate thread, then packet capturing thread captures the 3rd packet from network interface.Wherein,
3rd packet is next packet of the first packet, if that is, packet capturing thread judges not terminate thread, then
Packet capturing thread continues to capture next packet from network interface.
So, packet capturing thread is possible not only under the control jumping out instruction, terminates this thread, it is also possible to circulation execution is grabbed
Bag/storage (that is, depositing to internal memory) operation.
Embodiment 2
According to embodiments of the present invention, it is provided that the embodiment of the method for a kind of deposit method of data, it should be noted that
Can perform in the computer system of such as one group of computer executable instructions in the step shown in the flow chart of accompanying drawing,
And, although show logical order in flow charts, but in some cases, can be suitable be different from herein
Step shown or described by sequence execution.
Fig. 4 is the flow chart of the deposit method of a kind of data according to embodiments of the present invention, as shown in Figure 4, the method
Comprise the steps:
Step S402, reads the second packet from internal memory, and the second packet is at the first packet captured from network interface
In with the addition of the packet of identification information；And
Step S404, stores the second packet read to hard disk.
During enforcement, acquisition server performs packet in a thread and captures task, i.e. first captures from mutually from network interface
First packet of networking, then in the first packet captured, add identification information to obtain the second packet, then
This second packet is write in the internal memory of this acquisition server；Afterwards, acquisition server performs in another thread
Packet deposit task, i.e. first reads aforesaid second packet, then the second packet storage that will read from internal memory
To hard disk.
That is, acquisition server captures packet from network interface in a thread, then the packet for capturing adds volume
Number information is to be packaged into a new data packets, thus new data packets is write in internal memory, and then acquisition server is at this
In thread, circulation performs these steps；It is (the most aforementioned that acquisition server reads the packet in internal memory in another thread
New data packets), and detect the numbering of this packet, if not yet read before the packet of this numbering, then by it
It is stored in hard disk；If read before the packet of this numbering, then ignore this packet, then gather service
Device circulates these steps of execution in this thread.
By the embodiment of the present invention, reach to avoid using lock to cause the purpose of packet packet loss, it is achieved thereby that fall
The technique effect of low data packetloss rate.
Alternatively, in embodiments of the present invention, aforesaid step S402 can be to adopt to the executive agent of step S404
Deposit thread in collection server, i.e. deposit thread reads the second packet from internal memory；And deposit thread is by reading
The second packet taken stores to hard disk.Wherein, packet capturing thread loops performs packet capturing the packet storage that will capture
While step in internal memory, deposit datacycle performs read data packet being copied in hard disk from internal memory
Step.
So, acquisition server can perform packet capturing operation and deposit operation respectively in two threads, and does not does mutually
Disturb, i.e. maintain the integrity of data in EMS memory, reduce again packet loss.
Still optionally further, after deposit thread reads the second packet from internal memory, above-mentioned deposit method is all right
Including:
S6, whether deposit thread is the packet read first according to identification information judgment the second packet；
S8, if it is the packet read first that deposit thread goes out the second packet according to identification information judgment, then holds
The second packet read is stored the step to hard disk by row deposit thread；And/or
S10, if it is not the packet read first that deposit thread goes out the second packet according to identification information judgment, then
Deposit thread reads the 3rd packet from internal memory.
By the embodiment of the present invention, the mode analyzing identification information, deposit thread is used to may determine that the number of current reading
Whether it is the packet being read first according to bag, if the packet being read first, is then copied in hard disk,
Otherwise, do not process, and continue to read other data in internal memory.As such, it is possible to prevent same data from being repeated to deposit
Store up to hard disk, cause hard drive space waste, hard disc data surplus and the inefficiency etc. of copy data.
Alternatively, before the second packet read is stored to hard disk by deposit thread, above-mentioned deposit method is all right
Including:
S12, deposit thread is deleted identification information, the packet after being processed from the second packet, wherein, is deposited
The second packet after thread will process stores to hard disk.
Thus it is possible, on the one hand, so that deposit thread actual storage is grabbed to the packet in hard disk is actual with packet capturing thread
The packet taken keeps consistent, on the other hand, can save the memory space of hard disk, prevents unnecessary data (such as mark
Knowledge information) take memory space and cause the wasting of resources.
