CN117081935A - Webpage full scene restoration method and device, computer equipment and storage medium - Google Patents
Webpage full scene restoration method and device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN117081935A CN117081935A CN202310590608.3A CN202310590608A CN117081935A CN 117081935 A CN117081935 A CN 117081935A CN 202310590608 A CN202310590608 A CN 202310590608A CN 117081935 A CN117081935 A CN 117081935A
- Authority
- CN
- China
- Prior art keywords
- tcp
- message
- flow
- request
- content
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 58
- 238000004458 analytical method Methods 0.000 claims abstract description 50
- 230000002159 abnormal effect Effects 0.000 claims abstract description 33
- 238000005206 flow analysis Methods 0.000 claims abstract description 14
- 230000006798 recombination Effects 0.000 claims abstract description 7
- 238000005215 recombination Methods 0.000 claims abstract description 7
- 230000011218 segmentation Effects 0.000 claims description 32
- 230000004044 response Effects 0.000 claims description 29
- 238000004590 computer program Methods 0.000 claims description 21
- 238000004806 packaging method and process Methods 0.000 claims description 6
- 238000010276 construction Methods 0.000 claims description 5
- 238000012544 monitoring process Methods 0.000 claims description 3
- 230000008521 reorganization Effects 0.000 claims description 2
- 238000010586 diagram Methods 0.000 description 14
- 230000003068 static effect Effects 0.000 description 7
- 230000003993 interaction Effects 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 238000003491 array Methods 0.000 description 2
- 230000002452 interceptive effect Effects 0.000 description 2
- VYZAMTAEIAYCRO-UHFFFAOYSA-N Chromium Chemical compound [Cr] VYZAMTAEIAYCRO-UHFFFAOYSA-N 0.000 description 1
- 230000005856 abnormality Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 235000019800 disodium phosphate Nutrition 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 238000009877 rendering Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0876—Network utilisation, e.g. volume of load or congestion level
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/22—Parsing or analysis of headers
Abstract
The embodiment of the application discloses a webpage full scene restoration method, a device, computer equipment and a storage medium. The method comprises the following steps: when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from an intranet; TCP flow analysis is carried out on the file package to obtain an analysis result; performing content replacement on the data content of which the target address of the TCP is the local corresponding to the system in the analysis result to obtain TCP flow connection information; carrying out http message recombination according to TCP flow connection information to obtain message content; analyzing the message content to construct a numerical memory of key value pairs; when a user terminal initiates a request, constructing a key according to the request; and determining a corresponding key value from the numerical memory according to the key, and feeding back the key value to the user terminal. By implementing the method provided by the embodiment of the application, almost all application scenes can be covered, the current scenes can be automatically restored, the time and the labor are wasted without manually going on business to the customer site, the user experience is improved, and the problem efficiency is solved.
Description
Technical Field
The application relates to a webpage processing method, in particular to a webpage full scene restoration method, a device, computer equipment and a storage medium.
Background
The architecture of information system information developed by some institutions is a b/s architecture and uses an http protocol, but the network and the internet of the systems are completely isolated. In this case, if a problem occurs in the intranet system, it is very difficult to check the problem in the intranet system, and a person is required to physically arrive at the site and wait for the moment of problem reproduction, and after the problem is reproduced, the problem is located and checked, resulting in high labor cost and low efficiency.
The existing automatic webpage scene restoration mode is a scheme based on a flow restoration webpage, a flow recording scheme and a static resource reservation mode, wherein the flow restoration webpage based scheme is based on a specific website or a network plug-in of a system such as a chrome, the flow is packaged into a file, an intranet system is usually composed of a plurality of cross-domain systems, a new window, websocket interaction, a new address, local control rendering and the like can be popped up, all scenes can not be restored by conventional flow recording of a website, and the flow recording scheme is based on the dimension of an http application level; the static resource reservation mode is to store the web page after being resolved by one browser, but the web page is dead in this way, and no interactive function exists after being restored
Therefore, a new method is necessary to be designed, so that almost all application scenes are covered, the current scenes are automatically restored, the time and the labor are wasted because people do not need to go on business to the customer site, the user experience is improved, and the problem efficiency is solved.
Disclosure of Invention
The application aims to overcome the defects of the prior art and provides a webpage full scene restoration method, a device, computer equipment and a storage medium.
In order to achieve the above purpose, the present application adopts the following technical scheme: the webpage full scene restoration method comprises the following steps:
when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from an intranet;
TCP flow analysis is carried out on the independent file package so as to obtain an analysis result;
performing content replacement on all data contents of which the target address of the TCP is the local corresponding to the system in the analysis result to obtain TCP flow connection information;
carrying out http message recombination according to the TCP flow connection information to obtain message content;
analyzing the message content to construct a numerical memory of key value pairs;
when a user terminal initiates a request, constructing a key according to the request;
and determining a corresponding key value from the numerical value memory according to the key, and feeding back the key value to the user terminal.
The further technical scheme is as follows: the independent file packet is a file packet which is formed by monitoring all TCP flows of a network card where a default gateway is located after the system operates, storing all TCP flow increment into a file, intercepting all TCP session information of an abnormal time point from the file when the system is abnormal, and independently packaging.
The further technical scheme is as follows: the performing TCP traffic analysis on the independent file packet to obtain an analysis result includes:
reading the segmentation flow of the TCP of the independent file packet in a byte stream mode;
and recombining the segmentation flow of the TCP to obtain an analysis result.
The further technical scheme is as follows: the step of reorganizing the segment flow of the TCP to obtain an analysis result comprises the following steps:
determining a message position according to the segmentation flow of the TCP;
creating a byte array according to the data length field value of the segmented flow of the TCP;
inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment;
judging whether the byte array is completely filled;
if the byte array is completely filled, determining the content of the byte array as an analysis result;
and if the byte array is not completely filled, executing the step of determining the message position according to the segmentation flow of the TCP.
The further technical scheme is as follows: the determining the message position according to the segmentation flow of the TCP comprises the following steps:
acquiring a sequence number and a data length field in a TCP message segment header in the segmentation flow of TCP;
and calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field to obtain the message position.
The further technical scheme is as follows: and performing content replacement on all data contents of which the target address of the TCP in the analysis result is the local corresponding to the system to obtain TCP flow connection information, wherein the method comprises the following steps:
matching domain name ports and IP ports of all data contents of which the target address of TCP is the local corresponding to the system in the analysis result;
and replacing the matched result with the IP and the port of the local machine to obtain TCP flow connection information.
The further technical scheme is as follows: the parsing the message content to construct a numeric memory of key-value pairs includes:
sequentially reading the message content, and analyzing the message content into an HTTP request and an HTTP response according to an HTTP message structure;
and constructing a corresponding relation between the request and the response, and constructing a numerical memory of a key value pair, wherein the key is a request URI, a request method and a request parameter of the HTTP request, and the value is all byte information of the response corresponding to the HTTP request.
The application also provides a device for restoring the full scene of the webpage, which comprises the following steps:
the file packet acquisition unit is used for acquiring independent file packets of all TCP session information at an abnormal time point from the intranet when the system is abnormal;
the flow analysis unit is used for carrying out TCP flow analysis on the independent file package so as to obtain an analysis result;
the content replacing unit is used for replacing the content of all the data content of which the target address of the TCP in the analysis result is the local corresponding to the system so as to obtain TCP flow connection information;
the message reorganizing unit is used for carrying out http message reorganization according to the TCP flow connection information so as to obtain message content;
the content analysis unit is used for analyzing the message content to construct a numerical memory of key value pairs;
a construction unit, configured to construct a key according to a request when a user terminal initiates the request;
and the key value determining unit is used for determining a corresponding key value from the numerical value memory according to the key and feeding back the key value to the user terminal.
The application also provides a computer device which comprises a memory and a processor, wherein the memory stores a computer program, and the processor realizes the method when executing the computer program.
The present application also provides a storage medium storing a computer program which, when executed by a processor, implements the above method.
Compared with the prior art, the application has the beneficial effects that: when an intranet system is abnormal, the related TCP flow in an abnormal time period is determined, analyzed and replaced, so that TCP flow connection information is obtained, message recombination is carried out according to the TCP flow connection information, the message content is analyzed, a numerical memory of key value pairs is constructed, and key values related to requests are determined in an interaction process and fed back, so that almost all application scenes are covered, the scene is automatically restored to the current scene, time and effort are wasted without manually going out to a customer site, user experience is improved, and the problem efficiency is solved.
The application is further described below with reference to the drawings and specific embodiments.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is an application scenario schematic diagram of a web page full-scene restoration method provided by an embodiment of the present application;
fig. 2 is a flow chart of a method for restoring a full scene of a web page according to an embodiment of the present application;
FIG. 3 is a schematic sub-flowchart of a method for full scene restoration of a web page according to an embodiment of the present application;
fig. 4 is a schematic sub-flowchart of a method for restoring a full scene of a web page according to an embodiment of the present application;
FIG. 5 is a schematic sub-flowchart of a method for full scene restoration of a web page according to an embodiment of the present application;
FIG. 6 is a schematic sub-flowchart of a method for full scene restoration of a web page according to an embodiment of the present application;
FIG. 7 is a schematic sub-flowchart of a method for full scene restoration of a web page according to an embodiment of the present application;
fig. 8 is a schematic diagram of a TCP header structure according to an embodiment of the present application;
fig. 9 is a schematic diagram of an HTTP request and response structure according to an embodiment of the present application;
FIG. 10 is a schematic block diagram of a device for restoring a full scene of a web page according to an embodiment of the present application;
FIG. 11 is a schematic block diagram of a flow analysis unit of a webpage full scene restoration device provided by an embodiment of the present application;
FIG. 12 is a schematic block diagram of a flow reorganizing subunit of the web page full scene restoration device provided by the embodiment of the application;
FIG. 13 is a schematic block diagram of a location determining module of a web page full scene restoration device according to an embodiment of the present application;
fig. 14 is a schematic block diagram of a content replacing unit of the web page full scene restoration device provided by the embodiment of the application;
fig. 15 is a schematic block diagram of a content parsing unit of the web page full scene restoration device according to the embodiment of the present application;
fig. 16 is a schematic block diagram of a computer device according to an embodiment of the present application.
