CN111817915B - DPDK-based protocol analysis system - Google Patents
DPDK-based protocol analysis system Download PDFInfo
- Publication number
- CN111817915B CN111817915B CN202010630447.2A CN202010630447A CN111817915B CN 111817915 B CN111817915 B CN 111817915B CN 202010630447 A CN202010630447 A CN 202010630447A CN 111817915 B CN111817915 B CN 111817915B
- Authority
- CN
- China
- Prior art keywords
- data
- protocol data
- protocol
- modules
- tcp
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/18—Protocol analysers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/12—Network monitoring probes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/164—Adaptation or special uses of UDP protocol
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The embodiment of the invention provides a DPDK-based protocol analysis system, which is used for realizing an analysis framework of a data protocol and comprises a data acquisition module, a plurality of data sorting modules, a plurality of transmission layer distribution modules and a plurality of layers of data analysis modules, wherein the plurality of data sorting modules, the plurality of transmission layer distribution modules and the plurality of data analysis modules on each layer have corresponding relations, and each module can be bound to an independent CPU core to operate. The embodiment of the invention adopts a DPDK user driving mode to acquire the network data packet at a high speed, realizes high-speed analysis processing of high-speed large-flow data on a general x86 platform, has independent modules and low coupling, and can realize an asynchronous message interaction mechanism among multiple modules; the number of various modules of different types can be expanded along with the scale of data volume, and the provided protocol analysis framework can realize high-speed analysis of high-speed large-flow network data.
Description
Technical Field
The invention belongs to the technical field of data analysis, and particularly relates to a DPDK-based protocol analysis system.
Background
Along with the rapid development of network data, the processing speed is particularly important for processing high-speed and large-flow network data, the traditional method is realized by adding hardware, the hardware cost is high, the performance requirement on the hardware is high, and the development difficulty is high; the X86 platform has strong computing capability, but the traditional network access mode cannot meet the requirement of high-speed large-flow network access.
Disclosure of Invention
To overcome the existing problems or at least partially solve the problems, an embodiment of the present invention provides a DPDK-based protocol parsing system.
The embodiment of the invention provides a DPDK-based protocol analysis framework for realizing analysis of a data protocol, which comprises a data acquisition module, a plurality of data sorting modules, a plurality of transmission layer distribution modules and a plurality of layers of data analysis modules, wherein the data sorting modules, the transmission layer distribution modules and the data analysis modules on each layer have corresponding relations, and each module can be bound to an independent CPU core to operate;
the data acquisition module is used for acquiring network data packets from a high-speed network card by using a DPDK user plane driving mode and uniformly forwarding the network data packets to the data sorting modules;
each data sorting module is used for processing an IP layer of a network data packet, extracting TCP and UDP protocol data in the network data packet, and uniformly forwarding the TCP and UDP protocol data to a plurality of transmission layer distribution modules;
each transmission layer distribution module is used for marking TCP protocol data and UDP protocol data and uniformly transmitting the marked TCP protocol data and UDP protocol data to the plurality of data analysis modules of each layer;
and the data analysis module of each layer is used for analyzing the TCP and UDP protocol data, extracting effective information in the TCP and UDP protocol data and storing the effective information.
On the basis of the above embodiments, the embodiments of the present invention may be further modified as follows.
Optionally, each data sorting module is configured to process an IP layer of a network data packet, extract TCP and UDP protocol data therein, and forward the TCP and UDP protocol data to a plurality of transmission layer distribution modules in a balanced manner, where the transmission layer distribution module includes:
for the IP layer of the network data packet, IP fragments are recombined in a network transmission time sequence, the head information of each IP is stripped, and TCP and UDP protocol data in the IP layers are extracted;
and forwarding the extracted TCP and UDP protocol data to corresponding transmission layer distribution modules, wherein the TCP and UDP protocol data amount in each transmission layer distribution module is equal to that in each transmission layer distribution module.
Optionally, the multiple data analysis modules of each layer include multiple transmission layer analysis modules, multiple application layer distribution modules, multiple application layer base protocol analysis modules, and multiple feature comparison modules;
the transmission layer analysis module is used for extracting effective information in the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module and forwarding the effective information to the application layer distribution module in a balanced manner through a corresponding transmission protocol;
the application layer distribution module is used for identifying the application layer protocols to which the TCP protocol data and the UDP protocol data belong according to the transmission protocol carrying information and the effective information in the TCP protocol data and the UDP protocol data, and uniformly forwarding the application layer protocols to the application layer basic protocol analysis modules;
the application layer basic protocol analysis module is used for analyzing the application layer basic protocol corresponding to the application layer protocol to obtain effective information in the application layer basic protocol, and if the effective information needs to be further analyzed, the effective information is evenly forwarded to the plurality of feature comparison modules;
the characteristic comparison module is used for determining the application type corresponding to the custom protocol data according to the custom protocol data in the effective information and extracting the effective information in the custom protocol data.
Optionally, the transmission layer parsing module is configured to extract effective information in the TCP protocol data and the UDP protocol data forwarded by the transmission layer distributing module, where the effective information includes:
and analyzing the TCP protocol data and the UDP protocol data in a corresponding analysis mode according to the marks of the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module, and respectively extracting effective information in the TCP protocol data and the UDP protocol data.
Optionally, the application layer distribution module is configured to identify, according to the transmission protocol carrying information and effective information in the TCP protocol data and the UDP protocol data, an application layer protocol to which the TCP protocol data and the UDP protocol data belong, and includes:
extracting an output port address, magic bytes and fixed combined keywords according to the carrying information of the transmission protocol and effective information in TCP protocol data and UDP protocol data;
and identifying the application layer protocol to which the TCP protocol data and the UDP protocol data belong according to the port address, the magic byte and the fixed combined keyword.
Optionally, the feature comparison module is configured to determine, according to the custom protocol data in the valid information, an application type corresponding to the custom protocol data, and includes:
and matching in the feature library according to the custom protocol data, and determining the application type corresponding to the feature matched with the custom protocol data in the feature library as the application type of the custom protocol data.
The embodiment of the invention provides a DPDK-based protocol analysis system, which adopts a DPDK user-driven mode to acquire network data packets at a high speed, realizes high-speed analysis processing of high-speed and large-flow data on a general x86 platform by adopting a software layer, has the advantages of mutual independence and low coupling among modules, and can realize an asynchronous message interaction mechanism among multiple modules; the number of various modules of different types can be expanded along with the scale of data volume, and the provided protocol analysis framework can realize high-speed analysis of high-speed large-flow network data.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and those skilled in the art can also obtain other drawings according to the drawings without creative efforts.
Fig. 1 is a schematic structural diagram of a DPDK-based protocol parsing framework according to an embodiment of the present invention;
fig. 2 is a schematic diagram of the internal connection of the data parsing module in fig. 1.
Detailed Description
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and those skilled in the art can also obtain other drawings according to the drawings without creative efforts.
Referring to fig. 1, a DPDK-based protocol parsing framework according to an embodiment of the present invention is provided, and is configured to implement parsing of a data protocol, where the framework includes a data acquisition module, a plurality of data sorting modules, a plurality of transmission layer distribution modules, and a plurality of layers of data parsing modules, where the plurality of data sorting modules, the plurality of transmission layer distribution modules, and the plurality of data parsing modules in each layer have a correspondence, and each module can be bound to an independent CPU core to operate.
The data acquisition module is used for acquiring network data packets from the high-speed network card by using a DPDK user plane driving mode and uniformly forwarding the network data packets to the data sorting modules;
each data sorting module is used for processing an IP layer of a network data packet, extracting TCP and UDP protocol data in the network data packet, and uniformly forwarding the TCP and UDP protocol data to a plurality of transmission layer distribution modules;
each transmission layer distribution module is used for marking TCP protocol data and UDP protocol data and uniformly transmitting the marked TCP protocol data and UDP protocol data to the plurality of data analysis modules of each layer;
and the data analysis module of each layer is used for analyzing the TCP and UDP protocol data, extracting effective information in the TCP and UDP protocol data and storing the effective information.
It can be understood that, in the embodiment of the present invention, a high-speed protocol analysis framework is provided for high-speed large-traffic network data analysis based on a general x86 multi-core server and using an intel open source technology DPDK. A Data Plane Development Kit (DPDK) is mainly operated based on a Linux system, and is used for a function library and a driver set for fast packet processing, so that Data processing performance and throughput can be greatly improved, and the work efficiency of a Data Plane application program can be improved.
Based on a user surface drive and a high-speed multi-queue network card of the DPDK, realizing the high-speed acquisition of mass data; a pipeline model is used on the basis of a DPDK platform, data processing (including data sorting and data analysis) is divided into a plurality of modules with the coupling degrees as low as possible, and the modules are respectively bound to an independent CPU core to run and monopolize CPU resources; the number of various modules of different types can be expanded along with the scale of data volume, and the provided protocol analysis framework can realize high-speed analysis of high-speed large-flow network data.
The data acquisition module acquires network data packets from the high-speed network card by using a DPDK user plane driving mode under the condition of reducing packet loss to the maximum extent, and uniformly forwards the network data packets to the data sorting modules, wherein the number of the network data packets in each data sorting module is equal.
For an IP layer (IP layer) of a network data packet, each data sorting module recombines IP fragments in a network Transmission timing sequence, strips header information of each IP, and extracts TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) Protocol data therein; and forwarding the extracted TCP and UDP protocol data to corresponding transmission layer distribution modules, wherein the TCP and UDP protocol data amount in each transmission layer distribution module is equal to that in each transmission layer distribution module. The data sorting module can be flexibly configured with the corresponding relation between the data sorting module and the transmission layer distribution module according to the scale of the data volume, one data sorting module can correspond to one transmission layer distribution module, one data sorting module can also correspond to a plurality of transmission layer distribution modules, and a plurality of data sorting modules can also correspond to one transmission layer distribution module.
Referring to fig. 2, as an alternative embodiment, the multiple data parsing modules of each layer include multiple transport layer parsing modules, multiple application layer distribution modules, multiple application layer base protocol parsing modules, and multiple feature comparison modules.
The data sorting module forwards the extracted TCP and UDP protocol data to the corresponding transmission layer distribution module, and the corresponding transmission layer distribution module marks and distinguishes the TCP protocol data and the UDP protocol data and forwards the marked TCP protocol data and UDP protocol data to the plurality of data analysis modules.
The transmission layer analysis module is used for extracting effective information in the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module and forwarding the effective information to the application layer distribution module in a balanced manner through a corresponding transmission protocol;
the application layer distribution module is used for identifying the application layer protocols to which the TCP protocol data and the UDP protocol data belong according to the carrying information of the transmission protocol and the effective information in the TCP protocol data and the UDP protocol data, and uniformly forwarding the application layer protocols to the application layer basic protocol analysis modules;
the application layer basic protocol analysis module is used for analyzing the application layer basic protocol corresponding to the application layer protocol to obtain effective information in the application layer basic protocol, and if the effective information needs to be further analyzed, the effective information is evenly forwarded to the plurality of feature comparison modules;
and the characteristic comparison module is used for determining the application type corresponding to the custom protocol data according to the custom protocol data in the effective information and extracting the effective information in the custom protocol data.
As an optional embodiment, the transport layer parsing module, configured to extract valid information in the TCP protocol data and the UDP protocol data forwarded by the transport layer distribution module, includes:
and analyzing the TCP protocol data and the UDP protocol data in a corresponding analysis mode according to the marks of the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module, and respectively extracting effective information in the TCP protocol data and the UDP protocol data.