Owing to packet capturing thread does not interfere with each other mutually with deposit thread, it is possible to independently execute respective step, therefore ability
Field technique personnel record according to the content of above-mentioned two embodiment, can with easy and flexible by embodiment 1 packet capturing thread
The deposit step of thread of step and embodiment 2 carries out suitable part or all of combination, is derived from more embodiment,
Repeat the most one by one.
Embodiment 3
According to embodiments of the present invention, it is provided that the device embodiment of the packet capturing device of a kind of data.
Fig. 5 is the schematic diagram of the grabbing device of a kind of data according to embodiments of the present invention, and this device includes: packet capturing list
Unit 502, adding device 504 and writing unit 506.Packet capturing unit 502, for capturing the first packet from network interface；
Adding device 504, for adding identification information in the first packet captured, obtains the second packet；And write
Enter unit 506, for by the second packet write internal memory.
During enforcement, acquisition server performs packet in a thread and captures task, i.e. first captures from mutually from network interface
First packet of networking, then in the first packet captured, add identification information to obtain the second packet, then
This second packet is write in the internal memory of this acquisition server；Afterwards, acquisition server performs in another thread
Packet deposit task, i.e. first reads aforesaid second packet, then the second packet storage that will read from internal memory
To hard disk.Wherein, identification information is the character string that can uniquely identify the second packet, such as, can be numbering etc..
That is, acquisition server captures packet from network interface in a thread, then the packet for capturing adds volume
Number information is to be packaged into a new data packets, thus new data packets is write in internal memory, and then acquisition server is at this
In thread, circulation performs these steps；It is (the most aforementioned that acquisition server reads the packet in internal memory in another thread
New data packets), and detect the numbering of this packet, if not yet read before the packet of this numbering, then by it
It is stored in hard disk；If read before the packet of this numbering, then ignore this packet, then gather service
Device circulates these steps of execution in this thread.
On the one hand, shorter than packet capturing operation due to deposit operation so that packet capturing thread is just when packet capturing, it is possible to ensure
Deposit thread has the packet deposit that packet capturing thread last is captured by time enough；On the other hand, memcopy
Data in internal memory A, as memory copying function, are copied in internal memory B by function, and this operation has atomicity, holds
During this function of row, it is possible to ensure now only have this thread at operation internal memory A and internal memory B, thus ensure internal memory A and interior
Deposit the integrity of the data of B.Another further aspect, memcopy function only has several a small amount of cpu instructions, performs
Ultrahigh in efficiency.Therefore, compared with the common packet capturing/deposit method in correlation technique, the employing embodiment of the present invention can be big
Reducing greatly packet loss, the such as network interface in high capacity and use the embodiment of the present invention, packet loss is about the 1/100 of commonsense method.
It should be noted that memcopy function is the function of C Plus Plus, it can also use the near order of other Languages
Realize.
By the embodiment of the present invention, reach to avoid using lock to cause the purpose of packet packet loss, it is achieved thereby that fall
The technique effect of low data packetloss rate.
Alternatively, above-mentioned packet capturing unit can be also used for so that packet capturing thread captures the first packet from network interface；Above-mentioned add
Add unit to can be also used for, so that packet capturing thread adds identification information in the first packet captured, obtaining the second data
Bag；And above-mentioned writing unit can be also used for so that packet capturing thread is by the second packet write internal memory.
So, acquisition server can perform packet capturing operation and deposit operation respectively in two threads, and does not does mutually
Disturb, i.e. maintain the integrity of data in EMS memory, reduce again packet loss.
Still optionally further, above-mentioned packet capturing device can also include: the first judging unit, is used for so that at packet capturing thread
After the second packet write internal memory, packet capturing thread judges whether to terminate thread；End unit, at packet capturing line
When journey judges to terminate thread, terminate；And/or, packet capturing unit is additionally operable to so that packet capturing thread judges not terminate thread
Time, packet capturing thread captures the 3rd packet from network interface.Wherein, the 3rd packet is next packet of the first packet,
That is, if packet capturing thread judges not terminate thread, then packet capturing thread continues to capture next packet from network interface
So, packet capturing thread is possible not only under the control jumping out instruction, terminates this thread, it is also possible to circulation execution is grabbed
Bag/storage (that is, depositing to internal memory) operation.
Embodiment 4
According to embodiments of the present invention, it is provided that the device embodiment of the deposit device of a kind of data.
Fig. 6 is the schematic diagram of the deposit device of a kind of data according to embodiments of the present invention, and this device includes: read single
Unit 602 and memory element 604.Reading unit 602 to be used for reading the second packet from internal memory, the second packet is
The packet of identification information is with the addition of in the first packet captured from network interface；And memory element 604 will be for reading
The second packet taken stores to hard disk.
During enforcement, acquisition server performs packet in a thread and captures task, i.e. first captures from mutually from network interface
First packet of networking, then in the first packet captured, add identification information to obtain the second packet, then
This second packet is write in the internal memory of this acquisition server；Afterwards, acquisition server performs in another thread
Packet deposit task, i.e. first reads aforesaid second packet, then the second packet storage that will read from internal memory
To hard disk.
That is, acquisition server captures packet from network interface in a thread, then the packet for capturing adds volume
Number information is to be packaged into a new data packets, thus new data packets is write in internal memory, and then acquisition server is at this
In thread, circulation performs these steps；It is (the most aforementioned that acquisition server reads the packet in internal memory in another thread
New data packets), and detect the numbering of this packet, if not yet read before the packet of this numbering, then by it
It is stored in hard disk；If read before the packet of this numbering, then ignore this packet, then gather service
Device circulates these steps of execution in this thread.
By the embodiment of the present invention, reach to avoid using lock to cause the purpose of packet packet loss, it is achieved thereby that fall
The technique effect of low data packetloss rate.
Alternatively, read unit to can be also used for so that deposit thread reads the second packet from internal memory；And storage
Unit can be also used for so that the second packet read is stored to hard disk by deposit thread.Wherein, packet capturing thread follows
While ring performs packet capturing the step that is stored in internal memory by the packet of crawl, deposit datacycle performs from internal memory
Middle read data packet the step being copied in hard disk.
So, acquisition server can perform packet capturing operation and deposit operation respectively in two threads, and does not does mutually
Disturb, i.e. maintain the integrity of data in EMS memory, reduce again packet loss.
Still optionally further, above-mentioned deposit device also includes: the second judging unit, be used for so that deposit thread from interior
After depositing reading the second packet, whether deposit thread is to be read first according to identification information judgment the second packet
Packet；Memory element is additionally operable to so that going out the second packet for by first at deposit thread according to identification information judgment
During the packet read, perform deposit thread and the second packet read is stored the step to hard disk；And/or, read
Take unit to be additionally operable to so that going out the second packet not for the data read first at deposit thread according to identification information judgment
Bao Shi, deposit thread reads the 3rd packet from internal memory.
By the embodiment of the present invention, the mode analyzing identification information, deposit thread is used to may determine that the number of current reading
Whether it is the packet being read first according to bag, if the packet being read first, is then copied in hard disk,
Otherwise, do not process, and continue to read other data in internal memory.As such, it is possible to prevent same data from being repeated to deposit
Store up to hard disk, cause hard drive space waste, hard disc data surplus and the inefficiency etc. of copy data.
Alternatively, above-mentioned deposit device can also include: deletes unit, is used for second that deposit thread will be read
Before packet stores to hard disk, deposit thread deletes identification information, the number after being processed from the second packet
According to bag, wherein, the second packet that memory element is additionally operable to after processing so that deposit thread stores to hard disk.
Thus it is possible, on the one hand, so that deposit thread actual storage is grabbed to the packet in hard disk is actual with packet capturing thread
The packet taken keeps consistent, on the other hand, can save the memory space of hard disk, prevents unnecessary data (such as mark
Knowledge information) take memory space and cause the wasting of resources.
The invention described above embodiment sequence number, just to describing, does not represent the quality of embodiment.
In the above embodiment of the present invention, the description to each embodiment all emphasizes particularly on different fields, and does not has in certain embodiment
The part described in detail, may refer to the associated description of other embodiments.
In several embodiments provided herein, it should be understood that disclosed technology contents, can be passed through other
Mode realize.Wherein, device embodiment described above is only schematically, the division of the most described unit,
Can be that a kind of logic function divides, actual can have other dividing mode, the most multiple unit or assembly when realizing
Can in conjunction with or be desirably integrated into another system, or some features can be ignored, or does not performs.Another point, institute
The coupling each other shown or discuss or direct-coupling or communication connection can be by some interfaces, unit or mould
The INDIRECT COUPLING of block or communication connection, can be being electrical or other form.
The described unit illustrated as separating component can be or may not be physically separate, shows as unit
The parts shown can be or may not be physical location, i.e. may be located at a place, or can also be distributed to
On multiple unit.Some or all of unit therein can be selected according to the actual needs to realize the present embodiment scheme
Purpose.
It addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, it is also possible to
It is that unit is individually physically present, it is also possible to two or more unit are integrated in a unit.Above-mentioned integrated
Unit both can realize to use the form of hardware, it would however also be possible to employ the form of SFU software functional unit realizes.
If described integrated unit is using the form realization of SFU software functional unit and as independent production marketing or use,
Can be stored in a computer read/write memory medium.Based on such understanding, technical scheme essence
On the part that in other words prior art contributed or this technical scheme completely or partially can be with software product
Form embodies, and this computer software product is stored in a storage medium, including some instructions with so that one
Platform computer equipment (can be for personal computer, server or the network equipment etc.) performs each embodiment institute of the present invention
State all or part of step of method.And aforesaid storage medium includes: USB flash disk, read only memory (ROM, Read-Only
Memory), random access memory (RAM, Random Access Memory), portable hard drive, magnetic disc or CD
Etc. the various media that can store program code.
The above is only the preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art
For Yuan, under the premise without departing from the principles of the invention, it is also possible to make some improvements and modifications, these improve and profit
Decorations also should be regarded as protection scope of the present invention.
Claims (10)
1. the packet snapping method of data, it is characterised in that including:
The first packet is captured from network interface；
In the first packet captured, add identification information, obtain the second packet；And
By described second packet write internal memory.
Packet snapping method the most according to claim 1, it is characterised in that
Packet capturing thread captures described first packet from described network interface；
Described packet capturing thread adds described identification information in the first packet of described crawl, obtains described second
Packet；And
Described second packet is write described internal memory by described packet capturing thread.
Packet snapping method the most according to claim 2, it is characterised in that at described packet capturing thread by described second data
After bag writes described internal memory, described packet snapping method also includes:
Described packet capturing thread judges whether to terminate thread；
If described packet capturing thread is judged to terminate thread, then terminate；And/or
If described packet capturing thread judges not terminate thread, the most described packet capturing thread captures the 3rd from described network interface
Packet.
4. the deposit method of data, it is characterised in that including:
Reading the second packet from internal memory, described second packet is in the first packet captured from network interface
With the addition of the packet of identification information；And
The second packet read is stored to hard disk.
Deposit method the most according to claim 4, it is characterised in that
Deposit thread reads described second packet from described internal memory；And
Second packet of described reading is stored to described hard disk by described deposit thread.
Deposit method the most according to claim 5, it is characterised in that read institute from described internal memory at deposit thread
After stating the second packet, described deposit method also includes:
Whether described deposit thread is the number read first according to the second packet described in described identification information judgment
According to bag；
If it is read first that described deposit thread goes out described second packet according to described identification information judgment
Packet, then perform described deposit thread and the second packet of described reading stored the step to described hard disk；
And/or
If described deposit thread goes out described second packet not for be read first according to described identification information judgment
Packet, then deposit thread from described internal memory, read the 3rd packet.
Deposit method the most according to claim 5, it is characterised in that described deposit thread is by the second of described reading
Before packet stores to described hard disk, described deposit method also includes:
Described deposit thread deletes described identification information from described second packet, the packet after being processed,
Wherein, the second packet after described process is stored to described hard disk by described deposit thread.
8. the packet capturing device of data, it is characterised in that including:
Packet capturing unit, for capturing the first packet from network interface；
Adding device, for adding identification information in the first packet captured, obtains the second packet；With
And
Writing unit, for by described second packet write internal memory.
Packet capturing device the most according to claim 8, it is characterised in that
Described packet capturing unit is additionally operable to so that packet capturing thread captures described first packet from described network interface；
Described adding device is additionally operable to so that described packet capturing thread adds described in the first packet of described crawl
Identification information, obtains described second packet；And
Said write unit is additionally operable to so that described second packet is write described internal memory by described packet capturing thread.
10. the deposit device of data, it is characterised in that including:
Reading unit, for reading the second packet from internal memory, described second packet is to capture from network interface
The first packet in the addition of the packet of identification information；And
Memory element, for storing the second packet read to hard disk.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510303068.1A CN106293888A (en) | 2015-06-04 | 2015-06-04 | The packet capturing of data, deposit method and the packet capturing of data, deposit device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510303068.1A CN106293888A (en) | 2015-06-04 | 2015-06-04 | The packet capturing of data, deposit method and the packet capturing of data, deposit device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106293888A true CN106293888A (en) | 2017-01-04 |
Family
ID=57656583
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510303068.1A Pending CN106293888A (en) | 2015-06-04 | 2015-06-04 | The packet capturing of data, deposit method and the packet capturing of data, deposit device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106293888A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107256180A (en) * | 2017-05-19 | 2017-10-17 | 腾讯科技（深圳）有限公司 | Data processing method, device and terminal |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101783941A (en) * | 2009-09-15 | 2010-07-21 | 上海海事大学 | Real-time video transmission method based on IP network |
| CN101841470A (en) * | 2010-03-29 | 2010-09-22 | 东南大学 | High-speed capturing method of bottom-layer data packet based on Linux |
| CN104184659A (en) * | 2013-05-22 | 2014-12-03 | 上海贝尔股份有限公司 | Method and device for obtaining data packet in network |
| CN104243344A (en) * | 2014-10-11 | 2014-12-24 | 网宿科技股份有限公司 | Effective data packet capturing method and request redirection server |
-
2015
- 2015-06-04 CN CN201510303068.1A patent/CN106293888A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101783941A (en) * | 2009-09-15 | 2010-07-21 | 上海海事大学 | Real-time video transmission method based on IP network |
| CN101841470A (en) * | 2010-03-29 | 2010-09-22 | 东南大学 | High-speed capturing method of bottom-layer data packet based on Linux |
| CN104184659A (en) * | 2013-05-22 | 2014-12-03 | 上海贝尔股份有限公司 | Method and device for obtaining data packet in network |
| CN104243344A (en) * | 2014-10-11 | 2014-12-24 | 网宿科技股份有限公司 | Effective data packet capturing method and request redirection server |
Non-Patent Citations (1)
| Title |
|---|
| 何建敏: "《计算机应用软件开发基础》", 31 December 1994 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107256180A (en) * | 2017-05-19 | 2017-10-17 | 腾讯科技（深圳）有限公司 | Data processing method, device and terminal |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104778222B (en) | Media library based on USB storage device is established and update method | |
| CN104063293B (en) | A kind of data back up method and stream calculation system | |
| CN104252405B (en) | The output intent and device of log information | |
| CN104821924B (en) | A kind of processing method of network data packets, device and network processing device | |
| CN102549552A (en) | Method for processing data packets in flow-aware network nodes | |
| CN106776456B (en) | High speed regular expression matching hybrid system and method based on FPGA+NPU | |
| CN106325758B (en) | A kind of queue storage space management method and device | |
| CN104866528B (en) | Multi-platform collecting method and system | |
| CN106383666B (en) | Data storage method and device | |
| CN102064977A (en) | Graphics processing unit (GPU) based method for detecting message content of high-speed network | |
| CN109684099A (en) | Message treatment method and device | |
| CN106330788B (en) | Message fragment transmission method and device | |
| CN110231995A (en) | A kind of method for scheduling task based on Actor model, device and storage medium | |
| CN103488717A (en) | Lock-free data gathering method and lock-free data gathering device | |
| CN103684851B (en) | Collecting method and device | |
| CN104050193B (en) | Generate the method for message and realize the data handling system of this method | |
| CN103927244B (en) | A kind of method of the plug-in unit scheduling process monitoring realized based on dynamic proxy | |
| CN106407226A (en) | Data processing method, backup server and storage system | |
| US20200133855A1 (en) | Accessing queue data | |
| CN104077078B (en) | Read memory block, update the method and device of memory block | |
| CN103064749B (en) | Inter-process communication method | |
| CN101594201A (en) | The method of integrally filtering error data in linked queue management structure | |
| CN106293888A (en) | The packet capturing of data, deposit method and the packet capturing of data, deposit device | |
| CN106612303A (en) | Data processing method and data processing device | |
| CN103902471B (en) | Data buffer storage treating method and apparatus |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information | ||
| CB02 | Change of applicant information |
Address after: 100083 No. 401, 4th Floor, Haitai Building, 229 North Fourth Ring Road, Haidian District, Beijing Applicant after: Beijing Guoshuang Technology Co.,Ltd. Address before: 100086 Cuigong Hotel, 76 Zhichun Road, Shuangyushu District, Haidian District, Beijing Applicant before: Beijing Guoshuang Technology Co.,Ltd. |
|
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170104 |