Detailed Description
The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
It should be understood that the terms "comprises" and "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It is also to be understood that the terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should be further understood that the term "and/or" as used in the present specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.
Referring to fig. 1 and fig. 2, fig. 1 is a schematic application scenario diagram of a web page full-scenario restoration method according to an embodiment of the present application. Fig. 2 is a schematic flowchart of a web page full scene restoration method provided by an embodiment of the present application. The webpage full scene restoration method is applied to the server. The server and the terminal perform data interaction, realize automatic restoration of the full scene of the webpage, achieve ip-level flow recording and cover almost all applications, restore recorded flow to the current scene through a restoration tool, enable remote debugging and scene reproduction, and do not need to go on business to the customer site manually, and are time-consuming and labor-consuming. User experience is improved, and problem efficiency is solved.
Fig. 2 is a flow chart of a method for restoring a full scene of a web page according to an embodiment of the present application. As shown in fig. 2, the method includes the following steps S110 to S170.
S110, when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from the intranet.
In this embodiment, the independent file packet refers to a file formed by packaging all TCP session information at an abnormal time point.
Specifically, the independent file packet is a file packet formed by monitoring all TCP traffic of a network card where a default gateway is located after the system operates, storing all TCP traffic increment into a file, intercepting all TCP session information of an abnormal time point from the file when the system is abnormal, and independently packaging.
Specifically, the windows platform adopts winpcap, linux platform and adopts pcap as a traffic capturing tool to obtain all TCP traffic of the network card where the default gateway is located, and all TCP traffic increment is saved in a file.
And exporting the independent file package from the intranet to the server of the extranet in a file transmission mode so as to restore the whole scene of the webpage by the server of the extranet.
S120, carrying out TCP flow analysis on the independent file package to obtain an analysis result.
In this embodiment, the analysis result refers to the message content obtained after the independent file package is analyzed.
In one embodiment, referring to fig. 3, the step S120 may include steps S121 to S122.
S121, reading the segmentation flow of the TCP of the independent file packet in a byte stream mode.
In this embodiment, the segment traffic of TCP refers to the traffic of a single segment in a read traffic file, i.e., an independent file packet, in a byte stream manner.
The flow file is read in a byte stream mode, and the segmentation flow of the TCP is analyzed according to the fixed format of the head structure of the TCP as shown in FIG. 8. All the transmitted and received TCP messages, i.e. the segmented traffic of TCP, are read into individual data packets in time sequence, and because the network transmission may contain a large number of TCP segments, abnormal retransmissions, etc., the goal of this embodiment is to restore the http request, and the http protocol is request and responsive.
S122, recombining the segmentation flow of the TCP to obtain an analysis result.
In this embodiment, the reassembly of the segmented traffic of TCP may be implemented using an open source tool of the type PcapPlusPlus.
In one embodiment, referring to fig. 4, the step S122 may include steps S1221 to S1225.
S1221, determining the message position according to the segmentation flow of the TCP.
In this embodiment, the message location refers to a location where the segmented traffic of TCP belongs to the whole data flow, i.e. the whole complete message.
In one embodiment, referring to fig. 5, the step S1221 may include steps S12211 to S12212.
S12211, acquiring a sequence number and a data length field in a TCP segment header in the segmented flow of TCP.
In this embodiment, a field of sequence number is used to identify the location of each byte in the TCP data stream. In the TCP protocol, each packet has a unique sequence number that is used to sequence, reassemble, and check the packets. TCP uses 32 bit sequence number field, initial value is decided by negotiation of both sides; the data length field indicates the data length of the current transmission, and the data length field in the TCP message segment indicates the length of the data carried by the message segment.
S12212, calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field to obtain the message position.
In this embodiment, according to the sequence number and the data length field, the position of the data transmitted this time in the whole data stream can be calculated. For example, if the first packet has a sequence number of 1000 and a data length of 500 bytes, the data in the first packet is located at the position of 1000-1499 bytes in the data stream. The sequence number of each data packet and the data length in each packet segment are transmitted through the field of the TCP header, so in the network protocol analysis tool, the position of the data contained in each data packet in the data stream can be obtained by looking at the information of the TCP packet header.
S1222, creating byte arrays according to the data length field value of the segment flow of the TCP.
In this embodiment, the byte array refers to an array for placing a message.
S1223, inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment.
And creating a byte array according to the data length field value, and inserting the data of the message segment into the corresponding byte array position according to the sequence number field.
S1224, judging whether the byte array is completely filled;
s1225, if the byte array is completely filled, determining the content of the byte array as an analysis result;
if the byte array is not completely filled, the step S1221 is performed.
In this embodiment, the segmented traffic of a TCP is parsed, and whether the segmented traffic of the TCP is complete is determined according to whether the byte array is filled, if not, the segmented traffic of a subsequent TCP continues to wait for the segmented traffic of the TCP to be read until the segmented traffic of the TCP is complete.
And S130, replacing the content of all the data contents of which the target address of the TCP in the analysis result is the local data content corresponding to the system, so as to obtain TCP flow connection information.
In this embodiment, the TCP traffic connection information refers to the IP and port of the local device to which the TCP traffic is connected.
In one embodiment, referring to fig. 6, the step S130 may include steps S131 to S132.
S131, matching domain name ports and IP ports of all data contents of which the target address of TCP in the analysis result is the local corresponding to the system;
s132, replacing the matched result with the IP and the port of the local machine to obtain TCP flow connection information.
And (3) carrying out domain name: port and IP: port matching on all data contents with the target address of the TCP as a local, if the response data contains www.xxx.com or 192.168.1.40:8080, and completely replacing the matched result with the IP and ports of the local, such as 127.0.0.1:8000, so as to finally obtain a plurality of TCP flow connection information.
S140, carrying out http message recombination according to the TCP flow connection information to obtain message content.
In this embodiment, the message content is a result formed by recombining the http message according to the TCP flow connection information with the byte array in the analysis result.
Specifically, the http1.1x protocol chunked will still disperse a complete http request into a plurality of http chunked blocks, i.e., each byte in each byte array. The hexadecimal length values in each block are converted into corresponding decimal values, and the blocks are reassembled into a complete response body according to the values, so that message content is formed.
S150, analyzing the message content to construct a numerical memory of key value pairs.
In the present embodiment, the numerical memory refers to a memory for storing key-value pairs.
In one embodiment, referring to fig. 7, the step S150 may include steps S151 to S152.
S151, sequentially reading the message content, and analyzing the message content into an HTTP request and an HTTP response according to an HTTP message structure;
s152, constructing a corresponding relation between the request and the response, and constructing a numerical memory of a key value pair, wherein the key is a request URI, a request method and a request parameter of the HTTP request, and the value is all byte information of the response corresponding to the HTTP request.
In this embodiment, the message content is sequentially read, and the message content is parsed into an HTTP request, i.e. a request line+a request header+a request body, and an HTTP response, i.e. a response line, a response header, and a response body according to the HTTP message structure as shown in fig. 9. When parsing an HTTP request, the next segment of the TCP data stream must be an HTTP response corresponding thereto. Thereby establishing a corresponding relation between the request and the response, and constructing a storage of a key value pair. Wherein the key is the request URI + request method + request parameter of the HTTP request. All byte information with value of this HTTP request corresponding response
Because HTTP pages typically reload static resources multiple times, the browser has a mechanism to cache the static resources (which would cache the first requested static resources). If the request of the static resource type will cause that the corresponding response data cannot be found in the HTTP request after the first time, in this case, when the HTTP request is read, if the URI of the request line is found to point to the static resource file (js, jpg, png, css, etc., such as the complete request http:// www.xxx.com/xxx. Png), only the result of the first parsing is used as a return value.
Based on the dimensions of the TCP level, almost all applications are covered, and the recorded traffic is restored to the current scenario by a restoration tool.
S160, when a user terminal initiates a request, constructing a key according to the request;
s170, determining a corresponding key value from the numerical value memory according to the key, and feeding back the key value to the user terminal.
When a user initiates a request, the HTTP service is operated, the request comprises a request path, a request method and request parameters, a key is constructed, a storage of a key value pair in the step S150 is read, the key just constructed is input to inquire from the storage to obtain a value, and the value is sent to a terminal, so that the request is completed once, therefore, the method of the embodiment can generate an interactive webpage, 3, remote debugging and scene reproduction are possible, and the user experience is improved without manually going out to the customer site, thereby being time-consuming and labor-consuming and solving the problem efficiency.
According to the webpage full scene restoration method, when the intranet system is abnormal, the related TCP flow of the abnormal time period is determined, analyzed, and the content is replaced to obtain the TCP flow connection information, the message is recombined according to the TCP flow connection information, the message content is analyzed, a numerical memory of key value pairs is constructed, the key values related to the request are determined from the interaction process, feedback is carried out, almost all application scenes are covered, the scene is restored to the current scene automatically, time and effort are wasted without going on business to the customer site manually, user experience is improved, and the problem efficiency is solved.
Fig. 10 is a schematic block diagram of a web page full scene restoration device 300 according to an embodiment of the present application. As shown in fig. 10, the present application further provides a web page full scene restoration device 300 corresponding to the above web page full scene restoration method. The web page full scene restoration apparatus 300 includes a unit for performing the above web page full scene restoration method, and may be configured in a server. Specifically, referring to fig. 10, the web page full scene restoration apparatus 300 includes a file packet obtaining unit 301, a flow parsing unit 302, a content replacing unit 303, a message reorganizing unit 304, a content parsing unit 305, a constructing unit 306, and a key value determining unit 307.
A file packet obtaining unit 301, configured to obtain, when an abnormality occurs in the system, independent file packets of all TCP session information at an abnormal time point from the intranet; the flow analysis unit 302 is configured to perform TCP flow analysis on the independent file packet to obtain an analysis result; a content replacing unit 303, configured to replace content of all data content of the local machine corresponding to the system with a target address of TCP in the analysis result, so as to obtain TCP flow connection information; a message reassembly unit 304, configured to reassemble an http message according to the TCP traffic connection information, so as to obtain a message content; a content parsing unit 305, configured to parse the message content to construct a numeric memory of key-value pairs; a construction unit 306, configured to construct a key according to a request when the user terminal initiates the request; a key value determining unit 307, configured to determine a corresponding key value from the numerical value memory according to the key, and feed back the key value to the user terminal.
In one embodiment, as shown in fig. 11, the flow analysis unit 302 includes a reading subunit 3021 and a flow reassembly subunit 3022.
A reading subunit 3021, configured to read, in a byte stream manner, the segment traffic of the TCP of the independent file packet; and the flow reorganizing subunit 3022 is configured to reorganize the segment flows of the TCP to obtain an analysis result.
In one embodiment, as shown in fig. 12, the traffic reorganizing subunit 3022 includes a location determining module 30221, an array creating module 30222, an inserting module 30223, a judging module 30224, and a content determining module 30225.
A position determining module 30221, configured to determine a message position according to the segment flow of TCP; an array creation module 30222 for creating a byte array according to the data length field value of the segment flow of the TCP; the inserting module 30223 is used for inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment; a determining module 30224, configured to determine whether the byte array is completely filled; and if the byte array is not completely filled, executing the step of determining the message position according to the segmentation flow of the TCP. The content determining module 30225 is configured to determine that the content of the byte array is a parsing result if the byte array is completely filled.
In one embodiment, as shown in fig. 13, the location determining module 30221 includes a field obtaining sub-module 302211 and a calculating sub-module 302212.
A field obtaining submodule 302211, configured to obtain a sequence number and a data length field in a header of a TCP packet segment in a segmented flow of TCP; and the calculating submodule 302212 is used for calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field so as to obtain the message position.
In one embodiment, as shown in fig. 14, the content replacing unit 303 includes a matching subunit 3031 and an address replacing subunit 3032.
A matching subunit 3031, configured to match domain name ports and IP ports with all data contents of a local machine corresponding to the system by using a target address of TCP in the analysis result; address replacement subunit 3032 is configured to replace the matched result with the IP and the port of the local machine to obtain TCP traffic connection information.
In one embodiment, as shown in fig. 15, the content parsing unit 305 includes a message parsing subunit 3051 and a relationship construction subunit 3052.
The message Wen Jiexi subunit 3051 is configured to sequentially read the message content, and parse the message content into an HTTP request and an HTTP response according to an HTTP message structure; the relationship construction subunit 3052 is configured to construct a corresponding relationship between the request and the response, and construct a numerical memory of a key value pair, where a key is a request URI, a request method, and a request parameter of the HTTP request, and a value is all byte information of the response corresponding to the HTTP request.
It should be noted that, as a person skilled in the art can clearly understand, the specific implementation process of the above-mentioned web page full scene restoration device 300 and each unit may refer to the corresponding description in the foregoing method embodiment, and for convenience and brevity of description, the description is omitted here.
The web page full scene restoration apparatus 300 described above may be implemented in the form of a computer program that can be run on a computer device as shown in fig. 16.
Referring to fig. 16, fig. 16 is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device 500 may be a server, where the server may be a stand-alone server or may be a server cluster formed by a plurality of servers.
With reference to FIG. 16, the computer device 500 includes a processor 502, memory, and a network interface 505 connected by a system bus 501, where the memory may include a non-volatile storage medium 503 and an internal memory 504.
The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions that, when executed, cause the processor 502 to perform a method of full scene restoration of a web page.
The processor 502 is used to provide computing and control capabilities to support the operation of the overall computer device 500.
The internal memory 504 provides an environment for the execution of a computer program 5032 in the non-volatile storage medium 503, which computer program 5032, when executed by the processor 502, causes the processor 502 to perform a web page full scene restoration method.
The network interface 505 is used for network communication with other devices. It will be appreciated by those skilled in the art that the structure shown in FIG. 16 is merely a block diagram of some of the structures associated with the present inventive arrangements and does not constitute a limitation of the computer device 500 to which the present inventive arrangements may be applied, and that a particular computer device 500 may include more or fewer components than shown, or may combine certain components, or may have a different arrangement of components.
Wherein the processor 502 is configured to execute a computer program 5032 stored in a memory to implement the steps of:
when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from an intranet; TCP flow analysis is carried out on the independent file package so as to obtain an analysis result; performing content replacement on all data contents of which the target address of the TCP is the local corresponding to the system in the analysis result to obtain TCP flow connection information; carrying out http message recombination according to the TCP flow connection information to obtain message content; analyzing the message content to construct a numerical memory of key value pairs; when a user terminal initiates a request, constructing a key according to the request; and determining a corresponding key value from the numerical value memory according to the key, and feeding back the key value to the user terminal.
And when the system is abnormal, intercepting all TCP session information of an abnormal time point from the file, and independently packaging the file packet.
In an embodiment, when implementing the step of performing TCP traffic parsing on the independent file package to obtain a parsing result, the processor 502 specifically implements the following steps:
reading the segmentation flow of the TCP of the independent file packet in a byte stream mode; and recombining the segmentation flow of the TCP to obtain an analysis result.
In an embodiment, when the step of reorganizing the segment traffic of the TCP to obtain the parsing result is implemented by the processor 502, the following steps are specifically implemented:
determining a message position according to the segmentation flow of the TCP; creating a byte array according to the data length field value of the segmented flow of the TCP; inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment; judging whether the byte array is completely filled; if the byte array is completely filled, determining the content of the byte array as an analysis result; and if the byte array is not completely filled, executing the step of determining the message position according to the segmentation flow of the TCP.
In one embodiment, when the step of determining the location of the message according to the segment flow of TCP is implemented by the processor 502, the following steps are specifically implemented:
acquiring a sequence number and a data length field in a TCP message segment header in the segmentation flow of TCP; and calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field to obtain the message position.
In an embodiment, when implementing the step of replacing the content of the TCP target address in the analysis result with all the data contents of the local machine corresponding to the system to obtain the TCP traffic connection information, the processor 502 specifically implements the following steps:
matching domain name ports and IP ports of all data contents of which the target address of TCP is the local corresponding to the system in the analysis result; and replacing the matched result with the IP and the port of the local machine to obtain TCP flow connection information.
In one embodiment, when the step of parsing the message content to construct the numerical memory of the key-value pair is implemented by the processor 502, the following steps are specifically implemented:
sequentially reading the message content, and analyzing the message content into an HTTP request and an HTTP response according to an HTTP message structure; and constructing a corresponding relation between the request and the response, and constructing a numerical memory of a key value pair, wherein the key is a request URI, a request method and a request parameter of the HTTP request, and the value is all byte information of the response corresponding to the HTTP request.
It should be appreciated that in an embodiment of the application, the processor 502 may be a central processing unit (Central Processing Unit, CPU), the processor 502 may also be other general purpose processors, digital signal processors (Digital Signal Processor, DSPs), application specific integrated circuits (Application Specific Integrated Circuit, ASICs), off-the-shelf programmable gate arrays (Field-Programmable Gate Array, FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. Wherein the general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
Those skilled in the art will appreciate that all or part of the flow in a method embodying the above described embodiments may be accomplished by computer programs instructing the relevant hardware. The computer program comprises program instructions, and the computer program can be stored in a storage medium, which is a computer readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the flow steps of the embodiments of the method described above.
Accordingly, the present application also provides a storage medium. The storage medium may be a computer readable storage medium. The storage medium stores a computer program which, when executed by a processor, causes the processor to perform the steps of:
when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from an intranet; TCP flow analysis is carried out on the independent file package so as to obtain an analysis result; performing content replacement on all data contents of which the target address of the TCP is the local corresponding to the system in the analysis result to obtain TCP flow connection information; carrying out http message recombination according to the TCP flow connection information to obtain message content; analyzing the message content to construct a numerical memory of key value pairs; when a user terminal initiates a request, constructing a key according to the request; and determining a corresponding key value from the numerical value memory according to the key, and feeding back the key value to the user terminal.
And when the system is abnormal, intercepting all TCP session information of an abnormal time point from the file, and independently packaging the file packet.
In one embodiment, when the processor executes the computer program to implement the step of performing TCP flow parsing on the independent file package to obtain a parsing result, the method specifically includes the following steps:
reading the segmentation flow of the TCP of the independent file packet in a byte stream mode; and recombining the segmentation flow of the TCP to obtain an analysis result.
In one embodiment, when the processor executes the computer program to implement the step of reorganizing the segment traffic of the TCP to obtain the analysis result, the following steps are specifically implemented:
determining a message position according to the segmentation flow of the TCP; creating a byte array according to the data length field value of the segmented flow of the TCP; inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment; judging whether the byte array is completely filled; if the byte array is completely filled, determining the content of the byte array as an analysis result; and if the byte array is not completely filled, executing the step of determining the message position according to the segmentation flow of the TCP.
In one embodiment, when the processor executes the computer program to implement the step of determining the location of the message according to the segment flow rate of the TCP, the method specifically includes the following steps:
acquiring a sequence number and a data length field in a TCP message segment header in the segmentation flow of TCP; and calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field to obtain the message position.
In an embodiment, when executing the computer program to implement the step of replacing the content of all the data contents of the local machine corresponding to the system with the target address of the TCP in the analysis result, the processor specifically implements the following steps:
matching domain name ports and IP ports of all data contents of which the target address of TCP is the local corresponding to the system in the analysis result; and replacing the matched result with the IP and the port of the local machine to obtain TCP flow connection information.
In one embodiment, when the processor executes the computer program to implement the step of parsing the message content to construct a numerical memory of key-value pairs, the processor specifically implements the following steps:
sequentially reading the message content, and analyzing the message content into an HTTP request and an HTTP response according to an HTTP message structure; and constructing a corresponding relation between the request and the response, and constructing a numerical memory of a key value pair, wherein the key is a request URI, a request method and a request parameter of the HTTP request, and the value is all byte information of the response corresponding to the HTTP request.
The storage medium may be a U-disk, a removable hard disk, a Read-Only Memory (ROM), a magnetic disk, or an optical disk, or other various computer-readable storage media that can store program codes.
Those of ordinary skill in the art will appreciate that the elements and algorithm steps described in connection with the embodiments disclosed herein may be embodied in electronic hardware, in computer software, or in a combination of the two, and that the elements and steps of the examples have been generally described in terms of function in the foregoing description to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of each unit is only one logic function division, and there may be another division manner in actual implementation. For example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed.
The steps in the method of the embodiment of the application can be sequentially adjusted, combined and deleted according to actual needs. The units in the device of the embodiment of the application can be combined, divided and deleted according to actual needs. In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The integrated unit may be stored in a storage medium if implemented in the form of a software functional unit and sold or used as a stand-alone product. Based on such understanding, the technical solution of the present application is essentially or a part contributing to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a terminal, a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present application.
While the application has been described with reference to certain preferred embodiments, it will be understood by those skilled in the art that various changes and substitutions of equivalents may be made and equivalents will be apparent to those skilled in the art without departing from the scope of the application. Therefore, the protection scope of the application is subject to the protection scope of the claims.
Claims (10)
1. The webpage full scene restoration method is characterized by comprising the following steps of:
when the system is abnormal, acquiring independent file packages of all TCP session information at an abnormal time point from an intranet;
TCP flow analysis is carried out on the independent file package so as to obtain an analysis result;
performing content replacement on all data contents of which the target address of the TCP is the local corresponding to the system in the analysis result to obtain TCP flow connection information;
carrying out http message recombination according to the TCP flow connection information to obtain message content;
analyzing the message content to construct a numerical memory of key value pairs;
when a user terminal initiates a request, constructing a key according to the request;
and determining a corresponding key value from the numerical value memory according to the key, and feeding back the key value to the user terminal.
2. The method for restoring the full scene of the web page according to claim 1, wherein the independent file packet is a file packet formed by monitoring all TCP flows of a network card where a default gateway is located after the system operates, storing all TCP flow increments into a file, intercepting all TCP session information of an abnormal time point from the file when the system is abnormal, and individually packaging.
3. The method for full scene restoration of a web page according to claim 1, wherein the performing TCP traffic analysis on the independent file packet to obtain an analysis result includes:
reading the segmentation flow of the TCP of the independent file packet in a byte stream mode;
and recombining the segmentation flow of the TCP to obtain an analysis result.
4. The method for web page full scene restoration according to claim 3, wherein the reorganizing the segment traffic of the TCP to obtain the parsing result includes:
determining a message position according to the segmentation flow of the TCP;
creating a byte array according to the data length field value of the segmented flow of the TCP;
inserting the data of the message into the corresponding byte array position according to the sequence number in the header of the TCP message segment;
judging whether the byte array is completely filled;
if the byte array is completely filled, determining the content of the byte array as an analysis result;
and if the byte array is not completely filled, executing the step of determining the message position according to the segmentation flow of the TCP.
5. The method for full scene restoration of a web page according to claim 1, wherein determining the message position according to the segment flow of the TCP comprises:
acquiring a sequence number and a data length field in a TCP message segment header in the segmentation flow of TCP;
and calculating the position of the segmentation flow of the TCP in the whole data flow according to the sequence number and the data length field to obtain the message position.
6. The method for full-scene restoration of a web page according to claim 1, wherein the content replacing the TCP target address in the analysis result for all the data contents of the local machine corresponding to the system to obtain TCP traffic connection information includes:
matching domain name ports and IP ports of all data contents of which the target address of TCP is the local corresponding to the system in the analysis result;
and replacing the matched result with the IP and the port of the local machine to obtain TCP flow connection information.
7. The method for full scene restoration of a web page according to claim 1, wherein the parsing the message content to construct a numeric memory of key-value pairs comprises:
sequentially reading the message content, and analyzing the message content into an HTTP request and an HTTP response according to an HTTP message structure;
and constructing a corresponding relation between the request and the response, and constructing a numerical memory of a key value pair, wherein the key is a request URI, a request method and a request parameter of the HTTP request, and the value is all byte information of the response corresponding to the HTTP request.
8. The full scene restoring device of webpage, its characterized in that includes:
the file packet acquisition unit is used for acquiring independent file packets of all TCP session information at an abnormal time point from the intranet when the system is abnormal;
the flow analysis unit is used for carrying out TCP flow analysis on the independent file package so as to obtain an analysis result;
the content replacing unit is used for replacing the content of all the data content of which the target address of the TCP in the analysis result is the local corresponding to the system so as to obtain TCP flow connection information;
the message reorganizing unit is used for carrying out http message reorganization according to the TCP flow connection information so as to obtain message content;
the content analysis unit is used for analyzing the message content to construct a numerical memory of key value pairs;
a construction unit, configured to construct a key according to a request when a user terminal initiates the request;
and the key value determining unit is used for determining a corresponding key value from the numerical value memory according to the key and feeding back the key value to the user terminal.
9. A computer device, characterized in that it comprises a memory on which a computer program is stored and a processor which, when executing the computer program, implements the method according to any of claims 1-7.
10. A storage medium storing a computer program which, when executed by a processor, implements the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310590608.3A CN117081935A (en) | 2023-05-24 | 2023-05-24 | Webpage full scene restoration method and device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310590608.3A CN117081935A (en) | 2023-05-24 | 2023-05-24 | Webpage full scene restoration method and device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117081935A true CN117081935A (en) | 2023-11-17 |
Family
ID=88710328
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310590608.3A Pending CN117081935A (en) | 2023-05-24 | 2023-05-24 | Webpage full scene restoration method and device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117081935A (en) |
-
2023
- 2023-05-24 CN CN202310590608.3A patent/CN117081935A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8510469B2 (en) | Measuring attributes of client-server applications | |
| US8547974B1 (en) | Generating communication protocol test cases based on network traffic | |
| US8539224B2 (en) | Obscuring form data through obfuscation | |
| US8032626B1 (en) | Method and system for monitoring the performance of a distributed application | |
| US20100268834A1 (en) | Method For Embedding Meta-Commands in Normal Network Packets | |
| US10887201B2 (en) | Method for automatically monitoring end-to-end end user performance and apparatus for performing the method | |
| US20130007274A1 (en) | Method for Analyzing Browsing and Device for Implementing the Method | |
| US20060045019A1 (en) | Network testing agent with integrated microkernel operating system | |
| US11271856B2 (en) | Concept for segmenting an application buffer into data packets | |
| US20150071085A1 (en) | Network gateway for real-time inspection of data frames and identification of abnormal network behavior | |
| EP3142307B1 (en) | Method and apparatus for categorising a download of a resource | |
| CN105589764B (en) | CPU abnormality eliminating methods and device | |
| CN111385163A (en) | Flow analysis and detection method and device | |
| US10176068B2 (en) | Methods, systems, and computer readable media for token based message capture | |
| WO2021174879A1 (en) | Ai video call quality analysis method and apparatus, computer device, and storage medium | |
| CN113220481A (en) | Request processing and feedback method and device, computer equipment and readable storage medium | |
| CN117081935A (en) | Webpage full scene restoration method and device, computer equipment and storage medium | |
| CN113179317B (en) | Test system and method for content rewriting device | |
| CN113285951A (en) | Request forwarding method, device, equipment and storage medium | |
| CN113285904A (en) | RDP-based method for analyzing disk mapping file information | |
| CN107948234A (en) | The processing method and processing device of data | |
| US10191826B2 (en) | Methods, systems, and computer readable media for providing an anticipated data integrity check | |
| CN113282358A (en) | File transmission analysis method and device of bastion machine | |
| CN115037793B (en) | User datagram protocol data processing method and device and electronic equipment | |
| CN103346935B (en) | Method, the equipment and system of fragment message restructuring test |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |