CN117082161A - Capture filtration system for FCoE - Google Patents

Abstract

The application discloses a capturing and filtering system for FCoE, comprising: the software analysis module and the hardware execution module; the software analysis module is arranged in the CPU, and is used for processing the filtering expression input by the user, compiling the legal expression into a binary instruction and writing the binary instruction into a register of the hardware execution module; the hardware execution module is arranged in the FPGA, and is used for capturing the message data of the external device according to the capture instruction issued by the software analysis module and realizing message loop-back, storing the filter instruction issued by the software analysis module, caching the captured data, filtering the captured data stream according to the filter instruction of the software analysis module, and transmitting the filtered message to the external memory. The application has the advantages that the capturing and filtering system for FCoE processes the capturing and filtering function by using FPGA logic, improves capturing performance and can carry out capturing and filtering under a high-speed network.

Description

Capture filtration system for FCoE

Technical Field

The application belongs to the technical field of networks, and particularly relates to a capturing and filtering system for FCoE.

Background

Along with the acceleration of the global informatization process, massive data information is penetrated in all aspects of daily life work. The network analysis tool can capture and analyze the process of online data transmission on the network, and can better understand the network characteristics, check the network communication body, confirm the application occupying the network bandwidth, identify the network use peak, identify possible attacks and malicious activities, find the unsafe application and abuse the network resources.

Meanwhile, as the network transmission rate is continuously improved, the protocol complexity is higher and higher, and besides the most widely applied Ethernet protocol, the Fiber Channel (FC) protocol has the characteristics of high reliability, strong real-time performance, good manageability, strong expansibility, high transmission bandwidth, low transmission delay, long transmission distance and the like, and meanwhile, the flexible topology structure is provided, so that the method is very suitable for the fields of high-performance networked storage and avionics. The fiber channel over ethernet technology (Fibre Channel over Ethernet, FCoE) expands the FC protocol, merges the FC network with the ethernet, enables users to extend the architecture of both networks and enjoy the advantages of both networks at the same time, greatly reduces the cost, and gradually gets a wide range of applications. Therefore, how to capture and analyze the network message under the FCoE framework has practical significance, and is a necessary means for performing network test, simulation, fault diagnosis and protocol verification.

However, due to the rapid development of network technology, the wide application of optical fiber technology, the network bandwidth has realized a jump type increase. The traditional message capturing tool is not attractive in high-speed network environment, and cannot meet the requirements of high flow and high bandwidth nowadays. The capture filter can efficiently search the data needed by the user in the dense data, meanwhile, the memory duplication is reduced, the processor resource for capturing the redundant data packet is saved, and the performance is obviously improved. Common network analysis tools such as Wireshark, winpcap all contain capture filters, but they cannot achieve high speed filtering in excess of 100G, are difficult to accommodate in modern high speed networks, and do not have FCoE, the capture filtering of the underlying code stream.

Therefore, to improve the efficiency of the capture filter, adapt it to a high-speed network, improve the versatility of the system, and expand the supported protocols, further research on the FCoE capture filtering scheme is required.

Disclosure of Invention

The application provides a capturing and filtering system for FCoE, which solves the technical problems, and specifically adopts the following technical scheme:

a capture filtration system for FCoE, comprising: the software analysis module and the hardware execution module;

the software analysis module is arranged in the CPU, is used for processing a filtering expression input by a user, compiles a legal expression into a binary instruction, writes the binary instruction into a register of the hardware execution module, provides information for the operation of the hardware execution module, and is also used for analyzing data captured by the hardware execution module;

the hardware execution module is arranged in the FPGA and is used for capturing message data of external equipment according to the capture instruction issued by the software analysis module and realizing message loop-back, the hardware execution module stores the filter instruction issued by the software analysis module, caches the captured data, filters the captured data stream according to the filter instruction of the software analysis module and transmits the filtered message to the external memory.

Further, the Data captured by the hardware execution module comprises frame Data and Raw Data.

Further, the hardware execution module captures data link layer frame data or PCS layer 8B/10B, 64/66B code streams.

Further, the software analysis module comprises a filtering instruction compiling unit and a captured data analysis unit;

the filtering instruction compiling unit analyzes the filtering expression, translates the original input filtering expression into assembly code, converts the assembly code into a binary instruction which can be understood by hardware, and writes the compiled binary instruction into a corresponding register which is set for the hardware executing module through a PCIe bus;

the captured Data analyzing unit analyzes the frame Data according to the frame format, extracts the bottom primitive and the frame Data from the Raw Data according to the specific format, classifies and combines the bottom primitive and the frame Data to form a new complete frame message or primitive message, and then analyzes the meaning of the new complete frame message or primitive message.

Further, raw Data uses 16 bytes of Data information and 4 bytes of control information as a group, and each byte of Data has two bits of control information, namely a K code indicating bit and an error code indicating bit;

analyzing corresponding Data information according to control information by taking Raw Data as a unit, and determining a Data type;

the primitive data includes ARBff, IDLE, R _rdy, bb_ SCs, BBSCr, NOS, OLS, LR, LRR;

the analysis of the primitive data by the captured data analysis unit comprises merging nearby primitives of the same type, forming a new message according to the primitive types and the quantity, analyzing the new message by software, and displaying the primitive types and the quantity;

the captured data analysis unit needs to take SOF and EOF as boundaries for frame data analysis, extracts frames in 1 or 2 original messages, and analyzes the frames according to a frame format after forming a continuous complete message.

Further, the filtering instruction compiling unit further carries out grammar judgment before compiling, and if grammar errors exist, compiling is terminated.

Further, a binary instruction is compiled that is defined by type, addressing mode, jump offset, and immediate.

Further, the filtering expression is composed of primitives, the primitives comprise limiting words and limiting values, the plurality of primitives or the plurality of limiting values are connected through logic operators, the filtering instruction compiling unit analyzes the primitives in the filtering expression, and compiling is carried out according to the number of the primitives, the limiting words, the limiting values and the logic relations among the primitives.

Further, the qualifiers include protocols, types, and directions;

the protocol defines a protocol to be matched;

the type indicates the meaning represented by the ID;

the direction refers to whether the transmission direction is the source or the destination;

the limiting value comprises a name or a number, and represents a specific numerical value of the limiting word;

the logical operators include a join operator and, a select operator or, and a negative operator not.

Further, the hardware execution module comprises a data capturing unit and a data filtering unit;

the data capturing unit is used for converting the message data of the external equipment into parallel data through the transceiver, encoding and decoding the parallel data, converting the parallel data into an AXIS bus format and an FCoE message, and transmitting the parallel data into the data filtering unit;

the data filtering unit is used for implementing the execution of the instruction and the filtering of the data, completing the operation of message filtering, executing a filtering program on each received data packet by loading the stored instruction, and sending the received data packet to the external memory.

The application has the advantages that the capture and filtration system for FCoE provided by the application processes the capture and filtration function related to Wireshark by using FPGA logic, improves the capture performance and can carry out capture and filtration under a high-speed network.

The application has the advantages that the capturing and filtering system for FCoE uses capturing and filtering to directly discard the messages which are not concerned by the user, thereby improving the capturing performance; meanwhile, the capturing and filtering of the FCoE message are also expanded, the method is suitable for filtering on the FCoE network, the 8B/10B code stream and the 64/66B code stream of the PCS layer can be acquired, and the use scene of the system is increased.

Drawings

In order to more clearly illustrate the embodiments of the application or the technical solutions of the prior art, the drawings which are used in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are only some embodiments of the application, and that other drawings can be obtained according to these drawings without inventive faculty for a person skilled in the art.

FIG. 1 is a schematic diagram of a capture filtration system for FCoE of the present application;

FIG. 2 is a schematic diagram of the internal structure of the software analysis module according to the present application;

FIG. 3 is a schematic diagram of filtering expression parsing according to an exemplary embodiment of the present application;

FIG. 4 is a diagram illustrating the parsing of a Raw Data message according to an exemplary embodiment of the present application;

FIG. 5 is a schematic diagram of the internal structure of the hardware execution module according to the present application.

Detailed Description

Embodiments of the present application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative and intended to explain the present application and should not be construed as limiting the application.

As shown in fig. 1, the present application discloses a capture filtration system 100 for FCoE, comprising: a software parsing module 10 and a hardware execution module 20.

The software parsing module 10 is provided in the CPU. The software analysis module 10 is configured to process a filtering expression input by a user, compile a legal expression into a binary instruction, write the binary instruction into a register of the hardware execution module 20, provide information for an operation of the hardware execution module 20, and analyze data captured by the hardware execution module 20.

The hardware execution module 20 is provided in the FPGA. The hardware execution module 20 is configured to capture the message data of the external device according to the capture instruction issued by the software analysis module 10 and implement message loop-back. The Data captured by the hardware execution module 20 includes frame Data and an underlying code stream (Raw Data). Specifically, the hardware execution module 20 captures data link layer frame data or PCS layer 8B/10B, 64/66B code streams.

The hardware execution module 20 also stores the filtering instruction issued by the software analysis module 10, caches the captured data, filters the captured data stream according to the filtering instruction of the software analysis module 10, and transmits the filtered message to the external memory.

As shown in fig. 2, in the embodiment of the present application, the software parsing module 10 includes a filtering instruction compiling unit 11 and a captured data parsing unit 12.

The filter instruction compiling unit 11 parses the filter expression, translates the filter expression that was input into assembly code, translates the assembly code into a binary instruction that can be understood by hardware, and writes the compiled binary instruction into a corresponding register set for the hardware execution module 20 through the PCIe bus.

The filtering expression consists of primitives, each primitive comprises a limiting word and a limiting value, and a plurality of primitives or a plurality of limiting values are connected through a logic operator. The filtering instruction compiling unit 11 parses the primitives in the filtering expression, and compiles the primitives according to the number of the primitives, the qualifiers, and the logical relationships between the primitives. Preferably, the filter instruction compiling unit 11 further makes a grammar judgment before compiling, and if there is a grammar error, terminates the compiling. After extraction, the original string filter expression is arranged into N primitive blocks (N is a positive integer) and N-1 inter-primitive logical words. For simplicity of description, the i-th primitive block is denoted as PBi (0 < =i < N), the k-th inter-primitive logical word is denoted as logic (0 < =k < N-1), and the primitive block is composed of a qualifier, a qualifier number, and is denoted as < Determiner, { val0. And translating the original input expression into assembly code according to the extracted primitive and logic relation, and compiling the assembly code into a binary instruction which can be understood by hardware. A binary instruction is compiled that is defined by type, addressing mode, jump offset, and immediate.

In general, a filtered expression consists of one or more primitives, typically composed of a limit value and a qualifier, and multiple primitives or multiple limit values may be connected by logical operators, thus composing a higher level expression. Qualifiers include protocols, types, and directions.

Where the protocol defines the protocol to be matched, such as fcoe, tcp, udp, ether.

The type indicates the meaning represented by the ID, such as port, sid, etc.

The direction refers to whether the direction of transmission is the source or destination, i.e. src or dst.

The qualifier contains a name or number representing the particular numerical value of the qualifier.

Logical operators include a join operator and (≡), a select operator or (|) and a negative operator not (|), indicating the number of conditions satisfied. The negative operator has the highest priority, the connection operator has the same priority as the selection operator, and the operation is from left to right.

An example of a filtering expression of the present application is shown in fig. 3. In this example, the original expression is extracted as n=2 primitive blocks and N-1=1 logical words; PB0 contains a determiner=sid, num=2 Val, val0=0x100100, val1=0x100200; PB1 contains a determiner=did, num=1 Val, val0=0x 100300; logic0 is and, linking PB0 and PB1.

Preferably, the filtering instruction compiling unit 11 is implemented as follows:

s111: the space is used as a boundary to acquire each word, and if the first qualifier is not fcoe and other protocols or the non-logic word, the applicable qualifier and the word of the number or the expression is overlong, the expression is wrong; after the acquisition is finished, returning each word array and the word number;

s112: locking logical words among primitives in the array returned by S111, namely, the former bit is a number, the latter bit is a qualifier, the former bit is a logical word, and if the former bit and the latter bit are qualifiers, the former bit and the latter bit are both qualifiers, the former bit and the latter bit are the qualifiers, and the latter bit indicates that the expression is wrong; obtaining a logic word array and the number of logic words, and obtaining the number of primitives at the same time;

s113: and taking the logical words obtained in the step S112 as boundaries to obtain each primitive block. Determining the limiting words and limiting values of each primitive block, and if three conditions of 'and' logic words exist between the limiting values, the limiting words do not exist in the first position of each part, the numbers and the logic words do not alternately exist and the numbers end, then the expression is wrong; obtaining primitive arrays and assembling line numbers. Calculating the length of a binary instruction and distributing a proper memory according to the number of all the extracted primitive blocks;

s114: determining the immediate number and byte width of a loading command according to the command type of the primitive block, and storing the immediate number and byte width of the loading command into a pre-allocated memory by using binary expression;

s115: determining the immediate number of the jump command according to the qualifier of the primitive block, determining the jump offset according to the logic relation, using binary expression, and storing the jump offset into a pre-allocated memory;

s116: if the qualifier is completely compiled, selecting the next primitive block to execute S114, otherwise executing S115 until the primitive blocks are completely compiled, and executing S117;

s117: the compiled binary instructions are written into two 32-bit instruction registers set by the hardware execution module 20 in sequence through a PCIe bus, and whether the instructions are valid is controlled by a filtering control register.

The captured Data parsing unit 12 parses the frame Data according to the frame format, extracts the underlying primitive and frame Data from Raw Data according to the specific format, classifies and merges the extracted underlying primitive and frame Data to form a new complete frame message or primitive message, and parses the meaning of the new complete frame message or primitive message. The primitive message contains the type, number and error code information of the primitives.

In the embodiment of the application, raw Data is a group of 16 bytes of Data information and 4 bytes of control information, and each byte of Data has two bits of control information, namely a K code indicating bit and an error code indicating bit. The K code indication position 1 indicates that the byte is a K code, and vice versa, the error code indication position 1 indicates that the 16 bytes of data are all errors, and for simplicity of description, the i-th data information is denoted as DATAi, and the corresponding control information is denoted as CTRLi (1 < =i < =4).

And analyzing the corresponding Data information according to the control information by taking Raw Data as a unit, and determining the Data type and the content.

The primitive data includes ARBff, IDLE, R _rdy, bb_ SCs, BBSCr, NOS, OLS, LR, LRR, and the frame data includes SOF, EOF, and frame content.

The parsing of the primitive data by the captured data parsing unit 12 includes merging the nearby primitives of the same type, composing a new message according to the primitive types and numbers, and the software parses the new message and displays the primitive types and numbers.

The captured data parsing unit 12 needs to parse the frame data by using SOF and EOF as boundaries, and extracts frames in 1 or 2 original messages to form a continuous complete message, and then parses the continuous complete message according to a frame format.

As shown in fig. 4, which is a correct example of Raw Data message parsing, the message is in pcapng format, the original message content is stored in Raw Data group form, the primitive and frame of the bottom layer are mixed, and the parsed message divides the primitive and frame of the bottom layer into multiple messages.

The captured data analysis unit 12 is specifically implemented as follows:

s121: selecting a group of Raw Data blocks, judging whether error codes exist in CTRL, if so, forming error code messages, continuously analyzing the next group, and if not, executing S122;

s122: and sequentially analyzing DATAi and CTRRI, judging whether different primitive messages or frame messages are being integrated or not if the primitive data are the primitive data, ending the process, starting counting, and continuing counting if the primitives of the same type are available. If the frame content is the frame content, judging whether the frame data messages are being integrated, if yes, counting, and otherwise, discarding. If the frame delimiter SOF is the frame delimiter SOF, the frame data messages are integrated, and the messages before the end are finished. If the frame is the frame delimiter EOF, the frame is finished, and the frame data message is counted and finished. S121 and S122 are repeated until the analysis is completed.

It should be noted that if the captured data is scrambled, then it needs to be descrambled after the frame data message is finished. The self-defined primitive message comprises the type and the number of the primitives, whether the primitives are error codes or not, and the analysis and the display are carried out by using the lua script.

As shown in fig. 5, in the embodiment of the present application, the hardware execution module 20 includes a data capturing unit 21 and a data filtering unit 22.

The data capturing unit 21 is configured to convert the serial data into parallel data via the transceiver, encode and decode the parallel data, convert the parallel data into an AXIS bus format, and transmit the FCoE message to the data filtering unit 22. The data capturing unit 21 loops the physical layer bus crossing the physical coding layer by utilizing the loop of the physical coding layer, the encoding and decoding module transmits data in a mode of data and control two groups of signals, and the loop of the message can be realized by connecting the data and control signals of the receiving end bus and the data and control signals of the transmitting end bus; the data capture unit 21 may capture frame data of the data link layer, and may also capture 8B/10B, 64/66B code streams of the physical coding layer.

The data filtering unit 22 is configured to implement execution of an instruction and filtering of data, complete filtering of a packet, execute a filtering procedure on each received data packet by loading a stored instruction, and send the received data packet to an external memory.

Specifically, the data filtering unit 22 is provided with an instruction storage space, reads instructions from an external register using an AXI bus and writes the instructions into the storage space, starts reading instructions when the filtering control register is set to 0, and continuously reads the low 32-bit instruction register and the high 32-bit instruction register in sequence and writes them into the storage space until the filtering control register is set to 1, indicating that all instructions have been fetched. The instruction memory space may be loaded via an external configuration bus. A data buffer space is provided for buffering data received by the MAC or FC CORE and transmitting the data stream using the AXIS bus. Each accepted packet is copied into the buffer space, selected for retention or discard based on the filtering instruction.

The foregoing has shown and described the basic principles, principal features and advantages of the application. It will be appreciated by persons skilled in the art that the above embodiments are not intended to limit the application in any way, and that all technical solutions obtained by means of equivalent substitutions or equivalent transformations fall within the scope of the application.

Claims (10)

1. A capture filtration system for FCoE, comprising: the software analysis module and the hardware execution module;

the software analysis module is arranged in the CPU, is used for processing a filtering expression input by a user, compiles a legal expression into a binary instruction, writes the binary instruction into a register of the hardware execution module, provides information for the operation of the hardware execution module, and is also used for analyzing data captured by the hardware execution module;

the hardware execution module is arranged in the FPGA and is used for capturing message data of external equipment according to the capture instruction issued by the software analysis module and realizing message loop-back, the hardware execution module stores the filter instruction issued by the software analysis module, caches the captured data, filters the captured data stream according to the filter instruction of the software analysis module and transmits the filtered message to the external memory.

2. The capture filtration system for FCoE as claimed in claim 1, wherein,

the Data captured by the hardware execution module comprises frame Data and Raw Data.

3. The capture filtration system for FCoE as claimed in claim 2, wherein,

the hardware execution module captures data link layer frame data or PCS layer 8B/10B, 64/66B code streams.

4. The capture filtration system for FCoE as claimed in claim 2, wherein,

the software analysis module comprises a filtering instruction compiling unit and a captured data analysis unit;

the filtering instruction compiling unit analyzes the filtering expression, translates the original input filtering expression into assembly code, converts the assembly code into a binary instruction which can be understood by hardware, and writes the compiled binary instruction into a corresponding register which is set for the hardware executing module through a PCIe bus;

the captured Data analyzing unit analyzes the frame Data according to the frame format, extracts the bottom primitive and the frame Data from the Raw Data according to the specific format, classifies and combines the bottom primitive and the frame Data to form a new complete frame message or primitive message, and then analyzes the meaning of the new complete frame message or primitive message.

5. The FCoE capture filtration system of claim 4, wherein,

raw Data takes 16 bytes of Data information and 4 bytes of control information as a group, and each byte of Data has two bits of control information, namely K code indicating bits and error code indicating bits respectively;

analyzing corresponding Data information according to control information by taking Raw Data as a unit, and determining a Data type;

the primitive data includes ARBff, IDLE, R _rdy, bb_ SCs, BBSCr, NOS, OLS, LR, LRR;

the frame data includes SOF, EOF, and frame content;

the analysis of the primitive data by the captured data analysis unit comprises merging nearby primitives of the same type, forming a new message according to the primitive types and the quantity, analyzing the new message by software, and displaying the primitive types and the quantity;

the captured data analysis unit needs to take SOF and EOF as boundaries for frame data analysis, extracts frames in 1 or 2 original messages, and analyzes the frames according to a frame format after forming a continuous complete message.

6. The FCoE capture filtration system of claim 4, wherein,

the filtering instruction compiling unit also carries out grammar judgment before compiling, and if grammar errors exist, compiling is terminated.

7. The FCoE capture filtration system of claim 4, wherein,

a binary instruction is compiled that is defined by type, addressing mode, jump offset, and immediate.

8. The FCoE capture filtration system of claim 4, wherein,

the filtering expression consists of primitives, the primitives comprise limiting words and limiting values, a plurality of primitives or a plurality of limiting values are connected through logic operators, the filtering instruction compiling unit analyzes the primitives in the filtering expression, and compiles according to the number of the primitives, the limiting words, the limiting values and the logic relations among the primitives.

9. The capture filtration system for FCoE as claimed in claim 8, wherein,

the qualifiers include protocols, types, and directions;

the protocol defines a protocol to be matched;

the type indicates the meaning represented by the ID;

the direction refers to whether the transmission direction is the source or the destination;

the limiting value comprises a name or a number, and represents a specific numerical value of the limiting word;

the logical operators include a join operator and, a select operator or, and a negative operator not.

10. The capture filtration system for FCoE as claimed in claim 2, wherein,

the hardware execution module comprises a data capturing unit and a data filtering unit;

the data capturing unit is used for converting the message data of the external equipment into parallel data through the transceiver, encoding and decoding the parallel data, converting the parallel data into an AXIS bus format and an FCoE message, and transmitting the parallel data into the data filtering unit;

the data filtering unit is used for implementing the execution of the instruction and the filtering of the data, completing the operation of message filtering, executing a filtering program on each received data packet by loading the stored instruction, and sending the received data packet to the external memory.