CN114024924A - TCP stream recombination method and device, electronic equipment and storage medium - Google Patents
TCP stream recombination method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN114024924A CN114024924A CN202210003638.5A CN202210003638A CN114024924A CN 114024924 A CN114024924 A CN 114024924A CN 202210003638 A CN202210003638 A CN 202210003638A CN 114024924 A CN114024924 A CN 114024924A
- Authority
- CN
- China
- Prior art keywords
- tcp
- message
- cache
- messages
- linked list
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/90—Buffering arrangements
- H04L49/9057—Arrangements for supporting packet reassembly or resequencing
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a TCP stream recombination method, a device, electronic equipment and a storage medium, wherein the method comprises the following steps: acquiring a TCP message in a TCP stream, and judging whether the TCP message is out of order or not based on a message serial number of the TCP message; when the TCP messages are out of order, inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large to obtain a plurality of cache TCP messages; judging whether the TCP cache linked list reaches the maximum cache quota; and when the TCP cache linked list reaches the maximum cache quota, locally recombining the plurality of cache TCP messages in the TCP cache linked list to obtain locally recombined TCP packets. The invention realizes the aim that the TCP message can still be recombined under the condition that the TCP stream encounters network packet loss, and avoids the blockage of the TCP stream recombination.
Description
Technical Field
The invention relates to the technical field of network security, in particular to a TCP stream recombination method, a device, electronic equipment and a storage medium.
Background
In the field of network security, network traffic needs to be analyzed, packet loss of a TCP message and further out-of-order transmission can occur due to routing and jitter of network transmission and a retransmission mechanism of the TCP in the network traffic, and in the process of analyzing the network traffic, the TCP message in the TCP traffic needs to be recombined, for example, the HTTP traffic is borne on a TCP protocol, and if the TCP message is out-of-order, the analysis of the HTTP traffic is incorrect.
A common TCP flow reassembly method is to insert out-of-order TCP packets into a buffer linked list according to the sequence of the packet sequence number (seq), copy and splice the TCP load parts of all packets in the linked list into a complete segment of application layer data when the missing packets arrive, and then send the complete segment of application layer data to an application analysis engine for analysis.
However, the existing method has the following problems: when the TCP message is lost in the cache linked list, the TCP message cannot be recombined, the cached messages in the cache linked list are continuously increased until the maximum cache limit is reached, and when the data cache in the cache linked list is full, the TCP stream recombination can be blocked, so that the subsequent disordered messages cannot be recombined, the TCP message which cannot be recombined can be retained in the cache linked list, and the technical problem that an analysis engine cannot receive and analyze the TCP stream is caused.
Disclosure of Invention
In view of this, it is necessary to provide a TCP flow reassembly method, an apparatus, an electronic device, and a storage medium, so as to solve the technical problems in the prior art that when a TCP packet is lost in a cache chain table, a TCP cannot complete reassembly, so that a TCP flow cannot be reassembled, and an analysis engine cannot receive and analyze the TCP flow.
In order to solve the above technical problem, the present invention provides a TCP stream reassembly method, comprising:
acquiring a TCP message in a TCP stream, and judging whether the TCP message is out of order or not based on a message serial number of the TCP message;
when the TCP messages are out of order, inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large to obtain a plurality of cache TCP messages;
judging whether the TCP cache linked list reaches the maximum cache quota;
and when the TCP cache linked list reaches the maximum cache quota, locally recombining the plurality of cache TCP messages in the TCP cache linked list to obtain locally recombined TCP packets.
In some possible implementation manners, the locally reassembling the plurality of cached TCP packets in the TCP cache linked list to obtain a locally reassembled TCP packet includes:
sequentially judging whether the cache TCP messages need to be locally recombined according to the sequence of the message serial numbers from small to large, and determining at least one target cache message which needs to be locally recombined;
and locally recombining the at least one target cache message to obtain the locally recombined TCP packet.
In some possible implementations, the cached TCP message includes a current cached TCP message and a next cached TCP message; the method for sequentially judging whether the cached TCP messages need to be locally recombined according to the sequence of the message sequence numbers from small to large comprises the following steps:
acquiring a current message serial number and a current load length of the current cache TCP message;
acquiring a next message serial number of the next cache TCP message;
judging whether the sum of the current message serial number and the current load length is equal to the next message serial number or not;
and if the sum of the current message serial number and the current load length is equal to the next message serial number, the next cache TCP message needs to be locally recombined.
In some possible implementations, before the determining whether the TCP buffer linked list reaches the maximum buffer quota, the method further includes:
judging whether the TCP message is a first missing message or not;
and if the TCP message is the first missing message, locally recombining the plurality of cache TCP messages to obtain the locally recombined TCP packet.
In some possible implementations, the TCP flow reassembly method further includes:
when the TCP cache linked list does not reach the maximum cache quota, acquiring a flag bit field of the TCP message;
judging whether the TCP message is an end packet or a reset packet according to the flag bit field;
and when the TCP message is an end packet or a reset packet, completely recombining the plurality of cache TCP messages to generate a completely recombined TCP packet.
In some possible implementations, the TCP buffer chain table includes a timer, and the TCP flow reassembly method further includes:
judging whether the timer is overtime or not;
and when the timer is overtime, all the cached TCP messages are recombined to generate all recombined TCP packets.
In some possible implementations, before the inserting the TCP packets into the TCP buffer linked list according to the sequence of the packet sequence numbers from small to large, the TCP flow reassembly method further includes:
acquiring the application type of the TCP stream;
presetting a corresponding relation between the application type and the maximum cache quota of the TCP cache linked list;
and determining the maximum buffer quota of the TCP buffer linked list based on the application type and the corresponding relation.
In another aspect, the present invention further provides a TCP flow reassembly device, including:
the disorder judging unit is used for acquiring TCP messages in a TCP stream and judging whether the TCP messages are in disorder or not based on message serial numbers of the TCP messages;
the message inserting unit is used for inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large when the TCP messages are out of order, so as to obtain a plurality of cache TCP messages;
the buffer quota judging unit is used for judging whether the TCP buffer chain table reaches the maximum buffer quota;
and the local recombination unit is used for locally recombining the plurality of cached TCP messages in the TCP cache linked list to obtain a locally recombined TCP packet when the TCP cache linked list reaches the maximum cache quota.
In another aspect, the present invention also provides an electronic device comprising a memory and a processor, wherein,
the memory is used for storing programs;
the processor is coupled to the memory, and configured to execute the program stored in the memory to implement the steps in the TCP stream reassembly method in any of the above implementations.
In another aspect, the present invention further provides a computer-readable storage medium for storing a computer-readable program or instruction, where the program or instruction, when executed by a processor, can implement the steps in the TCP stream reassembly method in any of the above-mentioned implementations.
The beneficial effects of adopting the above embodiment are: according to the TCP stream recombination method provided by the invention, when the TCP cache linked list reaches the maximum cache quota, a plurality of cache TCP messages in the TCP cache linked list are locally recombined, so that the problem that the TCP messages cannot be recombined when packet loss occurs is prevented; moreover, the locally recombined TCP packet after local recombination can be uploaded to an application analysis engine, so that the problem that the application analysis engine cannot receive the TCP stream can be avoided.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a schematic flow chart of an embodiment of a TCP flow reassembly method provided in the present invention;
FIG. 2 is a schematic flow chart of one embodiment of S104 of FIG. 1;
FIG. 3 is a flow chart illustrating an embodiment of S201 in FIG. 2;
fig. 4 is a schematic flow chart of another embodiment of local reassembly of a cached TCP packet according to the present invention;
fig. 5 is a schematic flow chart of an embodiment of the present invention for completely recombining the cached TCP packets;
fig. 6 is a schematic flow chart of another embodiment of completely recombining the cached TCP packets according to the present invention;
FIG. 7 is a flowchart illustrating an embodiment of a maximum buffer quota setting manner provided by the present invention;
fig. 8 is a schematic structural diagram of an embodiment of a TCP flow reassembly device provided in the present invention;
fig. 9 is a schematic structural diagram of an embodiment of an electronic device provided in the present invention.
Detailed Description
The technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. It is to be understood that the described embodiments are merely exemplary of the invention, and not restrictive of the full scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
In the description of the embodiments of the present application, "a plurality" means two or more unless otherwise specified.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the invention. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
The present invention provides a TCP stream reassembly method, apparatus, electronic device, and storage medium, which are described below.
Before the examples are shown, the following terms are introduced:
TCP (Transmission Control Protocol) is a connection-oriented, reliable transport layer communication Protocol based on a byte stream.
TCP flow: refers to the data flow in the data transmission process in a certain service process.
Message: refers to the data units exchanged and transmitted in the network, namely: the data block to be sent by the station at one time contains the complete data information to be sent.
TCP messages: refers to the data units transported by the TCP layer.
TCP packets: refers to a data packet consisting of at least one TCP message.
Fig. 1 is a schematic flow diagram of an embodiment of a TCP flow reassembly method provided in the present invention, and as shown in fig. 1, the TCP flow reassembly method includes:
s101, acquiring a TCP message in a TCP stream, and judging whether the TCP message is out of order or not based on a message serial number of the TCP message;
s102, when the TCP messages are out of order, inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large to obtain a plurality of cache TCP messages;
s103, judging whether the TCP cache chain table reaches the maximum cache quota;
and S104, when the TCP cache linked list reaches the maximum cache quota, locally recombining the plurality of cached TCP messages in the TCP cache linked list to obtain a locally recombined TCP packet.
Compared with the prior art, the TCP stream recombination method provided by the embodiment of the invention has the advantages that when the TCP cache linked list reaches the maximum cache quota, the plurality of cached TCP messages in the TCP cache linked list are locally recombined, so that the problem that the TCP messages cannot be recombined when lost is solved; moreover, the locally recombined TCP packet after local recombination can be uploaded to an application analysis engine, so that the problem that the application analysis engine cannot receive the TCP stream when packet loss occurs can be avoided.
In some embodiments of the present invention, the step S101 of determining whether the TCP packet is out of order based on the packet sequence number of the TCP packet specifically includes:
and acquiring a previous TCP message of the TCP message, and acquiring a message serial number and a message load length of the previous TCP message, wherein if the sum of the message serial number and the message load length of the previous TCP message is equal to the message serial number of the TCP message, the TCP message is not out of order, and if the sum of the message serial number and the message load length of the previous TCP message is not equal to the message serial number of the TCP message, the TCP message is out of order.
In some embodiments of the present invention, as shown in fig. 2, step S104 comprises:
s201, sequentially judging whether the cached TCP messages need to be locally recombined according to the sequence of the message serial numbers from small to large, and determining at least one target cached message which needs to be locally recombined;
s202, locally recombining at least one target cache message to obtain a locally recombined TCP packet.
In some embodiments of the present invention, if the cached TCP packet includes a current cached TCP packet and a next cached TCP packet, as shown in fig. 3, step S201 includes:
s301, acquiring a current message serial number and a current load length of a current cache TCP message;
s302, acquiring a next message serial number of a next cache TCP message;
s303, judging whether the sum of the current message serial number and the current load length is equal to the next message serial number or not;
s304, if the sum of the current message serial number and the current load length is equal to the next message serial number, the next cache TCP message needs to be locally recombined.
According to the embodiment of the invention, the cached TCP messages which need to be locally recombined are recombined along the sequence of the message serial numbers from small to large to generate the locally recombined TCP packet. The method can avoid the blockage in the recombination process and realize the local recombination when the packet loss occurs in the TCP stream.
In a specific embodiment, the TCP cache chain table includes 4 cached TCP messages, if the sum of the message serial number and the message load of the first cached TCP message is equal to the message serial number of the second cached TCP message, and if the sum of the message serial number and the message load of the second cached TCP message is not equal to the message serial number of the third cached TCP message, the local reassembly can only partially reassemble the first cached TCP message and the second cached TCP message. When the sum of the message serial number and the message load of the first cached TCP message is not equal to the message serial number of the second cached TCP message, the local reassembly refers to performing local reassembly on the first cached TCP message.
It should be understood that: and the local recombined TCP packet is sent to an application analysis engine, and the rest cached TCP messages are still cached in a TCP cache linked list.
Since the local reassembly can be performed without waiting for the TCP buffer chain table to reach the maximum buffer quota when the TCP packet is the first missing packet, in some embodiments of the present invention, as shown in fig. 4, before step S103, the TCP flow reassembly method further includes:
s401, judging whether the TCP message is a first missing message or not;
s402, if the TCP message is the first missing message, locally recombining the plurality of cached TCP messages to obtain a locally recombined TCP packet.
According to the embodiment of the application, when the TCP message is the first missing message, the local recombination is directly carried out on the plurality of cache TCP messages to obtain the local recombination TCP packet, and the local recombination is carried out when the TCP cache chain table reaches the maximum cache quota without waiting, so that the efficiency of the local recombination is improved.
It should be noted that: in step S401, it is determined whether the TCP packet is the first missing packet according to the packet sequence number and the load length of the preamble packet before the first missing packet, and the determining method is consistent with the method for determining whether the TCP packet is out of order, which is not described herein again.
In order to solve the technical problem, in some embodiments of the present invention, as shown in fig. 5, the TCP flow reassembly method further includes:
s501, when the TCP cache linked list does not reach the maximum cache quota, acquiring a flag bit (Flags) field of the TCP message;
s502, judging whether the TCP message is an end packet or a reset packet according to the flag bit field;
and S503, when the TCP message is an end packet or a reset packet, completely recombining the plurality of cache TCP messages to generate a completely recombined TCP packet.
In the embodiment of the application, when the TCP packet is determined to be the end packet or the reset packet according to the flag bit field, all the buffered TCP packets are reassembled to generate all the reassembled TCP packets, that is: all the cached TCP messages in the TCP cache linked list are recombined, all the cached TCP messages can be sent to the application analysis engine, analysis errors caused by the fact that the application analysis engine cannot receive the cached TCP messages are avoided, and accuracy of TCP flow analysis is improved.
In some embodiments of the present invention, step S502 specifically includes:
when the flag bit field has an end bit (FIN), the TCP message is an end packet; when the flag bit field has a reset bit (RST), the TCP message is a reset packet.
In some embodiments of the present invention, the step S503 of completely recombining the plurality of buffered TCP packets specifically includes:
and traversing the TCP buffer chain table in sequence, and completely recombining all the buffer TCP messages according to the sequence of the message sequence numbers from small to large.
In order to avoid the technical problem that the TCP flow reassembly efficiency is low due to the fact that the buffered TCP packet is retained in the TCP buffer linked list for a long time because the TCP buffer linked list continuously waits when a new TCP packet is not received for a long time, in some embodiments of the present invention, the TCP buffer linked list includes a timer, and as shown in fig. 6, the TCP flow reassembly method further includes:
s601, judging whether the timer is overtime or not;
s602, when the timer is overtime, all the cached TCP messages are recombined to generate all recombined TCP packets.
According to the embodiment of the application, the timer is set, and when the timer is overtime, all the cached TCP messages are recombined, so that the cached TCP messages are prevented from being retained in the TCP cache chain table for a long time, and the TCP stream recombination efficiency is improved.
It should be understood that: the timer is reset every time the TCP buffer chain table receives a TCP message, and timing is restarted.
It should be noted that: the process of completely reassembling the plurality of buffered TCP messages in step S602 is the same as the process of completely reassembling the plurality of buffered TCP messages in step S503, and is not described herein again.
Further, the maximum buffer quota of the TCP buffer linked list is generally fixed, but in practical applications, some applications are important, and in order to improve the accuracy, the maximum buffer quota needs to be larger, but if the maximum buffer quota is uniformly increased, the reassembly efficiency of the whole TCP stream is reduced. To solve this technical problem, in some embodiments of the present invention, as shown in fig. 7, the TCP stream reassembly method further includes:
s701, acquiring the application type of the TCP stream;
s702, presetting a corresponding relation between an application type and the maximum buffer quota of a TCP buffer linked list;
and S703, determining the maximum buffer quota of the TCP buffer linked list based on the application type and the corresponding relation.
The embodiment of the invention correspondingly sets the maximum buffer quota of the TCP buffer linked list according to different application types, namely, the maximum buffer quota of the self-adaptive TCP buffer linked list is used, so that the correctness and the high efficiency of TCP stream recombination are ensured.
In an embodiment of the present invention, applications of TCP streams may be divided into three application types, which are respectively an important application, a common application, and a general application, and the corresponding maximum cache limit also includes three levels, namely, a low level, a medium level, and a high level. When the application of the TCP stream is an important application, setting the maximum cache limit to be a high level; when the application of the TCP stream is a common application, setting the maximum cache limit to be a middle level; when the application of the TCP flow is a general application, the maximum buffer quota is set to a low level.
In order to better implement the TCP stream reassembly method in the embodiment of the present invention, on the basis of the TCP stream reassembly method, as shown in fig. 8, correspondingly, an embodiment of the present invention further provides a TCP stream reassembly device 800, including:
an out-of-order determining unit 801, configured to obtain a TCP packet in a TCP stream, and determine whether the TCP packet is out of order based on a packet sequence number of the TCP packet;
a packet inserting unit 802, configured to insert, when a TCP packet is out of order, the TCP packet into a TCP cache linked list according to a sequence that packet sequence numbers are from small to large, so as to obtain a plurality of cached TCP packets;
a buffer quota determining unit 803, configured to determine whether the TCP buffer chain table reaches a maximum buffer quota;
the local reassembly unit 804 is configured to, when the TCP cache linked list reaches the maximum cache limit, perform local reassembly on the multiple cached TCP messages in the TCP cache linked list to obtain a local reassembly TCP packet.
The TCP stream reassembly device 800 provided in the foregoing embodiment may implement the technical solution described in the foregoing TCP stream reassembly method embodiment, and the specific implementation principle of each module or unit may refer to the corresponding content in the foregoing TCP stream reassembly method embodiment, which is not described herein again.
As shown in fig. 9, the present invention also provides an electronic device 900. The electronic device 900 includes a processor 901, memory 902, and a display 903. Fig. 9 shows only some of the components of the electronic device 900, but it is to be understood that not all of the shown components are required to be implemented, and that more or fewer components may be implemented instead.
The storage 902 may be an internal storage unit of the electronic device 900 in some embodiments, such as a hard disk or memory of the electronic device 900. The memory 902 may also be an external storage device of the electronic device 900 in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), etc., provided on the electronic device 900.
Further, the memory 902 may also include both internal storage units and external storage devices of the electronic device 900. The memory 902 is used for storing application software and various data installed in the electronic device 900.
The processor 901 may be a Central Processing Unit (CPU), microprocessor or other data Processing chip in some embodiments, and is used to execute program codes stored in the memory 902 or process data, such as the TCP stream reassembly method of the present invention.
The display 903 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch panel, or the like in some embodiments. The display 903 is used to display information at the electronic device 900 and to display a visual user interface. The components 901 and 903 of the electronic device 900 communicate with each other via a system bus.
In one embodiment, when the processor 901 executes the TCP stream reassembly program in the memory 902, the following steps may be implemented:
acquiring a TCP message in a TCP stream, and judging whether the TCP message is out of order or not based on the message serial number of the TCP message;
when the TCP messages are out of order, inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large to obtain a plurality of cache TCP messages;
judging whether the TCP cache linked list reaches the maximum cache quota;
and when the TCP cache linked list reaches the maximum cache quota, locally recombining a plurality of cache TCP messages in the TCP cache linked list to obtain a locally recombined TCP packet.
It should be understood that: the processor 901, when executing the TCP stream reassembly program stored in the memory 902, may perform other functions in addition to the above functions, which may be specifically described in the foregoing description of the corresponding method embodiment.
Further, the type of the electronic device 900 mentioned in the embodiment of the present invention is not particularly limited, and the electronic device 900 may be a portable electronic device such as a mobile phone, a tablet computer, a Personal Digital Assistant (PDA), a wearable device, and a laptop computer (laptop). Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices that carry an IOS, android, microsoft, or other operating system. The portable electronic device may also be other portable electronic devices such as laptop computers (laptop) with touch sensitive surfaces (e.g., touch panels), etc. It should also be understood that in other embodiments of the present invention, the electronic device 900 may not be a portable electronic device, but may be a desktop computer having a touch-sensitive surface (e.g., a touch panel).
Accordingly, the present application also provides a computer-readable storage medium, which is used for storing a computer-readable program or instruction, and when the program or instruction is executed by a processor, the method steps or functions provided by the above method embodiments can be implemented.
Those skilled in the art will appreciate that all or part of the flow of the method implementing the above embodiments may be implemented by a computer program, which may be stored in a computer-readable storage medium, to instruct associated hardware. The computer readable storage medium is a magnetic disk, an optical disk, a read-only memory or a random access memory.
The TCP stream reassembly method, apparatus, electronic device and storage medium provided by the present invention are described in detail above, and the principle and implementation of the present invention are explained herein by applying specific examples, and the description of the above embodiments is only used to help understanding the method and core idea of the present invention; meanwhile, for those skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.
Claims (10)
1. A TCP flow reassembly method, comprising:
acquiring a TCP message in a TCP stream, and judging whether the TCP message is out of order or not based on a message serial number of the TCP message;
when the TCP messages are out of order, inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large to obtain a plurality of cache TCP messages;
judging whether the TCP cache linked list reaches the maximum cache quota;
and when the TCP cache linked list reaches the maximum cache quota, locally recombining the plurality of cache TCP messages in the TCP cache linked list to obtain locally recombined TCP packets.
2. The TCP flow reassembly method according to claim 1, wherein said partially reassembling the plurality of buffered TCP packets in the TCP buffer chain table to obtain a partially reassembled TCP packet comprises:
sequentially judging whether the cache TCP messages need to be locally recombined according to the sequence of the message serial numbers from small to large, and determining at least one target cache message which needs to be locally recombined;
and locally recombining the at least one target cache message to obtain the locally recombined TCP packet.
3. The TCP stream reassembly method according to claim 2, wherein said buffered TCP packets include a current buffered TCP packet and a next buffered TCP packet; the method for sequentially judging whether the cached TCP messages need to be locally recombined according to the sequence of the message sequence numbers from small to large comprises the following steps:
acquiring a current message serial number and a current load length of the current cache TCP message;
acquiring a next message serial number of the next cache TCP message;
judging whether the sum of the current message serial number and the current load length is equal to the next message serial number or not;
and if the sum of the current message serial number and the current load length is equal to the next message serial number, the next cache TCP message needs to be locally recombined.
4. The TCP flow reassembly method according to claim 1, before said determining whether said TCP buffer chain table reaches a maximum buffer quota, further comprising:
judging whether the TCP message is a first missing message or not;
and if the TCP message is the first missing message, locally recombining the plurality of cache TCP messages to obtain the locally recombined TCP packet.
5. The TCP flow reassembly method of claim 1, further comprising:
when the TCP cache linked list does not reach the maximum cache quota, acquiring a flag bit field of the TCP message;
judging whether the TCP message is an end packet or a reset packet according to the flag bit field;
and when the TCP message is an end packet or a reset packet, completely recombining the plurality of cache TCP messages to generate a completely recombined TCP packet.
6. The TCP flow reassembly method of claim 1, wherein said TCP buffer linked list comprises a timer, further comprising:
judging whether the timer is overtime or not;
and when the timer is overtime, all the cached TCP messages are recombined to generate all recombined TCP packets.
7. The TCP flow reassembly method according to claim 1, wherein before said inserting said TCP packets into a TCP buffer linked list in an order from small to large packet sequence numbers, said TCP flow reassembly method further comprises:
acquiring the application type of the TCP stream;
presetting a corresponding relation between the application type and the maximum cache quota of the TCP cache linked list;
and determining the maximum buffer quota of the TCP buffer linked list based on the application type and the corresponding relation.
8. A TCP flow reassembly device, comprising:
the disorder judging unit is used for acquiring TCP messages in a TCP stream and judging whether the TCP messages are in disorder or not based on message serial numbers of the TCP messages;
the message inserting unit is used for inserting the TCP messages into a TCP cache linked list according to the sequence of the message serial numbers from small to large when the TCP messages are out of order, so as to obtain a plurality of cache TCP messages;
the buffer quota judging unit is used for judging whether the TCP buffer chain table reaches the maximum buffer quota;
and the local recombination unit is used for locally recombining the plurality of cached TCP messages in the TCP cache linked list to obtain a locally recombined TCP packet when the TCP cache linked list reaches the maximum cache quota.
9. An electronic device comprising a memory and a processor, wherein,
the memory is used for storing programs;
the processor, coupled to the memory, is configured to execute the program stored in the memory to implement the steps in the TCP stream reassembly method according to any of the preceding claims 1 to 7.
10. A computer-readable storage medium storing a computer-readable program or instructions, which when executed by a processor, is capable of implementing the steps in the TCP stream reassembly method as claimed in any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210003638.5A CN114024924B (en) | 2022-01-05 | 2022-01-05 | TCP stream recombination method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210003638.5A CN114024924B (en) | 2022-01-05 | 2022-01-05 | TCP stream recombination method and device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114024924A true CN114024924A (en) | 2022-02-08 |
| CN114024924B CN114024924B (en) | 2022-04-12 |
Family
ID=80069718
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210003638.5A Active CN114024924B (en) | 2022-01-05 | 2022-01-05 | TCP stream recombination method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114024924B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113364862A (en) * | 2021-06-03 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Packet decoding system and method |
| CN113382013A (en) * | 2021-06-21 | 2021-09-10 | 国网宁夏电力有限公司电力科学研究院 | Data mining system based on energy big data |
Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2004021143A2 (en) * | 2002-08-30 | 2004-03-11 | Broadcom Corporation | Method and system for data placement of out-of-order (ooo) tcp segments |
| US20040133713A1 (en) * | 2002-08-30 | 2004-07-08 | Uri Elzur | Method and system for data placement of out-of-order (OOO) TCP segments |
| CN101222298A (en) * | 2008-01-22 | 2008-07-16 | 中兴通讯股份有限公司 | Forward package out-of-order regulation method and base station used in HRPD system |
| US20080298369A1 (en) * | 2002-08-30 | 2008-12-04 | Uri Elzur | System and method for handling out-of-order frames |
| CN101841545A (en) * | 2010-05-14 | 2010-09-22 | 中国科学院计算技术研究所 | TCP stream restructuring and/or packetizing method and device |
| CN102082688A (en) * | 2010-12-17 | 2011-06-01 | 曙光信息产业(北京)有限公司 | Method for realizing management of TCP (transmission control protocol) out-of-order buffer by means of combination of software and hardware |
| CN104202656A (en) * | 2014-09-16 | 2014-12-10 | 国家计算机网络与信息安全管理中心 | Segmented decoding method for scrambled network audio MP3 (moving picture experts group audio layer 3) streams |
| CN106230744A (en) * | 2016-07-26 | 2016-12-14 | 京信通信系统（中国）有限公司 | A kind of method of out of order restructuring of data stream and forwarding unit |
| CN108512708A (en) * | 2017-02-24 | 2018-09-07 | 中兴通讯股份有限公司 | A kind of method and device that caching calculates |
| CN109672701A (en) * | 2017-10-16 | 2019-04-23 | 中国科学院信息工程研究所 | A kind of differentiation TCP link management method and equipment |
| CN112165457A (en) * | 2020-09-04 | 2021-01-01 | 苏州浪潮智能科技有限公司 | Method, system and device for file rearrangement and readable storage medium |
| CN113014586A (en) * | 2021-03-04 | 2021-06-22 | 即时匹配(上海)网络科技有限公司 | RTP data packet out-of-order processing and framing method and system |
| CN113364862A (en) * | 2021-06-03 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Packet decoding system and method |
| CN113783800A (en) * | 2021-11-10 | 2021-12-10 | 恒生电子股份有限公司 | Data packet processing method and device, computer equipment and readable storage medium |
-
2022
- 2022-01-05 CN CN202210003638.5A patent/CN114024924B/en active Active
Patent Citations (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2004021143A2 (en) * | 2002-08-30 | 2004-03-11 | Broadcom Corporation | Method and system for data placement of out-of-order (ooo) tcp segments |
| US20040133713A1 (en) * | 2002-08-30 | 2004-07-08 | Uri Elzur | Method and system for data placement of out-of-order (OOO) TCP segments |
| US20080298369A1 (en) * | 2002-08-30 | 2008-12-04 | Uri Elzur | System and method for handling out-of-order frames |
| CN101222298A (en) * | 2008-01-22 | 2008-07-16 | 中兴通讯股份有限公司 | Forward package out-of-order regulation method and base station used in HRPD system |
| CN101841545A (en) * | 2010-05-14 | 2010-09-22 | 中国科学院计算技术研究所 | TCP stream restructuring and/or packetizing method and device |
| CN102082688A (en) * | 2010-12-17 | 2011-06-01 | 曙光信息产业(北京)有限公司 | Method for realizing management of TCP (transmission control protocol) out-of-order buffer by means of combination of software and hardware |
| CN104202656A (en) * | 2014-09-16 | 2014-12-10 | 国家计算机网络与信息安全管理中心 | Segmented decoding method for scrambled network audio MP3 (moving picture experts group audio layer 3) streams |
| CN106230744A (en) * | 2016-07-26 | 2016-12-14 | 京信通信系统（中国）有限公司 | A kind of method of out of order restructuring of data stream and forwarding unit |
| CN108512708A (en) * | 2017-02-24 | 2018-09-07 | 中兴通讯股份有限公司 | A kind of method and device that caching calculates |
| CN109672701A (en) * | 2017-10-16 | 2019-04-23 | 中国科学院信息工程研究所 | A kind of differentiation TCP link management method and equipment |
| CN112165457A (en) * | 2020-09-04 | 2021-01-01 | 苏州浪潮智能科技有限公司 | Method, system and device for file rearrangement and readable storage medium |
| CN113014586A (en) * | 2021-03-04 | 2021-06-22 | 即时匹配(上海)网络科技有限公司 | RTP data packet out-of-order processing and framing method and system |
| CN113364862A (en) * | 2021-06-03 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Packet decoding system and method |
| CN113783800A (en) * | 2021-11-10 | 2021-12-10 | 恒生电子股份有限公司 | Data packet processing method and device, computer equipment and readable storage medium |
Non-Patent Citations (1)
| Title |
|---|
| 赵丽莉，孙伟: "TCP协议乱序数据包处理算法综述", 《软件工程师》 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113364862A (en) * | 2021-06-03 | 2021-09-07 | 上海天旦网络科技发展有限公司 | Packet decoding system and method |
| CN113382013A (en) * | 2021-06-21 | 2021-09-10 | 国网宁夏电力有限公司电力科学研究院 | Data mining system based on energy big data |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114024924B (en) | 2022-04-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3707882B1 (en) | Multi-path rdma transmission | |
| CN114024924B (en) | TCP stream recombination method and device, electronic equipment and storage medium | |
| KR101941416B1 (en) | Networking Technologies | |
| US7269171B2 (en) | Multi-data receive processing according to a data communication protocol | |
| EP2916508B1 (en) | Data packet processing method, electronic device, and storage medium | |
| US7817560B2 (en) | Acknowledging packet receipt based on expected size of sender's congestion window | |
| US8312159B2 (en) | Methodology for fast file transfer protocol | |
| CN105550051A (en) | Asynchronous processing method and device of business request | |
| US20190173960A1 (en) | Method, device and computer program product for protocol selection | |
| CN110581812A (en) | Data message processing method and device | |
| CN114124929A (en) | Cross-network data processing method and device | |
| CN112671771B (en) | Data transmission method, device, electronic equipment and medium | |
| US20130111002A1 (en) | Systems and methods for establishing a virtual local area network | |
| RU2329532C2 (en) | Data channel resource optimisation for network devices | |
| CN111385068A (en) | Data transmission method and device, electronic equipment and communication system | |
| JP3569149B2 (en) | Communication control device | |
| CN114024868B (en) | Flow statistical method, flow quality analysis method and device | |
| US20150012663A1 (en) | Increasing a data transfer rate | |
| US7394813B2 (en) | Systems and methods for implementing an acknowledgement mechanism for transmission of a real-time data stream | |
| CN113645291B (en) | Data communication method and device, electronic equipment and storage medium | |
| CN106385409B (en) | A kind of processing method and processing device of TCP message | |
| US20200136980A1 (en) | Method, device and computer program product for data processing | |
| CN1698280A (en) | System and method for piggybacking data across an open data channel of a wireless device | |
| CN112882838B (en) | Method and apparatus for vacating resource instances | |
| CN117768190A (en) | Virus interception method, device and equipment based on HTTP format message |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |