WO2016082380A1

WO2016082380A1 - Network data packet processing method and apparatus

Info

Publication number: WO2016082380A1
Application number: PCT/CN2015/074632
Authority: WO
Inventors: 赵先进
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-25
Filing date: 2015-03-19
Publication date: 2016-06-02
Also published as: CN105635088A

Abstract

The present invention provides a network data packet processing method and apparatus. The method comprises the following steps: determining a port that receives a data packet as well as packet protocol information (101); determining, according to a protocol rule of a data packet that needs to be captured by the port in a preset retrieval data table, whether the received data packet needs to be captured (102); and when it is determined that the data packet needs to be captured, capturing the data packet and performing preset security processing on the data packet (103). The apparatus comprises a data packet parsing module, a capture determining module, and a data packet processing module. The method and the apparatus provided in the present invention can simplify a determining process of a data packet that needs to be captured, and are applicable to most conditions in which a data packet needs to be filtered or captured.

Description

Network data packet processing method and device

Technical field

The present invention relates to the field of network communications, and in particular, to a network packet processing method and apparatus.

Background technique

With the development of the Internet faster and faster, the amount of information increases, a large amount of invalid data reduces the efficiency of network monitoring, and its processing capacity requirements for Ethernet devices are also growing. In addition to pure data forwarding, today's Ethernet devices also need to provide the co-processing capability of protocol packets. For Ethernet switches that are not very high-end, many protocol processing and network management data are performed by the central processing unit (CPU) that comes with the Ethernet switch. This structure greatly enhances the functions of the Layer 2 Ethernet switch, but it also brings serious load and security risks to the CPU, which causes the CPU to crash easily and greatly reduces the reliability of the system. For example, the CPU must run a protocol stack to support various protocols such as ARP (Address Resolution Protocol), ICMP (Internet Control Message Protocol), and IGMP (Internet Group Management Protocol). The packet function, when the rate of data packet transmission is too large, because the priority of the packet transmission interruption is high, the CPU will be greatly burdened, which may result in the failure to complete the function of the management device, and in this case, It is easy for external malicious attackers to take advantage of the fact that they can flood the network by sending Ethernet broadcasts or multicast packets.

In view of the above risks, the capture and filtering of network packets becomes more necessary. Packet filtering or packet capture is mainly to compare the protocol field information in the packet header of the packet with the filtering or capturing rules to achieve filtering of the packet. Packet filtering is a versatile, inexpensive and effective security tool. It does not use a special processing method for each specific network service, and is applicable to all network services. The packet filtering or packet capturing method used in the prior art is often only for a special case, the adaptation range is narrow, and the filtering or capturing algorithm is complicated and the efficiency is low.

Summary of the invention

In view of this, the present invention provides a network packet processing method and apparatus, which can simplify the process of determining a data packet to be captured, and adapt to most situations in which data packet filtering or capturing is required.

A network packet processing method provided by the present invention based on the above object includes the following steps:

Determine the port and packet protocol information of the received packet;

Determining whether the received data packet needs to be captured according to a protocol rule of the data packet that the port needs to capture in the preset retrieval data table;

When it is determined that the data packet needs to be captured, the data packet is captured and a predetermined security process is performed on the data packet.

In this embodiment, the step of determining whether the received data packet needs to be captured according to the protocol rule of the data packet that is required to be captured by the port in the preset search data table includes:

According to the port that receives the data packet, look up the protocol rule of the data packet that the port needs to capture in the preset retrieval data table;

According to the retrieval data table, when there is a protocol protocol record, each open system interconnection OSI layer protocol is consistent with the protocol adopted by each open system interconnection layer OSI (Open System Interconnection) layer of the received data packet, it is determined to receive Packets need to be captured;

The protocol rules record at least one protocol employed by at least one open system interconnect OSI layer of the data packet to be captured.

In this embodiment, before determining the port and the packet protocol information of the received data packet, the method further includes:

Adding at least one protocol rule record of the data packet that the port needs to capture in the retrieval data table;

In the newly added protocol rule record, the protocol type used by at least one open system interconnection OSI layer of the data packet to be captured is set.

In this embodiment, the at least one open system interconnection OSI layer includes an open system interconnection OSI layer 2, an open system interconnection OSI layer 3, and an open system interconnection OSI layer 4.

In this embodiment, the protocol rule record includes each open system interconnection OSI layer label and each open system interconnection OSI layer label protocol type number; the label is used to indicate whether the corresponding open system interconnection OSI layer protocol type is Empty; the protocol type number is used to indicate the protocol type of the corresponding open system OSI layer.

In the meantime, the present invention provides a network packet processing apparatus, including:

Packet parsing module: set to determine the port and packet protocol information of the received packet;

The capture judging module is configured to determine, according to a protocol rule of the data packet that the port needs to capture in the preset search data table, whether the received data packet needs to be captured;

Packet processing module: configured to capture the data packet and perform a predetermined security process on the data packet when it is determined that the data packet needs to be captured.

In this embodiment, the capture determining module specifically includes:

a protocol rule search unit: configured to search for a protocol rule of a data packet to be captured by the port in a preset search data table according to the port that receives the data packet;

The capture determining unit is configured to determine, according to the retrieved data table, when the protocol of each open system interconnect OSI layer specified in a protocol rule record is consistent with the protocol adopted by each open system interconnect OSI layer of the received data packet, determining receipt The incoming packet needs to be captured;

In this embodiment, the device further includes:

a port creation module: configured to add, in the retrieval data table, at least one protocol rule record of a data packet that needs to be captured by the port;

Protocol Rule Record Add Module: Set to set the protocol type used by at least one Open System Interconnect OSI layer of the data packet to be captured in the newly added protocol rule record.

As can be seen from the above, the packet filtering method and apparatus provided by the present invention use the data table method to record the protocol rules used for the data packets to be filtered. When receiving the data packet, only the search data table needs to be searched. However, the method is simple, and the filtering line can be matched effectively; at the same time, it is convenient to add ports and protocols in the retrieval data table, the packet capture filtering has small overhead, small delay, wide application range, convenient optimization, and does not affect network stability. And reliability, it can also be applied to applications such as firewalls and network access servers that need to quickly filter or capture packets.

DRAWINGS

1 is a schematic flowchart of a network packet filtering method according to an embodiment of the present invention;

2 is a schematic diagram of a port retrieval table according to an embodiment of the present invention;

3 is a schematic diagram of a protocol rule retrieval table according to an embodiment of the present invention;

4 is a schematic diagram of a protocol rule record according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a network packet filtering apparatus according to an embodiment of the present invention.

detailed description

In order to provide an effective implementation, the present invention provides the following embodiments, which are described below in conjunction with the accompanying drawings.

The present invention first provides a network packet filtering method, including the steps shown in FIG. 1:

Step 101: Determine port and packet protocol information of the received data packet;

Step 102: Determine, according to a protocol rule of the data packet that the port needs to capture in the preset retrieval data table, whether the received data packet needs to be captured;

Step 103: Perform a preset security process on the data packet when it is determined that the data packet needs to be captured.

As can be seen from the above, the network packet filtering method provided by the present invention determines whether the received data packet needs to be obtained by searching an item in the preset search data table that matches the protocol information carried in the received data packet. Capture, suitable for most scenarios that need to capture data packets, and the search operation is simple and has high efficiency. When the number of received data packets is large, the function of the network device will not be affected because the CPU is overloaded. The invention can capture the capture method through a simple and effective data packet, and better meets the current requirements, and can prevent the CPU co-processing load from being too heavy and affecting the management device function of the Ethernet switch.

In a specific embodiment of the present invention, the search data table is corresponding to each filter packet that needs to be filtered to establish a corresponding filter rule, and the rule specifies a protocol used by the data packet to be filtered in the corresponding open system interconnection OSI layer.

In a specific embodiment of the present invention, after the data packet is captured, the data packet may be subjected to security check, or processing such as filtering discarding may be performed.

In some embodiments of the present invention, the step of determining whether the received data packet needs to be captured according to a protocol rule of the data packet that is required to be captured by the port in the preset retrieval data table includes:

According to the retrieval data table, when there is a protocol protocol record, each open system interconnection OSI layer protocol is consistent with the protocol adopted by each open system interconnection OSI layer of the received data packet, it is determined that the received data packet needs to be captured. ;

In a specific embodiment of the present invention, the preset retrieval data table may include a port retrieval table and a protocol rule retrieval table, and the port retrieval table includes port numbers and port names of one or more ports, respectively corresponding to one or more data packets. The port to be sent; the port number of each port recorded in the port retrieval table can be found in the protocol rule retrieval table, and the corresponding protocol rule record can be found when the received data packet conforms to the port to be sent. When the protocol rule corresponding to the record is retrieved in the protocol rule retrieval table, it is determined that the received data packet needs to be captured because there may be a security risk.

In some embodiments of the present invention, before determining the port and packet protocol information of the received data packet, the method further includes:

In a specific embodiment of the present invention, the structure of the port retrieval table is as shown in FIG. 2, including one or more port names and port numbers, and a port number corresponding to a port name and a protocol as shown in FIG. A rule retrieval table in which one or more protocol rule records are set in the retrieval table. When you need to add a port named ETH0 and port number 0, and filter the packets sent to the ETH0 port, add the port named ETH0 and port number 0 to the port search table shown in Figure 2. Record and create a corresponding protocol rule retrieval table as shown in Figure 3, and add one or more protocol rule records in the protocol rule retrieval table, so that the port name of the received packet port is ETH0, port When the port number is 0, the protocol rule record in the search table is retrieved according to the corresponding protocol rule to determine whether the data packet needs to be captured. When ETH0 port is required The filtering rule is set to ARP protocol, and then the protocol rule retrieval table corresponds to the protocol rule record for establishing the ARP protocol.

In another specific embodiment of the present invention, the port retrieval table structure is as shown in FIG. 2, and includes one or more port names and port numbers, and one port number corresponds to a port name and a protocol rule as shown in FIG. Retrieve one or more protocol rule records in the table. When you need to add a port named ETH0 and port number 0, and filter the packets sent to the ETH0 port, add the port named ETH0 and port number 0 to the port search table shown in Figure 2. Record and add the protocol rule record of the port whose port name is ETH0 and port number 0 to the protocol rule search table shown in Figure 3. When the port name of the received packet port is ETH0 and the port number of the port is 0, the protocol rule record corresponding to the ETH0 port in the corresponding protocol rule is used to determine whether the data packet needs to be captured. When the filtering rule to be set on the ETH0 port is the ARP protocol, the protocol rule retrieval table corresponds to the protocol rule record for establishing the ARP protocol.

In some embodiments of the present invention, the at least one open system interconnection OSI layer comprises an open system interconnection OSI layer 2, an open system interconnection OSI layer 3, and an open system interconnection OSI layer 4.

In some embodiments of the present invention, the protocol rule record includes each open system interconnect OSI layer label and each open system interconnect OSI layer label protocol type number; the label is used to indicate a corresponding open system interconnect OSI layer. Whether the protocol type is empty; the protocol type number is used to indicate the protocol type of the corresponding open system OSI layer.

Still referring to FIG. 3, in a specific embodiment of the present invention, each protocol rule record includes the following items: protocol name, open system interconnection OSI layer 2 protocol type number, open system interconnection OSI layer 2 label, open type System interconnection OSI three-layer protocol type number, open system interconnection OSI three-layer label, open system interconnection OSI four-layer protocol type number, open system interconnection OSI four-layer label. The label is used to indicate whether the corresponding open system interconnection OSI layer protocol type is empty. For example, if the protocol described in a protocol rule record is a layer 2 protocol, the protocol system records the open system interconnection OSI layer 3 protocol type, The open system interconnection OSI four-layer protocol type shall be empty or invalid; in this case, the corresponding open system interconnection OSI three-layer label, open system interconnection OSI four-layer label indicates the open type in this protocol rule record The system interconnect OSI Layer 3 protocol type is empty or invalid, and the Open System Interconnect OSI Layer 4 protocol type is empty or invalid.

In a specific embodiment of the present invention, it is assumed that a port whose port name is ETH0 and whose port number is 0 needs to filter ARP protocol data packets, and the label 0 indicates that the corresponding open system interconnection layer protocol type is valid; The open system interconnect layer protocol type is invalid; the protocol type number 0 indicates that the corresponding open system interconnect layer protocol type is empty. Then, the corresponding protocol rule records are: the protocol name is ARP, the open system interconnection OSI layer 2 protocol type number is 0×0806, and the open system interconnection OSI layer 2 is 0. The open system interconnection OSI three-layer protocol type number is 0×0, the open system interconnection OSI three-layer label is 1, the open system interconnection OSI four-layer protocol type number is 0×0, and the open system interconnection OSI four-layer label is 1.

In a specific embodiment of the invention, the protocol rule record is as shown in FIG.

In a specific embodiment of the present invention, in conjunction with FIG. 4, the method includes the following steps:

Step 201: Receive a data packet to be sent to the port.

Step 202: Parse the data packet to obtain a port number and protocol header information. For example, the received data packet is an ARP data packet. The analysis indicates that the port name to be sent by the data packet is ETH0, the port number is 0, and the Layer 2 protocol type number of the data packet is 0x0806.

Step 203: Obtain a port corresponding to the port number, a protocol rule record corresponding to the port, and obtain an OSI layer 2 protocol type, an OSI layer 3 protocol type, and an OSI layer 4 of the data packet in a preset search data packet. agreement type. For example, the protocol rule record corresponding to the ETH0 port is found in the preset search data table; in the protocol rule record corresponding to ETH0, as shown in FIG. 4, a record of the Layer 2 protocol type number 0x0806 is found.

Step 204: Search for the OSI Layer 2 protocol type in the protocol rule record.

Step 205: If there is a match between the OSI Layer 2 protocol type recorded in the protocol rule record and the OSI Layer 2 protocol type used by the data packet, then the OSI Layer 3 protocol type is searched in the protocol rule record.

If the port name to be sent is ETH0 and the port number is 0, the Layer 2 protocol type of the packet is 0x0806, the Layer 3 protocol type is empty, and the Layer 4 protocol type is empty. If there is a protocol rule record with the Layer 2 protocol type number 0x0806, the Layer 3 protocol type is empty, and the Layer 4 protocol type is empty in the protocol rule record, the received data packet is consistent with the protocol rule record.

Step 206: If the OSI Layer 3 protocol type of the data packet is not empty, look for an item matching the OSI Layer 3 protocol type of the data packet in the OSI Layer 3 protocol type recorded in the protocol rule record.

Step 207: If there is a matching item between the OSI Layer 3 protocol type and the OSI Layer 3 protocol type of the data packet in the protocol rule record, then in the protocol rule record, look for the OSI layer 4 protocol type.

Step 208: If the OSI four-layer protocol type of the data packet is not empty, look for an item matching the OSI four-layer protocol type of the data packet in the OSI four-layer protocol type recorded in the protocol rule record.

In the above steps 201-208, if at least one of the OSI Layer 2, or Layer 3, or Layer 4 protocols of the received data packet is empty, and at the same time, the corresponding OSI Layer 2, or If the label of the third layer or the fourth layer is empty, then the protocol type of the corresponding OSI layer in the protocol rule record is considered to be the same as the protocol type of the corresponding OSI layer of the data packet.

Further, the present invention provides a network packet processing apparatus, and the structure is as shown in FIG. 5, including:

In some embodiments of the present invention, the capture determining module specifically includes:

In some embodiments of the present invention, the apparatus further includes:

In some embodiments of the present invention, the protocol rule record includes each open system interconnect OSI layer label and each open system interconnect OSI layer label protocol type number; the label is used to indicate a corresponding open system interconnect OSI layer protocol. Whether the type is empty; the protocol type number is used to indicate the protocol type of the corresponding open system OSI layer.

It is to be understood that the various embodiments of the present invention are intended to illustrate and explain the invention. And in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Industrial applicability

According to the foregoing technical solution provided by the embodiment of the present invention, by using a data table method, the protocol rule used for the data packet to be filtered is recorded, and when the data packet is received, only the search data table needs to be searched, and the method is simple and effective. Matching the filtering lines at the same time; at the same time, it is convenient to add ports and protocols in the retrieval data table, the packet capture filtering has small overhead, small delay, wide application range, easy optimization, does not affect the stability and reliability of the network, and can also be applied. Applications that need to quickly filter or capture packets, such as firewalls and network access servers.

Claims

A network packet processing method includes the following steps:

Determine the port and packet protocol information of the received packet;

Determining whether the received data packet needs to be captured according to a protocol rule of the data packet that the port needs to capture in the preset retrieval data table;

When it is determined that the data packet needs to be captured, the data packet is captured and a predetermined security process is performed on the data packet.
The method of claim 1, wherein the step of determining whether the received data packet needs to be captured according to a protocol rule of the data packet that is required to be captured by the port in the preset search data table comprises:

According to the port that receives the data packet, look up the protocol rule of the data packet that the port needs to capture in the preset retrieval data table;

According to the retrieval data table, when there is a protocol protocol record, each open system interconnection OSI layer protocol is consistent with the protocol adopted by each open system interconnection OSI layer of the received data packet, it is determined that the received data packet needs to be captured. ;

The protocol rules record at least one protocol employed by at least one open system interconnect OSI layer of the data packet to be captured.
The method of claim 2, wherein before determining the port and packet protocol information of the data packet, the method further comprises:

Adding at least one protocol rule record of the data packet that the port needs to capture in the retrieval data table;

In the newly added protocol rule record, the protocol type used by at least one open system interconnection OSI layer of the data packet to be captured is set.
The method according to claim 2 or 3, wherein the at least one open system interconnection OSI layer comprises an open system interconnection OSI layer 2, an open system interconnection OSI layer 3, and an open system interconnection OSI layer 4.
The method according to claim 4, wherein said protocol rule record comprises each open system interconnect OSI layer label and each open system interconnect OSI layer label protocol type number; said label is used to indicate a corresponding open system interconnection Whether the OSI layer protocol type is empty; the protocol type number is used to indicate the protocol type of the corresponding open system OSI layer.
A network packet processing apparatus includes:

Packet parsing module: set to determine the port and packet protocol information of the received packet;

The capture judging module is configured to determine, according to a protocol rule of the data packet that the port needs to capture in the preset search data table, whether the received data packet needs to be captured;

Packet processing module: configured to capture the data packet and perform a predetermined security process on the data packet when it is determined that the data packet needs to be captured.
The device according to claim 6, wherein the capture determination module specifically comprises:

a protocol rule search unit: configured to search for a protocol rule of a data packet to be captured by the port in a preset search data table according to the port that receives the data packet;

The capture determining unit is configured to determine, according to the retrieved data table, when the protocol of each open system interconnect OSI layer specified in a protocol rule record is consistent with the protocol adopted by each open system interconnect OSI layer of the received data packet, determining receipt The incoming packet needs to be captured;

The protocol rules record at least one protocol employed by at least one open system interconnect OSI layer of the data packet to be captured.
The apparatus of claim 7 wherein said apparatus further comprises:

a port creation module: configured to add, in the retrieval data table, at least one protocol rule record of a data packet that needs to be captured by the port;

Protocol Rule Record Add Module: Set to set the protocol type used by at least one Open System Interconnect OSI layer of the data packet to be captured in the newly added protocol rule record.
The apparatus according to claim 7 or 8, wherein the at least one open system interconnection OSI layer comprises an open system interconnection OSI layer 2, an open system interconnection OSI layer 3, and an open system interconnection OSI layer 4.
The apparatus according to claim 9, wherein said protocol rule record comprises each open system interconnect OSI layer label and each open system interconnect OSI layer label protocol type number; said label is used to indicate phase Whether the open system interconnection OSI layer protocol type is empty; the protocol type number is used to indicate the protocol type of the corresponding open system OSI layer.