It can be understood that the transmission layer distribution module marks the TCP protocol data and the UDP protocol data, and the transmission layer analysis module distinguishes the TCP protocol data and the UDP protocol data according to the mark, and analyzes the TCP protocol data and the UDP protocol data in a corresponding analysis manner, so as to extract effective information in the TCP protocol data and the UDP protocol data respectively.
As an optional embodiment, the application layer distribution module is configured to identify, according to the transport protocol carrying information and effective information in the TCP protocol data and the UDP protocol data, an application layer protocol to which the TCP protocol data and the UDP protocol data belong, and includes:
extracting an output port address, magic bytes and fixed combined keywords according to the carrying information of the transmission protocol and effective information in TCP protocol data and UDP protocol data;
and identifying the application layer protocol to which the TCP protocol data and the UDP protocol data belong according to the port address, the magic byte and the fixed combined keyword.
As an optional embodiment, the feature comparison module is configured to determine, according to the custom protocol data in the valid information, an application type corresponding to the custom protocol data, and includes:
and matching in the feature library according to the custom protocol data, and determining the application type corresponding to the feature matched with the custom protocol data in the feature library as the application type of the custom protocol data.
It can be understood that, after the application layer distributes the module port address, the magic byte and the fixed combination keyword, and identifies the application layer protocol to which the TCP protocol data and the UDP protocol data belong, the application layer base protocol analysis module is mainly responsible for analyzing the application layer base protocol determined by the protocol format to extract the effective information in the protocol. And if the protocol data does not need to be further analyzed, storing the extracted effective information. If the protocol data comprises the custom protocol data, the custom protocol data needs to be further analyzed, and the custom protocol data is forwarded to the characteristic comparison module.
The feature comparison module compares and matches the user-defined protocol data with features in the feature library, and determines the application type corresponding to the features matched with the user-defined protocol data in the feature library as the application type of the user-defined protocol data. And after self-defined protocol data is identified, effective information in the self-defined protocol data is extracted, and the extracted effective information is extracted.
According to the protocol analysis framework based on the DPDK, provided by the embodiment of the invention, a DPDK user-driven mode is adopted to acquire network data packets at a high speed, high-speed analysis processing of high-speed large-flow data is realized on a general x86 platform, modules are mutually independent, the coupling is low, and an asynchronous message interaction mechanism among multiple modules can be realized; the number of various modules of different types can be expanded along with the scale of data volume, and the provided protocol analysis framework can realize high-speed analysis of high-speed large-flow network data.
Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (6)
1. A DPDK-based protocol analysis system is used for realizing analysis of a data protocol and is characterized by comprising a data acquisition module, a plurality of data sorting modules, a plurality of transmission layer distribution modules and a plurality of layers of data analysis modules, wherein the data sorting modules, the transmission layer distribution modules and the data analysis modules on each layer have corresponding relations, and each module can be bound to an independent CPU core to operate;
the data acquisition module is used for acquiring network data packets from a high-speed network card by using a DPDK user plane driving mode and uniformly forwarding the network data packets to the data sorting modules;
each data sorting module is used for processing an IP layer of a network data packet, extracting TCP and UDP protocol data in the network data packet, and uniformly forwarding the TCP and UDP protocol data to a plurality of transmission layer distribution modules;
each transmission layer distribution module is used for marking TCP protocol data and UDP protocol data and uniformly transmitting the marked TCP protocol data and UDP protocol data to the plurality of data analysis modules of each layer;
and the data analysis module of each layer is used for analyzing the TCP and UDP protocol data, extracting effective information in the TCP and UDP protocol data and storing the effective information.
2. The DPDK-based protocol parsing system of claim 1, wherein each of the data sorting modules is configured to process an IP layer of a network packet, extract TCP and UDP protocol data therein, and forward the TCP and UDP protocol data to the plurality of transport layer distribution modules in a balanced manner, and includes:
for the IP layer of the network data packet, IP fragments are recombined in a network transmission time sequence, the head information of each IP is stripped, and TCP and UDP protocol data in the IP layers are extracted;
and forwarding the extracted TCP and UDP protocol data to corresponding transmission layer distribution modules, wherein the TCP and UDP protocol data amount in each transmission layer distribution module is equal to that in each transmission layer distribution module.
3. The DPDK-based protocol parsing system of claim 1 or 2, wherein the plurality of data parsing modules of each layer includes a plurality of transport layer parsing modules, a plurality of application layer distribution modules, a plurality of application layer base protocol parsing modules, a plurality of feature comparison modules;
the transmission layer analysis module is used for extracting effective information in the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module and forwarding the effective information to the application layer distribution module in a balanced manner through a corresponding transmission protocol;
the application layer distribution module is used for identifying the application layer protocols to which the TCP protocol data and the UDP protocol data belong according to the transmission protocol carrying information and the effective information in the TCP protocol data and the UDP protocol data, and uniformly forwarding the application layer protocols to the application layer basic protocol analysis modules;
the application layer basic protocol analysis module is used for analyzing the application layer basic protocol corresponding to the application layer protocol to obtain effective information in the application layer basic protocol, and if the effective information needs to be further analyzed, the effective information is evenly forwarded to the plurality of feature comparison modules;
the characteristic comparison module is used for determining the application type corresponding to the custom protocol data according to the custom protocol data in the effective information and extracting the effective information in the custom protocol data.
4. The DPDK-based protocol parsing system of claim 3, wherein the transport layer parsing module, configured to extract valid information in the TCP protocol data and UDP protocol data forwarded by the transport layer distribution module, includes:
and analyzing the TCP protocol data and the UDP protocol data in a corresponding analysis mode according to the marks of the TCP protocol data and the UDP protocol data forwarded by the transmission layer distribution module, and respectively extracting effective information in the TCP protocol data and the UDP protocol data.
5. The DPDK-based protocol parsing system of claim 3, wherein the application layer distribution module is configured to identify, according to the transmission protocol carrying information and effective information in the TCP protocol data and the UDP protocol data, an application layer protocol to which the TCP protocol data and the UDP protocol data belong, and includes:
extracting an output port address, magic bytes and fixed combined keywords according to the carrying information of the transmission protocol and effective information in TCP protocol data and UDP protocol data;
and identifying the application layer protocol to which the TCP protocol data and the UDP protocol data belong according to the port address, the magic byte and the fixed combined keyword.
6. The DPDK-based protocol parsing system of claim 3, wherein the feature comparison module is configured to determine, according to the custom protocol data in the valid information, the application type corresponding to the custom protocol data by:
and matching in the feature library according to the custom protocol data, and determining the application type corresponding to the feature matched with the custom protocol data in the feature library as the application type of the custom protocol data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010630447.2A CN111817915B (en) | 2020-06-30 | 2020-06-30 | DPDK-based protocol analysis system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010630447.2A CN111817915B (en) | 2020-06-30 | 2020-06-30 | DPDK-based protocol analysis system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111817915A CN111817915A (en) | 2020-10-23 |
| CN111817915B true CN111817915B (en) | 2022-04-01 |
Family
ID=72856717
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010630447.2A Active CN111817915B (en) | 2020-06-30 | 2020-06-30 | DPDK-based protocol analysis system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111817915B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112532614A (en) * | 2020-11-25 | 2021-03-19 | 国网辽宁省电力有限公司信息通信分公司 | Safety monitoring method and system for power grid terminal |
| CN113098780B (en) * | 2021-02-22 | 2023-04-28 | 网宿科技股份有限公司 | Message processing method of virtual network, electronic equipment and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013040438A1 (en) * | 2011-09-15 | 2013-03-21 | Fisher-Rosemount Systems, Inc. | Communicating data frames across communication networks that use incompatible network routing protocols |
| WO2017219009A1 (en) * | 2016-06-18 | 2017-12-21 | StarFlow Networks, Inc. | Intelligent adaptive transport layer to enhance performance using multiple channels |
| CN108282412A (en) * | 2018-01-19 | 2018-07-13 | 世纪龙信息网络有限责任公司 | Network shunt method, apparatus, system and computer equipment |
| CN109445944A (en) * | 2018-10-25 | 2019-03-08 | 武汉虹旭信息技术有限责任公司 | A kind of network data acquisition processing system and its method based on DPDK |
| CN110971487A (en) * | 2019-11-26 | 2020-04-07 | 武汉虹信通信技术有限责任公司 | Network protocol identification method and device |
| CN111107081A (en) * | 2019-12-17 | 2020-05-05 | 互联网域名系统北京市工程研究中心有限公司 | DPDK-based multi-process DNS service method and system |
-
2020
- 2020-06-30 CN CN202010630447.2A patent/CN111817915B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013040438A1 (en) * | 2011-09-15 | 2013-03-21 | Fisher-Rosemount Systems, Inc. | Communicating data frames across communication networks that use incompatible network routing protocols |
| WO2017219009A1 (en) * | 2016-06-18 | 2017-12-21 | StarFlow Networks, Inc. | Intelligent adaptive transport layer to enhance performance using multiple channels |
| CN109565471A (en) * | 2016-06-18 | 2019-04-02 | 科里维网络有限公司 | High performance intelligent adaptive transport layer is proposed using multichannel |
| CN108282412A (en) * | 2018-01-19 | 2018-07-13 | 世纪龙信息网络有限责任公司 | Network shunt method, apparatus, system and computer equipment |
| CN109445944A (en) * | 2018-10-25 | 2019-03-08 | 武汉虹旭信息技术有限责任公司 | A kind of network data acquisition processing system and its method based on DPDK |
| CN110971487A (en) * | 2019-11-26 | 2020-04-07 | 武汉虹信通信技术有限责任公司 | Network protocol identification method and device |
| CN111107081A (en) * | 2019-12-17 | 2020-05-05 | 互联网域名系统北京市工程研究中心有限公司 | DPDK-based multi-process DNS service method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111817915A (en) | 2020-10-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112468370B (en) | High-speed network message monitoring and analyzing method and system supporting custom rules | |
| WO2021082339A1 (en) | Machine learning and rule matching integrated security detection method and device | |
| CN107911237B (en) | DPDK-based rapid detection method for data packets in user space | |
| CN111371779B (en) | Firewall based on DPDK virtualization management system and implementation method thereof | |
| Lu et al. | {ServerSwitch}: A Programmable and High Performance Platform for Data Center Networks | |
| CN101656677B (en) | Message diversion processing method and device | |
| JP5167501B2 (en) | Network monitoring system and its operation method | |
| EP1196856B1 (en) | Method and apparatus for monitoring traffic in a network | |
| CN111817915B (en) | DPDK-based protocol analysis system | |
| WO2022088779A1 (en) | Deep packet processing method and apparatus, electronic device, and storage medium | |
| CN105162626B (en) | Network flow depth recognition system and recognition methods based on many-core processor | |
| CN102347949B (en) | Application protocol analysis method based on DPI (Distributed Protocol Interface) | |
| US20130318107A1 (en) | Generating data feed specific parser circuits | |
| CN106330584A (en) | Identification method and identification device of business flow | |
| WO2021164261A1 (en) | Method for testing cloud network device, and storage medium and computer device | |
| TWI745034B (en) | Method of aggregating and disaggregating packet | |
| CN112347020A (en) | FAST market analysis system and method based on CGRA | |
| CN108289125A (en) | TCP sessions recombination based on Stream Processing and statistical data extracting method | |
| CN109672594B (en) | IPoE message processing method and device and broadband remote access server | |
| US7958265B2 (en) | Coding method of vector network address | |
| US7814219B2 (en) | Method, apparatus, system, and article of manufacture for grouping packets | |
| CN102523208A (en) | Application layer protocol parallel processing method under multi-core architecture | |
| WO2011135181A1 (en) | Method and arrangement for message analysis | |
| CN113285904A (en) | RDP-based method for analyzing disk mapping file information | |
| CN115396363B (en) | Flow classification method and system in SDN network environment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |