CN109412893A - A kind of message back method and device - Google Patents
A kind of message back method and device Download PDFInfo
- Publication number
- CN109412893A CN109412893A CN201811237036.6A CN201811237036A CN109412893A CN 109412893 A CN109412893 A CN 109412893A CN 201811237036 A CN201811237036 A CN 201811237036A CN 109412893 A CN109412893 A CN 109412893A
- Authority
- CN
- China
- Prior art keywords
- data message
- source address
- preset quantity
- dpi
- load information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/50—Testing arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the present application provides a kind of message back method and device, method are comprised determining that playback file, and extracts the load information to data message each in playback file；It constructs that preset quantity source address is corresponding, heading of specified protocol type, and establishes the corresponding thread of preset quantity source address；Using the corresponding heading of source address each in preset quantity source address, each load information extracted is carried out adding encapsulation process respectively, obtains the corresponding preset quantity reconstruct data message of each load information；Using the corresponding thread of source address each in preset quantity source address, each reconstruct data message is sent to DPI equipment, so that respectively reconstruct data message carries out DPI test to DPI equipment based on the received.Using technical solution provided by the embodiments of the present application, it can be improved the efficiency of DPI test, improve the test effect of DPI.
Description
Technical field
This application involves fields of communication technology, more particularly to a kind of message back method and device.
Background technique
With the development of network technology, the malicious act of menace network safety is increasingly complicated, or even many malicious acts are all
It is to be hidden in the application layer load of data message.This makes DPI (Deep Packet Inspection, deep message detection)
Function is more and more indispensable, and DPI test also becomes more and more important.
Currently, DPI test mainly plays back message using softwares such as Tcpreplay.Specifically, operation Tcpreplay is soft
The server of part is obtained to playback file (such as pcap file), includes multiple data messages in pcap file, by pcap file
In the source address of each data message be rewritten as the address of server, the destination address of data message each in pcap file being changed
It is written as the address of default equipment, retrieves multiple data messages.Server sends out the multiple data messages retrieved one by one
Give DPI equipment.DPI equipment carries out DPI test according to the data message.
In above-mentioned message playback, server can only play back a data message every time, this leads to DPI equipment synchronization only
DPI test can be carried out according to a data message, the efficiency for causing DPI to test is lower.Meanwhile DPI equipment carries out DPI test
The source address and destination address of each data message are all the same, and DPI test is single, and test effect is poor.
Summary of the invention
The embodiment of the present application is designed to provide a kind of message back method and device, to improve the efficiency of DPI test,
Improve the test effect of DPI.Specific technical solution is as follows:
In a first aspect, the embodiment of the present application provides a kind of message back method, which comprises
It determines to playback file, and extracts the load information to data message each in playback file；
It constructs that preset quantity source address is corresponding, heading of specified protocol type, and establishes the present count
Measure the corresponding thread of source address；
It is each to what is extracted respectively using the corresponding heading of source address each in the preset quantity source address
Load information carries out plus encapsulation process, obtains the corresponding preset quantity reconstruct datagram of each load information
Text；
Using the corresponding thread of source address each in the preset quantity source address, each reconstruct data are sent to DPI equipment
Message, so that respectively reconstruct data message carries out DPI test to the DPI equipment based on the received.
Second aspect, the embodiment of the present application provide a kind of message playback reproducer, and described device includes:
Extraction unit for determining to playback file, and extracts the load to data message each in playback file
Information；
Construction unit, preset quantity source address is corresponding, heading of specified protocol type for constructing, and builds
Found the corresponding thread of the preset quantity source address；
Encapsulation unit, for using the corresponding heading of source address each in the preset quantity source address, respectively to mentioning
Each load information taken out carries out plus encapsulation process, obtains the corresponding preset quantity reconstruct datagram of each load information
Text；
Transmission unit, for being sent out to DPI equipment using the corresponding thread of source address each in the preset quantity source address
Each reconstruct data message is sent, so that respectively reconstruct data message carries out DPI test to the DPI equipment based on the received.
The third aspect, the embodiment of the present application provide a kind of electronic equipment, including processor and machine readable storage medium,
The machine readable storage medium is stored with the machine-executable instruction that can be executed by the processor, and the processor is by institute
It states machine-executable instruction to promote: realizing the either step for the message back method that first aspect provides.
Fourth aspect, the embodiment of the present application provide a kind of machine readable storage medium, are stored with machine-executable instruction,
When being called and being executed by processor, the machine-executable instruction promotes the processor: realizing the report that first aspect provides
The either step of literary back method.
In technical solution provided by the embodiments of the present application, multiple threads are opened, multiple threads can forward multiple heavy simultaneously
Structure data message, realizes Batch sending data message, and DPI equipment can carry out DPI test according to multiple data messages simultaneously, have
Effect improves the efficiency of DPI test.In addition, the reconstruct data message that a variety of source addresses are different, DPI test diversification, improve
The test effect of DPI.
Certainly, any product or method for implementing the application must be not necessarily required to reach all the above excellent simultaneously
Point.
Detailed description of the invention
In order to illustrate the technical solutions in the embodiments of the present application or in the prior art more clearly, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of application for those of ordinary skill in the art without creative efforts, can be with
It obtains other drawings based on these drawings.
Fig. 1 is a kind of schematic diagram of Test Networking provided by the embodiments of the present application；
Fig. 2 is a kind of flow diagram of message back method provided by the embodiments of the present application；
Fig. 3 is a kind of structural schematic diagram of message playback reproducer provided by the embodiments of the present application；
Fig. 4 is a kind of structural schematic diagram of electronic equipment provided by the embodiments of the present application.
Specific embodiment
Below in conjunction with the attached drawing in the embodiment of the present application, technical solutions in the embodiments of the present application carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of embodiments of the present application, instead of all the embodiments.It is based on
Embodiment in the application, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall in the protection scope of this application.
Currently, playing back message, Lai Jinhang DPI test using softwares such as Tcpreplay.This kind of message plays back mode, service
Device can only play back a data file every time, this causes DPI equipment synchronization to be only capable of carrying out DPI survey according to a data message
Examination, the efficiency for causing DPI to test are lower.Meanwhile DPI equipment carries out the source address and purpose of each data message of DPI test
Site homogeneous is same, and DPI test is single, and test effect is poor.
For the efficiency for improving DPI test, the test effect of DPI is improved, the embodiment of the present application provides a kind of message playback
Method.This method can be applied in any electronic equipment (server as shown in Figure 1).In the message back method, determine
To playback file, and extract the load information to data message each in playback file；Construct preset quantity source address difference
Corresponding, specified protocol type heading；For each load information extracted, it is respectively adopted in preset quantity source address
The corresponding heading of each source address is carried out to the load information plus encapsulation process, obtains the corresponding preset quantity of the load information
Reconstruct data message；Each load information is sent to DPI equipment using the corresponding thread of source address each in preset quantity source address
Corresponding each reconstruct data message.Respectively reconstruct data message carries out DPI test to DPI equipment based on the received.
Test Networking as shown in Figure 1, the Test Networking include at least server 100, DPI equipment 110.Wherein, DPI equipment
110 can be the communication equipments such as firewall box, gateway, router, interchanger.When having the function of DPI on communication equipment, so that it may
With referred to as DPI equipment.Further, Test Networking can also include the client 120 being connected with DPI equipment 110.
In technical solution provided by the embodiments of the present application, be previously stored in server 100 it is multiple to playback file (such as
Pacp file), server 100 is determined to need to play back multiple to playback file according to configuration file, and extracts wait play back
The payload information of each data message in file；Be provided with multiple and different source address (source IP address in server 100 in advance
And/or source port information), server 100 constructs corresponding, specified protocol a heading for each source address respectively, and
A corresponding transmission thread is constructed respectively for each source address；Server 100 is using each heading of building respectively to extraction
Each payload information out carries out plus encapsulation process, obtains the corresponding each reconstruct data message of each payload information,
Corresponding reconstruct data message is sent to DPI equipment 110, Huo Zhefa respectively using each transmission thread established by server 100
It send to client 120 (being sent to client 120 for data message is reconstructed by DPI equipment 110)；So that DPI equipment 110
DPI test is carried out according to each reconstruct data message received.
In summary, in technical solution provided by the embodiments of the present application, server opens multiple threads, and multiple threads can
Multiple reconstruct data messages are forwarded simultaneously, realize Batch sending data message, DPI equipment can be simultaneously according to multiple data messages
DPI test is carried out, the efficiency of DPI test is effectively increased.In addition, the reconstruct data message that a variety of source addresses are different, DPI test
Diversification improves the test effect of DPI.
Below by specific embodiment, the application is described in detail.
With reference to Fig. 2, Fig. 2 is a kind of flow diagram of message back method provided by the embodiments of the present application.This method can
To be applied in any electronic equipment, for ease of understanding, it is illustrated by taking server as an example below.Above-mentioned message back method packet
Include following steps.
Step 201, it determines to playback file, and extracts the load information to data message each in playback file.
It can be pcap file to playback file in the embodiment of the present application.One to include one or more in playback file
A data message.Data message can be UDP (User Datagram Protocol, User Datagram Protocol) message, can also
Think TCP (Transmission Control Protocol, transmission control protocol) message.Data message include heading and
Load information.
In one embodiment of the application, it can will be stored under specified directory to playback file list, by specified mesh
Record is stored in configuration file.When carrying out message playback, server reads the specified directory in configuration file, traverses specified mesh
Record under to playback file list, obtain to playback file.To include one or more in playback file list to playback file.
Server is being got after playback file, extracts the load information to data message each in playback file.
The protocol type of playback message, i.e. specified protocol are preset in one embodiment of the application, in server
Type.Server extracts the load information to specify the data message of protocol type in playback file.In addition, for convenient for subsequent place
Reason, server carry out queue caching to the load information extracted.Wherein, specified protocol type can be UDP or TCP.
For example, including data message 11, data message 12 and data message 13 to playback file.Data message 11 includes carrying
Lotus information 11, data message 12 include load information 12, and data message 13 includes load information 13.If data message 11 and data
Message 12 is the message of udp protocol, and data message 13 is the message of Transmission Control Protocol.If specified protocol type is UDP, server
Load information 11 and load information 12 are extracted to playback file, and load information 11 and load information 12 are subjected to queue and delayed
It deposits.
If a kind of data message of protocol type is encapsulated as the data message of another protocol type by server.As incited somebody to action
The data message of UDP is encapsulated as the data message of TCP, it is likely that causes not identifying.Server is extracted in playback file one
The data message of kind protocol type reconstructs data message, it is ensured that the data message energy of reconstruct according still further to this kind of protocol type
It is enough identified.
Step 202, building preset quantity source address is corresponding, heading of specified protocol type, and establishes in advance
If the corresponding thread of quantity source address.
In the embodiment of the present application, source address can be source IP address and/or source port.The heading packet of specified protocol type
Include specified protocol head and IP head.Specified protocol head can be UDP or TCP header.
Certain amount source address, i.e. preset quantity source address are previously stored in server, for each source address,
Construct corresponding, specified protocol type a heading.
In one embodiment, the destination address and preset quantity source address for reconstructing data message be can store in configuration text
In part.When playing back message, server gets the destination address and preset quantity of reconstruct data message from configuration file
Source address, and then construct that preset quantity source address is corresponding, heading of specified protocol type.
In one embodiment, for a source address in preset quantity source address, server uses raw socket
Construct that the source address is corresponding, heading of specified protocol type.Wherein, which is appointing in preset quantity source address
One source address.
Further, for a source address in preset quantity source address, server establish the source address it is corresponding,
For sending the thread of reconstruct data message.Wherein, which is any source address in preset quantity source address.
For example, it is assumed that preset quantity source address includes: IP1, IP2 and IP3, then, server is with can constructing source IP
Location is the heading 1 of IP1, the heading 3 that the heading 2 and source IP address that source IP address is IP2 are IP3.In addition, server is also
It can establish the corresponding thread 1 of IP1, the corresponding thread 2 of IP2 thread 3 corresponding with IP3, it is understood that corresponding for heading 1
Thread 1, the corresponding thread 2 of heading 2 and the corresponding thread 3 of heading 3.Reconstruct data message is sent using thread subsequent
When, the source IP address that data message carries can be reconstructed according to one and determine corresponding thread, and using the thread determined
Send this reconstruct data message.
In the embodiment of the present application, heading is constructed using raw socket, the different heading of source address can be generated.No
It may be the same or different with the destination address in the heading of reconstruct data message.In order to reduce the purpose equipment of deployment,
Network cost is reduced, can set identical for the destination address in the heading of different reconstruct data messages.
Step 203, using the corresponding heading of source address each in preset quantity source address, respectively to each load extracted
Lotus information carries out plus encapsulation process, obtains the corresponding preset quantity reconstruct data message of each load information.
Server is directed to any load information extracted, is believed using the corresponding heading of each source address any load
Breath carries out plus encapsulation process, obtains the corresponding preset quantity of any load information and reconstructs data message.
For example, server extracts load information 11 and load information 12.Preset quantity source address include IP11 and
IP12.Server construction IP11 is corresponding, specified protocol type heading 11 and IP11 are corresponding, specified protocol type
Heading 12.
For load information 11, server is carried out using heading 11 to load information 11 plus encapsulation process, obtains load
The corresponding reconstruct data message 111 of information 11；Server is carried out using heading 12 to load information 11 plus encapsulation process, obtains
The corresponding reconstruct data message 112 of load information 11.
For load information 12, server is carried out using heading 11 to load information 12 plus encapsulation process, obtains load
The corresponding reconstruct data message 121 of information 12；Server is carried out using heading 12 to load information 12 plus encapsulation process, obtains
The corresponding reconstruct data message 122 of load information 11.
Step 204, using the corresponding thread of source address each in preset quantity source address, each reconstruct is sent to DPI equipment
Data message, so that DPI equipment reconstructs data message based on the received and carries out DPI test.
Multiple threads are opened on server, multiple threads can forward multiple reconstruct data messages simultaneously, and then can realize
Batch sending data message, DPI equipment can carry out DPI test according to multiple data messages simultaneously, effectively increase DPI test
Efficiency.In addition, the reconstruct data message that a variety of source addresses are different, DPI test diversification, improve the test effect of DPI.
In one embodiment, server is using the corresponding thread of source address each in preset quantity source address, to DPI equipment
Sending the corresponding each reconstruct data message of each load information can be with are as follows: for each reconstruct data message in each reconstruct data message
Following operation is executed respectively: the corresponding thread of source address that data message carries is reconstructed using one, by this reconstruct data
Message is sent to DPI equipment.
Still it is illustrated by taking the example in step 203 as an example.For example, server obtains the corresponding reconstruct data of heading 11
Message 111 and reconstruct data message 121 obtain the corresponding reconstruct data message 112 of heading 12 and reconstruct data message 122.
Heading 11 corresponds to IP11, the corresponding IP12 of heading 12.Server is using the corresponding forwarding of the thread 11 reconstruct data message of IP11
111 and reconstruct data message 121, using IP12 corresponding thread 12 forwarding reconstruct data message 112 and reconstruct data message
122。
That is, server is carried out using heading 11 to load information 11 and load information 12 plus encapsulation process, obtain
Weight is sent to reconstruct data message 111 and reconstruct data message 121, and using thread 11 corresponding with heading 11 (i.e. IP11)
Structure data message 111 and reconstruct data message 121；Meanwhile server uses heading 12 to load information 11 and load information
12 carry out adding encapsulation process, obtain reconstruct data message 112 and reconstruct data message 122, and use heading 12 (i.e. IP12)
Corresponding thread 12 sends reconstruct data message 112 and reconstruct data message 122.
In one embodiment, the heading of building and the thread of foundation are corresponded.Server is sending each reconstruct data
When message, thread corresponding with the heading can be determined, and then use the message according to the heading of reconstruct data message
Corresponding thread sends the reconstruct data message to DPI equipment.
For example, it is assumed that thread corresponding with heading 11 is thread 11, thread corresponding with heading 12 is thread 12, that
, sealing up the reconstruct data message obtained after dress using heading 11 can be used the transmission of thread 11, be sealed up using heading 12
The transmission of thread 12 can be used in the reconstruct data message obtained after dress.
In one embodiment of the application, if specified protocol type is TCP, sent out using multiple threads to DPI equipment
Before sending each reconstruct data message, server establishes the corresponding TCP channel of each thread by three-way handshake, with DPI equipment.
Later, server sends each reconstruct datagram to DPI equipment using multiple threads by the corresponding TCP channel of each thread
Text.
Using TCP channel, Batch sending data message may be implemented, but server needs to handle response message, establishes TCP
It is more to expend resource for channel, and realizes that difficulty is big.In one embodiment, specified protocol type can be UDP.If specified protocol class
Type is UDP, before sending each reconstruct data message to DPI equipment using multiple threads, it is not necessary to establish TCP channel, it is not necessary to
Response message is handled, the resource of consuming is reduced, reduces realization difficulty.
In one embodiment of the application, playback number, i.e. destination number are provided in advance.It is sent to DPI equipment
When each reconstruct data message, for any reconstruct data message, server is using any source address for reconstructing data message
Corresponding thread sends destination number time any reconstruct data message to DPI equipment.It is sent out in this way, batch equally may be implemented
Data message is sent, the accuracy and reliability of DPI test is improved.
In another embodiment of the application, the corresponding playback number of each source address, i.e., each source address are provided in advance
Corresponding destination number.When sending each reconstruct data message to DPI equipment, for any reconstruct data message, server
Using the corresponding thread of source address of any reconstruct data message, the source of any reconstruct data message is sent to DPI equipment
The corresponding destination number time any reconstruct data message in address.
A kind of message playback reproducer corresponding with above-mentioned message back method embodiment, that the embodiment of the present application also provides.Ginseng
Fig. 3 is examined, Fig. 3 is a kind of structural schematic diagram of message playback reproducer provided by the embodiments of the present application.The device includes extraction unit
301, construction unit 302, encapsulation unit 303 and transmission unit 304.
Extraction unit 301 for determining to playback file, and extracts the load letter to data message each in playback file
Breath；
Construction unit 302, preset quantity source address is corresponding, heading of specified protocol type for constructing,
And establish the corresponding thread of preset quantity source address；
Encapsulation unit 303 is used for using the corresponding heading of source address each in preset quantity source address, respectively to extraction
Each load information out carries out plus encapsulation process, obtains the corresponding preset quantity reconstruct data message of each load information；
Transmission unit 304, for being sent out to DPI equipment using the corresponding thread of source address each in preset quantity source address
Each reconstruct data message is sent, so that respectively reconstruct data message carries out DPI test to the DPI equipment based on the received.
Optionally, extraction unit 301 specifically can be used for:
The load information to specify the data message of protocol type in playback file is extracted, and to the load information extracted
Carry out queue caching.
Optionally, construction unit 302 specifically can be used for:
For each source address in preset quantity source address, corresponding using each source address of raw socket building,
The heading of specified protocol type.
Optionally, transmission unit 304 specifically can be used for:
Following operation is executed respectively for each reconstruct data message in each reconstruct data message: using a reconstruct data
The corresponding thread of source address that message carries, is sent to DPI equipment for this reconstruct data message.
Optionally, specified protocol type is UDP or TCP；Source address is source IP address and/or source port.
In technical solution provided by the embodiments of the present application, multiple threads are opened, multiple threads can forward multiple heavy simultaneously
Structure data message, realizes Batch sending data message, and DPI equipment can carry out DPI test according to multiple data messages simultaneously, have
Effect improves the efficiency of DPI test.In addition, the reconstruct data message that a variety of source addresses are different, DPI test diversification, improve
The test effect of DPI.
Corresponding with above-mentioned message back method embodiment, the embodiment of the present application also provides a kind of electronic equipment, such as Fig. 4 institute
Show, including processor 401 and machine readable storage medium 402, machine readable storage medium 402 is stored with can be by processor
401 machine-executable instructions executed.Processor 401 is promoted to realize that above-mentioned message shown in Fig. 2 is returned by machine-executable instruction
Put the either step of method.Wherein, message back method, comprising:
It determines to playback file, and extracts the load information to data message each in playback file；
Construct that preset quantity source address is corresponding, heading of specified protocol type, and it is a to establish preset quantity
The corresponding thread of source address；
Using the corresponding heading of source address each in preset quantity source address, respectively to each load information extracted into
Row plus encapsulation process obtain the corresponding preset quantity reconstruct data message of each load information；
Using the corresponding thread of source address each in preset quantity source address, each reconstruct data message is sent to DPI equipment,
So that respectively reconstruct data message carries out DPI test to DPI equipment based on the received.
In technical solution provided by the embodiments of the present application, multiple threads are opened, multiple threads can forward multiple heavy simultaneously
Structure data message, realizes Batch sending data message, and DPI equipment can carry out DPI test according to multiple data messages simultaneously, have
Effect improves the efficiency of DPI test.In addition, the reconstruct data message that a variety of source addresses are different, DPI test diversification, improve
The test effect of DPI.
In addition, as shown in figure 4, electronic equipment can also include: communication interface 403 and communication bus 404；Wherein, it handles
Device 401, machine readable storage medium 402, communication interface 403 complete mutual communication, communication interface by communication bus 404
403 for the communication between above-mentioned electronic equipment and other equipment.
Corresponding with above-mentioned message back method embodiment, the embodiment of the present application also provides a kind of machine readable storage Jie
Matter is stored with machine-executable instruction, and when being called and being executed by processor, machine-executable instruction promotes processor to realize
State the either step of message back method shown in Fig. 2.
Above-mentioned communication bus can be PCI (Peripheral Component Interconnect, Peripheral Component Interconnect
Standard) bus or EISA (Extended Industry Standard Architecture, expanding the industrial standard structure) bus
Deng.The communication bus can be divided into address bus, data/address bus, control bus etc..
Above-mentioned machine readable storage medium may include RAM (Random Access Memory, random access memory),
It also may include NVM (Non-Volatile Memory, nonvolatile memory), for example, at least a magnetic disk storage.Separately
Outside, machine readable storage medium can also be that at least one is located remotely from the storage device of aforementioned processor.
Above-mentioned processor can be general processor, including CPU (Central Processing Unit, central processing
Device), NP (Network Processor, network processing unit) etc.；Can also be DSP (Digital SignalProcessing,
Digital signal processor), ASIC (Application Specific Integrated Circuit, specific integrated circuit),
It is FPGA (Field-Programmable Gate Array, field programmable gate array) or other programmable logic device, discrete
Door or transistor logic, discrete hardware components.
It should be noted that, in this document, relational terms such as first and second and the like are used merely to a reality
Body or operation are distinguished with another entity or operation, are deposited without necessarily requiring or implying between these entities or operation
In any actual relationship or order or sequence.Moreover, the terms "include", "comprise" or its any other variant are intended to
Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those
Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment
Intrinsic element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that
There is also other identical elements in process, method, article or equipment including the element.
Each embodiment in this specification is all made of relevant mode and describes, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.It is returned especially for message
For putting device, electronic equipment, machine readable storage medium embodiment, implement since it is substantially similar to message back method
Example, so being described relatively simple, related place illustrates referring to the part of message back method embodiment.
The foregoing is merely the preferred embodiments of the application, are not intended to limit the protection scope of the application.It is all
Any modification, equivalent replacement, improvement and so within spirit herein and principle are all contained in the protection scope of the application
It is interior.
Claims (12)
1. a kind of message back method, which is characterized in that the described method includes:
It determines to playback file, and extracts the load information to data message each in playback file；
Construct that preset quantity source address is corresponding, heading of specified protocol type, and it is a to establish the preset quantity
The corresponding thread of source address；
Using the corresponding heading of source address each in the preset quantity source address, respectively to each load information extracted into
Row plus encapsulation process obtain the corresponding preset quantity reconstruct data message of each load information；
Using the corresponding thread of source address each in the preset quantity source address, sent to deep message detection DPI equipment each
Data message is reconstructed, so that respectively reconstruct data message carries out DPI test to the DPI equipment based on the received.
2. the method according to claim 1, wherein to data message each in playback file described in the extraction
The step of load information, comprising:
The load information of the data message to specified protocol type described in playback file is extracted, and to the load extracted
Information carries out queue caching.
3. according to the method described in claim 2, it is characterized in that, the building preset quantity source address it is corresponding,
The step of heading of specified protocol type, comprising:
For each source address in the preset quantity source address, corresponding using each source address of raw socket building,
The heading of specified protocol type.
4. the method according to claim 1, wherein it is described using each source in the preset quantity source address
The step of corresponding thread in location, each reconstruct data message corresponding to each load information of DPI equipment transmission, comprising:
Following operation is executed respectively for each reconstruct data message in each reconstruct data message: using a reconstruct data message
This reconstruct data message is sent to DPI equipment by the corresponding thread of the source address of carrying.
5. method according to claim 1-4, which is characterized in that the specified protocol type is user datagram
Agreement UDP or transmission control protocol TCP；
The source address is source network Protocol IP address and/or source port.
6. a kind of message playback reproducer, which is characterized in that described device includes:
Extraction unit for determining to playback file, and extracts the load information to data message each in playback file；
Construction unit, preset quantity source address is corresponding, heading of specified protocol type for constructing, and establishes institute
State the corresponding thread of preset quantity source address；
Encapsulation unit, for using the corresponding heading of source address each in the preset quantity source address, respectively to extracting
Each load information carry out plus encapsulation process, obtain the corresponding preset quantity of each load information and reconstruct data message；
Transmission unit, for being detected to deep message using the corresponding thread of source address each in the preset quantity source address
DPI equipment sends each reconstruct data message, so that respectively reconstruct data message carries out DPI test to the DPI equipment based on the received.
7. device according to claim 6, which is characterized in that the extraction unit is specifically used for:
The load information of the data message to specified protocol type described in playback file is extracted, and to the load extracted
Information carries out queue caching.
8. device according to claim 7, which is characterized in that the construction unit is specifically used for:
For each source address in the preset quantity source address, corresponding using each source address of raw socket building,
The heading of specified protocol type.
9. device according to claim 6, which is characterized in that the transmission unit is specifically used for:
Following operation is executed respectively for each reconstruct data message in each reconstruct data message: using a reconstruct data message
This reconstruct data message is sent to DPI equipment by the corresponding thread of the source address of carrying.
10. according to the described in any item devices of claim 6-9, which is characterized in that the specified protocol type is user data
Datagram protocol UDP or transmission control protocol TCP；
The source address is source network Protocol IP address and/or source port.
11. a kind of electronic equipment, which is characterized in that including processor and machine readable storage medium, the machine readable storage
Media storage has the machine-executable instruction that can be executed by the processor, and the processor is by the machine-executable instruction
Promote: realizing any method and step of claim 1-5.
12. a kind of machine readable storage medium, which is characterized in that be stored with machine-executable instruction, by processor call and
When execution, the machine-executable instruction promotes the processor: realizing any method and step of claim 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811237036.6A CN109412893B (en) | 2018-10-23 | 2018-10-23 | Message playback method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811237036.6A CN109412893B (en) | 2018-10-23 | 2018-10-23 | Message playback method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109412893A true CN109412893A (en) | 2019-03-01 |
| CN109412893B CN109412893B (en) | 2020-06-19 |
Family
ID=65468404
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811237036.6A Active CN109412893B (en) | 2018-10-23 | 2018-10-23 | Message playback method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109412893B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110912783A (en) * | 2019-12-18 | 2020-03-24 | 北京嘀嘀无限科技发展有限公司 | Flow playback method and device, electronic equipment and storage medium |
| CN111935533A (en) * | 2020-07-06 | 2020-11-13 | 南京熊猫电子股份有限公司 | Multi-source measurement and control data playback method for unmanned aerial vehicle |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101605018A (en) * | 2009-06-17 | 2009-12-16 | 中兴通讯股份有限公司 | A kind of decoding depth message detection protocol method, equipment and system based on stream |
| CN102497297A (en) * | 2011-12-13 | 2012-06-13 | 曙光信息产业(北京)有限公司 | System and method for realizing deep packet inspection technology based on multi-core and multi-thread |
| US20120243547A1 (en) * | 2008-12-10 | 2012-09-27 | Avelina Pardo-Blazquez | Token-based correlation of control sessions for policy and charging control of a data session through a nat |
| CN104394090A (en) * | 2014-11-14 | 2015-03-04 | 北京航空航天大学 | SDN (Software Defined Networking) controller classifying network flows through DPI (Deep Packet Inspection) data package |
| CN105847179A (en) * | 2016-03-23 | 2016-08-10 | 武汉绿色网络信息服务有限责任公司 | Method and device for concurrently reporting data in DPI system |
| CN107426059A (en) * | 2017-08-28 | 2017-12-01 | 上海国云信息科技有限公司 | DPI equipment feature databases automatic update method, system, DPI equipment and cloud server |
-
2018
- 2018-10-23 CN CN201811237036.6A patent/CN109412893B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120243547A1 (en) * | 2008-12-10 | 2012-09-27 | Avelina Pardo-Blazquez | Token-based correlation of control sessions for policy and charging control of a data session through a nat |
| CN101605018A (en) * | 2009-06-17 | 2009-12-16 | 中兴通讯股份有限公司 | A kind of decoding depth message detection protocol method, equipment and system based on stream |
| CN102497297A (en) * | 2011-12-13 | 2012-06-13 | 曙光信息产业(北京)有限公司 | System and method for realizing deep packet inspection technology based on multi-core and multi-thread |
| CN104394090A (en) * | 2014-11-14 | 2015-03-04 | 北京航空航天大学 | SDN (Software Defined Networking) controller classifying network flows through DPI (Deep Packet Inspection) data package |
| CN105847179A (en) * | 2016-03-23 | 2016-08-10 | 武汉绿色网络信息服务有限责任公司 | Method and device for concurrently reporting data in DPI system |
| CN107426059A (en) * | 2017-08-28 | 2017-12-01 | 上海国云信息科技有限公司 | DPI equipment feature databases automatic update method, system, DPI equipment and cloud server |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110912783A (en) * | 2019-12-18 | 2020-03-24 | 北京嘀嘀无限科技发展有限公司 | Flow playback method and device, electronic equipment and storage medium |
| CN111935533A (en) * | 2020-07-06 | 2020-11-13 | 南京熊猫电子股份有限公司 | Multi-source measurement and control data playback method for unmanned aerial vehicle |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109412893B (en) | 2020-06-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10699026B2 (en) | Internal controls engine and reporting of events generated by a network or associated applications | |
| US10084642B2 (en) | Automated sensing of network conditions for dynamically provisioning efficient VPN tunnels | |
| US10129097B2 (en) | GUI and high-level API wrapper for software defined networking and software defined access for controlling network routing and rules | |
| CN111130931B (en) | Detection method and device for illegal external connection equipment | |
| CN103501486B (en) | A kind of information push method and push server | |
| WO2017140216A1 (en) | Method and device for network load balancing, control, and network interaction | |
| US9379952B2 (en) | Monitoring NAT behaviors through URI dereferences in web browsers | |
| US20140126387A1 (en) | Endpoint selection in a network test system | |
| CN110380935B (en) | Port scanning method and device | |
| CN102025567A (en) | Sharing access detection method and related device | |
| Frolov et al. | Detecting Probe-resistant Proxies. | |
| CN109412893A (en) | A kind of message back method and device | |
| CN105245407A (en) | Network sniffer based on socket and method thereof | |
| US7599365B1 (en) | System and method for detecting a network packet handling device | |
| US7590725B1 (en) | Network analyzer system, method and computer program product for multi-dimensional analysis of network tunnels | |
| US8966321B2 (en) | Logical port and layer protocol test configuration resource manager | |
| US9804899B2 (en) | Communications using the common object request broker architecture (CORBA) | |
| Malik et al. | XMPP architecture and security challenges in an IoT ecosystem | |
| CN109347696B (en) | Network protocol fuzzy test method based on hierarchical variation | |
| CN110138682A (en) | A kind of method for recognizing flux and device | |
| Okunade | Manipulating e-mail server feedback for spam prevention | |
| CN105634839B (en) | A kind of method and apparatus for obtaining network reachable address space | |
| Singh | Implementing Cisco Networking Solutions: Configure, implement, and manage complex network designs | |
| Gamer et al. | Distack--a framework for anomaly-based large-scale attack detection | |
| Ghazali et al. | Enhanced IPFIX flow monitoring for VXLAN based cloud overlay networks. |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |