WO2019057089A1

WO2019057089A1 - Network card image packet capture method, terminal, and readable storage medium

Info

Publication number: WO2019057089A1
Application number: PCT/CN2018/106521
Authority: WO
Inventors: 阎松明
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-09-19
Filing date: 2018-09-19
Publication date: 2019-03-28
Also published as: CN109525509A

Abstract

This disclosure provides a network card image packet capture method, a terminal, and a readable storage medium. The image packet capture method comprises the following steps: configuring a mapping module, and performing associated configuration with the mapping module on a network card, on which packet capture is to be performed, and an image port; generating an image of the network card in the image port by means of the mapping module; and performing packet capture in the image in the image port to obtain a packet of the image port.

Description

NIC image capture method, terminal, and readable storage medium

Technical field

The present disclosure relates to the field of network information technologies, and in particular, to a network card (NIC) image capture method, a terminal, and a readable storage medium.

Background technique

In computer network information technology, packet capture is a very common and useful technology. The packet capture technology is to intercept, retransmit, edit, and transfer data packets sent and received by the network transmission. Packet capture can be used to check network security or analyze traffic, so packet capture is a technology that is very practical and difficult to use.

However, in a virtual machine environment, a physical host cannot directly capture packets that are not directly connected to it. If you want to capture a network card that is mounted on a virtual machine or other network that is not directly connected to the physical host, you need to add additional external devices or change the settings of the original external network device. This increases the cost of capturing the bag, reduces the operability, and also has certain technical requirements for the operator.

Summary of the invention

The present disclosure provides a network card image capture method, where the image capture method includes the following steps: configuring a mapping module, and performing association configuration with the mapping module on the network card to be captured and the mirrored port; The image of the NIC to be captured is generated. The mirroring of the mirrored port is obtained.

The present disclosure also provides a mobile terminal, including: a memory, a processor, and a network card image capture program stored on the memory and operable on the processor, the network card image capture program being used by the processor The step of implementing the network card image capture method as described above is implemented during execution.

The present disclosure further provides a computer readable storage medium, wherein the computer readable storage medium stores a network card image capture program, and the network card image capture program is executed by the processor to implement the network card image capture method as described above. A step of.

DRAWINGS

1 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure;

2 is a schematic flowchart of a network card image capture method according to the present disclosure;

3 is a schematic flowchart of the refinement of step S30 of the network card image capture method according to the present disclosure;

4 is a schematic diagram of a usage scenario of a network card image capture method according to the present disclosure in some cases;

FIG. 5 is a schematic diagram of a usage scenario of a network card image capture method according to the present disclosure; FIG.

6 is a schematic diagram of a typical scenario of a network card image capture method according to the present disclosure;

7 is a flow chart of a network card image capture method according to the present disclosure in a typical scenario shown in FIG. 6;

8 is a schematic diagram of still another typical scenario of a network card image capture method according to the present disclosure;

9 is a flowchart of another exemplary scenario shown in FIG. 8 of the network card image capture method according to the present disclosure;

10 is a schematic diagram of another exemplary scenario of a network card image capture method according to the present disclosure;

11 is a flow chart of another exemplary scenario shown in FIG. 10 of the network card image capture method according to the present disclosure.

The implementation, functional features, and advantages of the present disclosure will be further described in conjunction with the embodiments and the accompanying drawings.

Detailed ways

It is understood that the specific embodiments described herein are merely illustrative of the disclosure and are not intended to limit the disclosure.

In various embodiments, there may be a Virtual Network Interface Card (VNIC).

As shown in FIG. 1, FIG. 1 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.

The terminal in the embodiment of the present disclosure may be a PC, or may be a smart phone, a tablet computer, an e-book reader, a Motion Picture Experts Group Audio Layer III (MP3) player, and a motion picture expert compression standard. A portable terminal device having a display function such as a Moving Picture Experts Group Audio Layer IV (MP4) player or a portable computer.

As shown in FIG. 1, the terminal may include a processor 1001 (eg, a CPU), a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Communication bus 1002 is used to implement the connections and communications between these components. The user interface 1003 can include a display, an input unit (such as a keyboard), and the user interface 1003 can also include a standard wired interface, a wireless interface. The network interface 1004 can include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high speed RAM memory or a non-volatile memory such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

The terminal may also include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, and the like. The sensors are such as light sensors, motion sensors, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display screen according to the brightness of the ambient light, and the proximity sensor may turn off the display screen when the mobile terminal moves to the ear. Or backlight. As a kind of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity (when the sensor is stationary), so it can be used to identify the mobile terminal. The application of gestures (such as horizontal and vertical screen switching, related games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping). Of course, the mobile terminal can also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, and details are not described herein again.

It will be understood by those skilled in the art that the terminal structure shown in FIG. 1 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements.

As shown in FIG. 1, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a network card image capture program.

In the terminal shown in FIG. 1, the network interface 1004 is configured to connect to the background server and perform data communication with the background server; the user interface 1003 is configured to connect to the client (user end) for data communication with the client; and the processor 1001 is set to call the network card image capture program stored in the memory 1005, and performs the following operations: setting a mapping module with the physical host command sending end in the network card driver; setting a packet capturing switch and a preset packet capturing time; and passing the mapping module Configure the mirrored port of the NIC to be captured, and capture the mirrored packets of the NIC according to the packet capture duration.

In one embodiment, the processor 1001 can invoke the network card image capture program stored in the memory 1005 to perform the following operations: selecting a mirrored port, where the mirrored port is a port that the physical host can directly capture.

In one embodiment, the processor 1001 may invoke the network card image capture procedure stored in the memory 1005 to perform the following operations: acquiring a packet of the network card to be captured, and mapping the packet to the mirrored port by using the mapping module.

In an embodiment, the processor 1001 may invoke the network card image capture program stored in the memory 1005 to perform the following operations: after receiving the packet capture instruction, the mirror port is captured by the preset packet capture tool based on the physical host. .

In an embodiment, the processor 1001 may call the network card image capture program stored in the memory 1005 to perform the following operations: recording the packet capture duration and comparing with the preset capture duration, according to the capture duration and the preset. The comparison result of the packet capture duration controls whether to stop capturing packets.

In an embodiment, the processor 1001 may call the network card image capture program stored in the memory 1005 to perform the following operations: when the packet capture duration is less than the preset capture duration, the packet capture is continued; and when the packet capture duration is greater than Or equal to the preset capture time, then stop capturing.

In an embodiment, the processor 1001 may call the network card image capture program stored in the memory 1005 to perform the following operations: after the packet capture is stopped, the packet acquired by the packet capture is stored in a preset local path.

In an embodiment, the processor 1001 may call the network card image capture program stored in the memory 1005 to perform the following operations: after the packet capture is stopped, the packet obtained by the packet capture is sent to the preset remote address through the network. .

The disclosure also provides a network image capture method.

Referring to FIG. 2, the network card image capture method includes: steps S10-S30.

In step S10, the mapping module is configured, and the network card to be captured and the mirrored port are associated with the mapping module.

Specifically, the mapping module is first added to the network card driver (the mapping module is added to the network card driver by software to have corresponding functions). The mapping module is configured to associate the network card to be captured with the mirrored port, and the mirroring port can mirror the network card to be captured by the mapping module.

In step S20, the mirroring of the network card to be captured is generated in the mirrored port by the mapping module.

Specifically, the network card driver first obtains the packet of the network card to be captured, and then maps the packet of the network card to be captured to the mirrored port through the mapping module, and then generates a mirror image of the network card to be captured on the mirrored port.

In step S30, the image of the mirrored port is captured, and the packet of the mirrored port is obtained.

Specifically, the mirrored port is different from the network card to be captured. The mirrored port is a PCI (Peripheral Component Interconnect) device that can be directly viewed by the physical host (that is, the port data can be directly obtained). Therefore, the physical host can capture the mirrored port, and the mirrored port is the mirrored packet of the NIC to be captured by the mapping module. Therefore, the packet of the mirrored port can be regarded as the packet to be captured. NIC message.

First, a mapping module is configured in the network card driver, and the mapping module can map the packets of the network card to be captured to be mapped to the mirrored port, so as to generate a mirror image of the network card to be captured in the mirrored port. The network card to be captured is not directly connected to the physical host. Therefore, the physical host cannot directly capture the captured network card. However, the physical host can capture the mirrored port through the capture tool such as TcpDump. The packet in the mirrored port is The packet obtained by the NIC to be captured is the same as that of the NIC to be captured. Therefore, the packet of the mirrored port can be obtained as the packet of the NIC to be captured. Capture the bag.

At present, virtualization technology has been widely used in computer technology. For example, NICs implement multiple virtual NICs (Single-root I/O virtualization, SR-IOV or SRIOV) to implement multiple virtual NICs (VF, Virtual). Function), each virtual machine (VM, Virtual Machine) allocates a certain number of virtual network cards according to requirements, wherein each virtual network card is a physical Peripheral Component Interconnect Express (PCI). The device is directly mounted on the virtual machine through the hardware exchange of the NIC itself. The virtual machine can view the PCI device itself. However, for the cloud platform, the physical host does not load the PCI device. Therefore, the physical host cannot implement the physical device. Capture packets on the port of the PCI device (the scenario is shown in Figure 4). In the present disclosure, the virtual network card VNIC and the virtual network card VF may have the same meaning.

If you want to solve the problem of the physical host's capture of the network card in the virtual machine environment, the first thing to be solved is how to enable the physical host to view (or connect, etc., that is, establish the association relationship between the physical host and the network card). The network card to which it is connected. In general, this can be achieved by adding external devices or by an operator modifying the settings of the external network device. However, this may increase the cost of additional use (additional external equipment), high technical requirements for operators (change the settings of external network equipment), and increase the cost of capturing packets.

In the present disclosure, by adding a mapping module to the network card driver, the port packet of the network card to be captured is mapped to the mirrored port (the mirrored port is the network card port that the physical host can directly capture), and the mirrored port is in the mirrored port. A packet with a mirrored network card to be captured. At this time, the physical host can obtain the packets of the mirrored port by capturing the mirrored port. The packets of the mirrored port are obtained by mirroring the NIC to be captured. Therefore, the packets of the mirrored port are the same as those of the NIC to be captured. Packets for the network card. Therefore, by adding a mapping module to the network card driver, an indirect connection relationship is established between the physical host and the network card to be captured, thereby realizing the packet capture of the network card to be captured (the schematic diagram of the usage scenario of the present disclosure is shown in FIG. 5). In FIG. 5, the VF image capture packet parameter can be set by calling the interface of the underlying driver in the form of IOCTL.

Packet capture is one of the most common technologies in network communication technology. Packet capture is the interception, retransmission, editing, and transfer of data packets transmitted and received by the network. Packet capture is commonly used to check network security or to intercept data for interception. For example, in the field of network security, packet capture is used to obtain data packets transmitted between networks, and after the data packet is acquired, the content of the data packet is further analyzed to determine whether the data packet contains content that threatens network security. In addition, in software development, software testing is also performed by capturing packets. After the problem is discovered, by capturing packets and obtaining incorrect data streams, logs, and other data, the tester can locate the problem by reproducing errors, intercepting data, and the like.

In actual use, there are various situations in the application scenario of capturing packets. For example, FIG. 6 illustrates a scenario in which the virtual machine VM2 captures the packet of the virtual network card VF1 port (the network card to be captured) in the virtual machine VM1 through the virtual network card VF2 (mirror port) under the same physical host HOST. FIG. 7 is a packet capture interaction process between a virtual network card VF1 (a network card to be captured) and a virtual machine VM2 (a mirror port) in the same physical host in the connection relationship in the scenario of FIG. 6; FIG. The physical host HOST captures the scenario of the virtual network card VF1 (the network card to be captured) in the virtual machine VM1 through the mirroring port through the virtual network card VF2 (mirror port). FIG. 9 illustrates a packet capture interaction process of the virtual network card VF2 (mirror port) in the virtual host VM1 in the physical host HOST in the connection relationship in the scenario of FIG. The physical host HOST and the virtual machine VM2 are described, and the scene of the virtual network card VF1 (to be captured) is mirrored by the OpenVSwitch (OVS) bridge image and the virtual network card VF2 (mirror port). Figure 11 illustrates the virtual network card VF2 (mirrored port) in the virtual host VM2 and the virtual network card VF1 (to be captured) in another virtual machine VM1. The process of interaction. In Figures 7, 9, and 11, Neutron is a network control component. The Neutron SRIOV agent is a process running on the compute node server. It is used to control the management of the SR-IOV network card and its VM. The Neutron OVS agent is running. Another process on the compute node server.

The disclosure sets the mapping module in the network card driver, sets the network card that needs to be captured to the network card driver, and the network card driver completes the mirroring function, and the host HOST can use the special packet capture tool (TcpDump, etc.) to mirror the port. The packet is captured to solve the packet capture problem caused by the virtual machine of the SR-IOV NIC in the virtual machine environment. Through the present disclosure, packet capture for all virtual network card ports in the virtual machine can be completed without adding additional external devices and without changing the external setting configuration; and, according to an embodiment of the present disclosure, the use is low in difficulty and easy to use. By capturing the image of the NIC, you can implement fault location for network data abnormality and important operations such as traffic monitoring on the network.

In an embodiment, in step S10, the step of performing the association configuration of the to-be-captured network card and the mirrored port with the mapping module includes: Step 11.

In the step S11, the mirrored port is selected, and the mirrored port is a port that the physical host can directly capture.

Specifically, the mirrored port needs to be able to be loaded by the physical host, that is, the physical host can capture the mirrored port.

After setting up the mapping module in the NIC driver, you need to select a NIC port as the mirroring port. A mirrored port is used to store the image of the NIC to be captured, and the physical host obtains the packet in the mirror. Therefore, the mirrored port is different from the NIC to be captured. The mirrored port can be loaded by the physical host. The physical network host cannot capture the physical network host. Therefore, the physical host can capture packets directly from the captured network adapter. The physical host can capture packets on the mirrored port and obtain packets on the mirrored port. By selecting the port that can be loaded by the physical host as the mirroring port, the physical host can capture the mirrored port directly.

In an embodiment, in step S20, the step of generating a mirror image of the network card to be captured in the mirror port by using the mapping module includes: step S21.

Step S21: Obtain a packet of the network card to be captured, and map the packet to the mirrored port by using the mapping module.

Specifically, when the mapping module is used to mirror the captured network card, the mapping port first obtains the data sent and received by the network card to be captured, and then sends the obtained data to the mirrored port, and generates the image in the mirrored port. Capture the image of the network card. The mapping module is configured to mirror the captured network card, which is to copy the data received and sent by the captured network card, and send the copied data to the mirrored port, so that the data in the mirrored port is the same as the data packet to be captured.

The mapping module can send the data received and sent by the network card to be captured to the mirroring port to generate a mirror image of the network card to be captured. After the mirroring port is mirrored, the physical host can obtain the mirroring of the NIC to be captured on the mirroring port.

In an embodiment, as shown in FIG. 3, in step S30, the image of the mirrored port is captured, and the step of obtaining the packet of the mirrored port includes: Steps S31-S342.

In step S31, after receiving the packet capture instruction, the mirror port is captured by the preset packet capture tool based on the physical host.

Specifically, after the mirroring port completes the mirroring of the packet to be captured, the physical host obtains the required packet by using the packet capture tool to capture the mirrored packet. .

After the mirroring packet of the NIC that needs to be captured is set on the mirrored port, the physical host can obtain the mirrored packet of the target NIC when the packet needs to be captured. The physical host captures the packets of the mirroring port through the packet capture tool (such as TcpDump).

The SR-IOV network card itself has registers in which the source destination image can be set. However, since there is no driver interface and implementation, the physical host cannot randomly capture the network card. In the present disclosure, by establishing a mapping module in the network card driver, and the mapping module establishes a bridge between the physical host and the target network card that needs to be captured, thereby solving the problem that the physical host cannot directly mount the virtual machine on the virtual machine. The problem that the NIC performs viewing (operations such as capturing packets). According to the disclosure, the physical host performs the view of the network card driver, and the network card driver completes the image capture of the network card through the mapping module, thereby implementing image capture of the network card.

In an embodiment, as shown in FIG. 3, in step S31, after the step of capturing the mirror port by using the preset packet capture tool based on the physical host, the method includes: step S32.

In step S32, the packet capture duration is recorded, and compared with the preset packet capture duration, and the packet capture is stopped according to the comparison result of the capture packet duration and the preset capture duration.

Specifically, when the packet capture is started, the packet capture start time is recorded. In the process of capturing the packet, the current time is subtracted from the packet capture start time to obtain the packet capture duration. Compare the packet capture duration with the preset capture packet duration to determine whether to continue packet capture, so as to accurately control the amount of data captured in the capture packet.

Packet capture is the process of intercepting, resending, editing, and transferring data packets sent and received by the network transmission. Therefore, the target of packet capture is data, and as the packet capture time increases, the amount of data captured by the packet will also follow. Increase. The increase in the amount of data will increase the resources occupied by the captured messages, while the excessively large data is not conducive to subsequent interpretation. Therefore, it is necessary to control the captured data to an appropriate size, so that a sufficient amount of data can be acquired at one time, and the problem that the data is too large and the resource consumption is too large and the reading speed is slow is not caused. The control of the packet capture duration can be used to control the amount of data to be captured. When the packet capture duration reaches the preset packet capture duration, it indicates that the packet has been captured with sufficient data. In order to avoid the crawling of the message data is too large, making storage and reading inconvenient.

In an embodiment, in step S32, after the step of controlling whether to stop capturing packets according to the comparison result of the packet capture duration and the preset packet capture duration, the steps include: steps S33 and S34. In step S33, when the packet capture duration is less than the preset packet capture duration, the packet capture is continued. In step S34, when the packet capture duration is greater than or equal to the preset capture packet duration, the packet capture is stopped.

Specifically, the length of the packet capture determines the total amount of data captured in this capture. The preset duration is determined according to the packet capture requirement and the hardware and software conditions. After the preset duration is set, whether to stop the packet capture is controlled according to the relationship between the recorded packet capture duration and the preset duration.

The amount of data acquired by the packet capture increases as the packet capture time increases, and the amount of data that needs to be fetched is adjusted according to different conditions. If the amount of data captured is too small, the purpose of data monitoring or network security may result in the inability to obtain accurate information due to insufficient data. If the amount of data captured is too large, it may cause inconvenience or even failure of storage or transmission, and too much data will only make the user less efficient in the analysis, and can not significantly improve the accuracy of the analysis results. Sex. Therefore, after the preset packet capture time is set according to the specific requirements, the packet capture duration is compared with the preset capture packet duration, and the comparison result is determined to continue to capture the packet or stop the packet capture, thereby accurately controlling The amount of data fetched by the port.

In an embodiment, as shown in FIG. 3, in step S34, when the packet capture duration is greater than or equal to the preset packet capture duration, the step of stopping the packet capture includes: step S341.

In step S341, after the packet capture is stopped, the packet acquired by the packet capture is stored in a preset local path.

After the packet capture is complete, the obtained port data (that is, the packet obtained by the packet capture) is stored locally, and the storage path is a preset local path.

After the packet capture is complete, the obtained packet needs to be assigned a stored local path to store the packet locally. Stored locally allows technicians to better use locally captured messages. The technician can obtain the locally stored message according to the specified path when needed, thereby realizing the analysis of the local data.

In an embodiment, in step S34, when the packet capture duration is greater than or equal to the preset packet capture duration, the step of stopping the packet capture further includes: step S342.

In step S342, after the packet capture is stopped, the packet obtained by the packet capture is sent to the preset remote address through the network.

Specifically, in addition to storing the captured message in the specified local path, the captured message can be sent to the remote address, thereby implementing remote monitoring and analysis of the network data by the technician.

In the field of network monitoring or network security, a small number of administrator devices are generally set to monitor and manage devices in the entire network. The administrator can manage all the devices on the network through the administrator device. However, the administrator device needs to obtain packet capture data from other devices on the network. To enable the administrator to obtain the port data of the device that needs to be monitored on the entire network, you need to capture the port of the device and send the obtained port data to the remote address after the packet is captured. The administrator's computer address), thus enabling computer operations such as remote monitoring. According to the NIC image capture method of the present disclosure, in addition to being able to store the captured data locally, it is also possible to set an address for transmitting the packet data to the remote end through the network. In this way, the technician can uniformly manage the devices in the network through the administrator device.

The present disclosure also provides a terminal. The terminal includes: a memory, a processor, and a network card image capture program stored on the memory and operable on the processor, where the network card image capture program is implemented by the processor, as described above The steps of the NIC image capture method.

For the method for implementing the NIC image capture program running on the processor, reference may be made to the embodiments of the NIC image capture method of the present disclosure, and details are not described herein again.

Further, embodiments of the present disclosure also propose a computer readable storage medium.

The network readable storage medium of the present disclosure stores a network card image capture program, and the network card image capture program is executed by the processor to implement the steps of the network card image capture method as described above.

It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional elements in the process, method, article, or device that comprises the element.

The above-mentioned serial numbers of the embodiments of the present disclosure are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the essential part of the technical solution of the present disclosure or the part contributing to the prior art can be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal (which may be a cell phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.

The embodiments of the present disclosure have been described above with reference to the accompanying drawings, but the present disclosure is not limited to the specific embodiments described above. The above detailed description is merely illustrative and not restrictive. Numerous forms of the invention may be made without departing from the scope of the disclosure and the scope of the invention.

Claims

A NIC image capture method includes the following steps:

The mapping module is configured, and the network card to be captured and the mirrored port are associated with the mapping module.

Generating an image of the network card to be captured in the mirrored port by using the mapping module;

Capture the mirrored port and obtain the mirrored port.
The NIC image capture method of claim 1, wherein the step of configuring the association between the network card to be captured and the mirrored port and the mapping module comprises the following steps:

A mirrored port is selected. The mirrored port is a port on which the physical host can directly capture packets.
The NIC image capture method of claim 1, wherein the step of generating a mirror image of the network card to be captured by the mapping module in the mirroring port comprises the following steps:

Obtain the packet of the NIC to be captured, and map the packet to the mirrored port through the mapping module.
The NIC image capture method of claim 1, wherein the step of capturing the image of the mirrored port and obtaining the packet of the mirrored port comprises the following steps:

After receiving the packet capture command, the mirror port is captured by the default packet capture tool based on the physical host.
The NIC image capture method according to claim 4, wherein the step of capturing the mirror port by using the preset packet capture tool after the step of the physical host includes the following steps:

Record the length of the packet capture and compare it with the preset packet capture time. Control whether to stop capturing packets based on the comparison between the packet capture duration and the preset capture duration.
The NIC image capture method of claim 5, wherein the step of controlling whether to stop capturing packets according to the comparison result of the packet capture duration and the preset packet capture duration comprises the following steps:

When the packet capture duration is less than the preset capture packet duration, the packet capture continues;

When the packet capture duration is greater than or equal to the preset capture packet duration, the packet capture is stopped.
The method for capturing a network card image capture method according to claim 6, wherein when the packet capture duration is greater than or equal to the preset capture packet duration, the step of stopping the capture packet includes the following steps:

After the packet capture is stopped, the packet obtained by the packet capture is stored in the preset local path.
The method for capturing a network card image capture method according to claim 6, wherein when the packet capture duration is greater than or equal to a preset capture packet duration, the step of stopping the capture packet further includes the following steps:

After the packet is stopped, the packet obtained by the packet is sent to the preset remote address through the network.
A terminal includes: a memory, a processor, and a network card image capture program stored on the memory and operable on the processor, where the network card image capture program is implemented by the processor, such as a right The step of the network card image capture method according to any one of claims 1 to 8.
A computer readable storage medium, wherein the computer readable storage medium stores a network card image capture program, and the network card image capture program is executed by the processor to implement any one of claims 1 to 8. The steps of the network card image capture method.