WO2021056400A1

WO2021056400A1 - File analysis udp protocol method and apparatus based on pcap format

Info

Publication number: WO2021056400A1
Application number: PCT/CN2019/108474
Authority: WO
Inventors: 王电轻
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2019-09-26
Filing date: 2019-09-27
Publication date: 2021-04-01
Also published as: CN110661683A; CN110661683B

Abstract

A file analysis UDP protocol method, apparatus and device based on a pcap format, and a readable storage medium. The method comprises: capturing a file in a pcap format from a network configured with a UDP protocol; calling a filter to filter the file to obtain a target file; splitting the target file into a file header and a plurality of data packets; extracting any data packet, and determining whether the data packet conforms to a UDP protocol or not by utilizing a libpcap library; and if yes, analyzing the data packet to obtain the analysis result, and visually displaying the analysis result, so that a user analyzes the UDP protocol according to the analysis result. The filter and the libpcap library are utilized to avoid the influence of other data on the analysis result, and the analysis result can be visually displayed, so that the analysis accuracy of the UDP protocol and the positioning accuracy of the UDP protocol fault are improved.

Description

Method and device for analyzing UDP protocol based on pcap format file

This application claims the priority of the Chinese patent application filed to the Chinese Patent Office on September 26, 2019, the application number is 201910915173.9, and the invention title is "a method and device for analyzing UDP protocol based on pcap format files", all of which The content is incorporated in this application by reference.

Technical field

This application relates to the field of computer technology, and in particular to a method, device, equipment, and readable storage medium for analyzing a UDP protocol based on a pcap format file.

Background technique

At present, in order to test the UDP protocol configured in the network, some packet capture tools can be used to capture data packets in the network, and then analyze these data packets to analyze the UDP protocol and determine the related faults in the UDP protocol.

However, the existing packet capture tools can only capture data packets from the network, and cannot visually display the packet capture results, which is not conducive to the analysis and fault location of the UDP protocol. In addition, the protocol configured in a network does not only include the UDP protocol, so the captured data packet may be a data packet that conforms to other protocols, and the existing packet capture tools cannot accurately identify the data packets corresponding to different protocols, thereby further giving The analysis of UDP protocol brings obstacles to the location of various faults.

Therefore, how to improve the analysis efficiency and accuracy of the UDP protocol is a problem that needs to be solved by those skilled in the art.

Summary of the invention

In view of this, the purpose of this application is to provide a method, device, equipment, and readable storage medium for analyzing UDP protocol based on pcap format files, so as to improve the efficiency and accuracy of UDP protocol analysis. The specific plan is as follows:

In the first aspect, this application provides a method for analyzing UDP protocol based on pcap format files, including:

Grab a file in pcap format from the network where the UDP protocol is configured:

Call the filter to filter the file to obtain the target file; the filter has pcap_complie() filtering function and pcap_setfilter() filtering function;

Split the target file into file headers and multiple data packets;

Extract any data packet, and use the libpcap library to determine whether the data packet conforms to the UDP protocol;

If so, the data packet is parsed, the analysis result is obtained, and the analysis result is visually displayed, so that the user can analyze the UDP protocol according to the analysis result.

Preferably, parsing the data packet to obtain the parsing result includes:

Split the data packet into data packet header and data;

Parse the data packet header to obtain the components of the data packet header;

Analyze the data and get the length of the data;

Determine the components and length of the data packet header as the analysis result.

Preferably, the visual display of the analysis result includes:

Perform statistics on the analysis results and obtain statistical results;

Use preset visualization tools to display statistical results.

Preferably, capturing a file in pcap format from a network configured with UDP protocol includes:

Use a packet capture tool to grab files from the Internet.

Preferably, if the data packet does not conform to the UDP protocol, the data packet is discarded.

Preferably, after visually displaying the analysis result, the method further includes:

Call the data packet editor according to the data packet modification instruction entered by the user;

Use the data packet editor to modify the data package and transmit the modified data package to the network;

Obtain the processing result of the modified data packet by the network;

If the processing result is wrong, it is determined that the UDP protocol configured in the network is faulty.

Determine the generation timestamp of the analysis result, and store the generation timestamp and the analysis result.

Preferably, after storing the generated timestamp and the analysis result, the method further includes:

If the UDP protocol configured in the network fails, the time period of the failure will be determined according to the playback instruction input by the user;

Query the target generation timestamp corresponding to the time period of occurrence;

Visually display the analysis results corresponding to the target generation timestamp.

In the second aspect, this application provides a file analysis UDP protocol based on pcap format device, including:

The capture module is used to capture files in pcap format from the network configured with the UDP protocol:

The filter module is used to call the filter to filter the file to obtain the target file; the filter has a pcap_complie() filter function and a pcap_setfilter() filter function;

Splitting module, used to split the target file into file headers and multiple data packets;

The judgment module is used to extract any data packet and use the libpcap library to judge whether the data packet conforms to the UDP protocol;

The parsing module is used for parsing the data packet if it conforms to the UDP protocol, obtaining the parsing result, and visually displaying the parsing result, so that the user can analyze the UDP protocol according to the parsing result.

In the third aspect, this application provides a file analysis UDP protocol device based on pcap format, including:

Memory, used to store computer programs;

The processor is used to execute a computer program to implement the previously disclosed method for analyzing the UDP protocol based on the pcap format file.

In a fourth aspect, the present application provides a readable storage medium for storing a computer program, where the computer program is executed by a processor to implement the aforementioned disclosed method for analyzing a UDP protocol based on a pcap format file.

It can be seen from the above solution that this application provides a method for analyzing UDP protocol based on pcap format files, including: grabbing pcap format files from a network configured with UDP protocol: calling a filter to filter the files to obtain the target file; The filter is equipped with pcap_complie() filtering function and pcap_setfilter() filtering function; split the target file into file headers and multiple data packets; extract any data packet, and use libpcap library to determine whether the data packet conforms to the UDP protocol; if so , The data packet is parsed, the analysis result is obtained, and the analysis result is displayed visually, so that the user can analyze the UDP protocol according to the analysis result.

It can be seen that after this method grabs a file in pcap format from a network configured with UDP protocol, it first calls a filter to filter the file to obtain a purer target file in pcap format; and then splits the target file into file headers and multiple files. A data packet; for any data packet, use the libpcap library to determine whether the data packet conforms to the UDP protocol; if so, parse the data packet and visually display the obtained analysis result so that the user can analyze the UDP protocol according to the analysis result. Among them, in order to analyze the UDP protocol more accurately and locate the faults in the UDP protocol, this application first calls the filter to filter the files in pcap format to avoid data that is not in the pcap format from affecting the analysis results; secondly, it uses the libpcap library to determine Whether the data packet conforms to the UDP protocol, so as to prevent the data packet that is not the UDP protocol from affecting the analysis result again. Therefore, this application can improve the accuracy of analyzing the UDP protocol and the accuracy of locating faults in the UDP protocol. At the same time, this application can also visually display the analysis results of data packets conforming to the UDP protocol, so that the user can further determine the faults in the UDP protocol based on the analysis results, thereby facilitating the location of the UDP protocol faults.

Correspondingly, the device, equipment and readable storage medium for analyzing UDP protocol based on pcap format file provided by this application also have the above technical effects.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are the embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work.

Figure 1 is a flow chart of the first method for analyzing UDP protocol based on pcap format files disclosed in this application;

Figure 2 is a detailed flowchart of step S105 in Figure 1;

Figure 3 is a flow chart of the second method for analyzing UDP protocol based on pcap format files disclosed in this application;

FIG. 4 is a flow chart of the third method for analyzing UDP protocol based on pcap format files disclosed in this application;

Figure 5 is a schematic diagram of a file selection interface disclosed in this application;

FIG. 6 is a schematic diagram showing the analysis results disclosed in this application;

FIG. 7 is a schematic diagram of an apparatus for analyzing UDP protocol based on a pcap format file disclosed in this application;

FIG. 8 is a schematic diagram of a device for analyzing UDP protocol based on a pcap format file disclosed in this application.

detailed description

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

At present, the existing packet capture tools can only capture data packets from the network, but cannot visually display the packet capture results, which is not conducive to the analysis and fault location of the UDP protocol. In addition, the protocol configured in a network does not only include the UDP protocol, so the captured data packet may be a data packet that conforms to other protocols, and the existing packet capture tools cannot accurately identify the data packets corresponding to different protocols, thereby further giving The analysis of UDP protocol brings obstacles to the location of various faults. For this reason, this application provides a solution for analyzing UDP protocol based on pcap format files, which can improve the analysis efficiency and accuracy of UDP protocol.

As shown in Fig. 1, an embodiment of the present application discloses a first method for analyzing UDP protocol based on a pcap format file, including:

S101. Grab a file in pcap format from a network configured with UDP protocol:

Specifically, capturing a file in pcap format from a network configured with a UDP protocol includes: using a packet capture tool to capture a file from the network. Packet capture tools such as Wireshark, tcpdump, etc. Pcap is a file format, and the UDP protocol is User Datagram Protocol (User Datagram Protocol), which is a connectionless transmission protocol.

S102: Invoke the filter to filter the file, and obtain the target file;

Among them, the filter has pcap_complie() filtering function and pcap_setfilter() filtering function. pcap_complie() uses strings containing high-level Boolean expressions and generates low-level bytecodes that can be integrated into the packet driver by the filtering engine. pcap_setfilter() associates a filter with the packet capture session. Once pcap_setfilter() is called, the relevant filter will be applied to all packets from the network. Among them, calling the filter to filter files in pcap format can prevent data that is not in pcap format from affecting the analysis results.

S103. Split the target file into a file header and multiple data packets;

It should be noted that a file in the pcap format includes a file header and multiple data packets, and each data packet includes a data packet header and data. Each of the data packets is the object used to analyze the protocol, that is, by analyzing the data packets in the pcap format file, you can learn whether the protocol is faulty or not.

S104. Extract any data packet, and use the libpcap library to determine whether the data packet conforms to the UDP protocol; if yes, execute S105; if not, execute S107;

S105. Parse the data packet to obtain the parsing result;

S106: Visually display the analysis result, so that the user can analyze the UDP protocol according to the analysis result;

S107. Discard the data packet.

In this embodiment, when the data packet in the pcap format file complies with the UDP protocol, the data packet is further analyzed; otherwise, the data packet is discarded, thereby reducing unnecessary analysis processes. libpcap is a very powerful network sniffing tool library, among which the libpcap series of functions can analyze the content of data packets. Related functions and functions in the Libpcap library can be referred to the prior art.

In a specific implementation manner, visually displaying the analysis result includes: performing statistics on the analysis result to obtain the statistical result; and displaying the statistical result using a preset visualization tool. A variety of display charts can be set in the visualization tool, such as: line chart, column chart, pie chart, line chart, etc.

Among them, the statistics of the analysis result may be: data packets with the correct source port number, data packets with the wrong source port number, data packets with the correct destination port number, and data packets with the wrong destination port number within the preset time period. For these statistical results, you can use line graphs, histograms, pie charts, line graphs, etc. to display.

Please refer to FIG. 2, which is a detailed flowchart of step S105 in FIG. 1. The specific implementation steps of S105 in Figure 1 include:

S201: Split the data packet into a data packet header and data;

S202: Parse the data packet header to obtain the components of the data packet header;

S203: Analyze the data to obtain the length of the data;

S204: Determine the components and length of the data packet header as the analysis result.

It should be noted that the components of the data packet header include: GMTtime, MicroTime, caplen, len, etc.

Generally, data packets conforming to the UDP protocol include: source port number, destination port number, data packet length, checksum and data, where the source port number, destination port number, data packet length, and checksum are the UDP header. The source port number, destination port number, packet length, checksum, and data can be further determined based on the analysis result including the components and length of the packet header.

It can be seen that, in order to analyze the UDP protocol more accurately and locate the faults in the UDP protocol in this embodiment, the filter is first called to filter the files in pcap format to avoid data that is not in the pcap format from affecting the analysis results; secondly, the libpcap library is used It is judged whether the data packet conforms to the UDP protocol, so as to avoid the data packet that is not the UDP protocol from affecting the analysis result. Therefore, the present application can improve the accuracy of analyzing the UDP protocol and the accuracy of locating faults of the UDP protocol. At the same time, this application can also visually display the analysis results of data packets conforming to the UDP protocol, so that the user can further determine the faults in the UDP protocol based on the analysis results, thereby facilitating the location of the UDP protocol faults.

Referring to FIG. 3, the embodiment of the present application discloses a second method for analyzing UDP protocol based on a pcap format file, including:

S301. Grab a file in pcap format from a network configured with UDP protocol:

S302: Invoke the filter to filter the file, and obtain the target file;

Among them, the filter has pcap_complie() filtering function and pcap_setfilter() filtering function;

S303. Split the target file into a file header and multiple data packets;

The first 24 bytes of the pcap format file are the file header, and the file header contains file information. The components of the file header include: Magic, Major, Minor, ThisZone, SnapLen, LinkType, etc.

S304. Extract any data packet, and use the libpcap library to determine whether the data packet conforms to the UDP protocol; if so, execute S305; if not, execute S307;

S305: Parse the data packet to obtain a parsing result;

S306: Visually display the analysis result, so that the user can analyze the UDP protocol according to the analysis result, and execute S308;

S307. Discard the data packet.

S308: Receive a data packet modification instruction input by the user;

S309: Invoke the data packet editor according to the data packet modification instruction input by the user;

S310. Use the data packet editor to modify the data packet, and transmit the modified data packet to the network;

S311. Obtain a processing result of the modified data packet by the network.

S312. Determine whether the processing result is correct; if yes, execute S313; if not, execute S314;

S313. Determine that there is no corresponding fault in the UDP protocol configured in the network;

S314. Determine that the UDP protocol configured in the network has a corresponding failure.

In this embodiment, data packet modification and sending functions are added, that is, the content described in S308-S314. Specifically, the data packet editor may be WPE (Winsock Packet Editor, network packet editor). The modified data packet is a misleading data packet, which can mislead the network to process the data packet in the wrong direction. Therefore, if the network processes the modified data packet correctly, it means that the network has not been misled by the modified data packet. , The correct processing result is output, and there is no fault corresponding to the modified data packet; if the network processing the modified data packet is wrong, it means that the network is misled by the modified data packet and the wrong processing result is output , It means that there is a fault corresponding to the modified data packet in the current network.

It should be noted that the implementation steps in this embodiment are the same as or similar to those in the foregoing embodiment, and can be referred to each other when necessary, so this embodiment will not be repeated in this embodiment.

It can be seen from the above that in order to analyze the UDP protocol more accurately and locate the faults in the UDP protocol, this embodiment first calls the filter to filter files in pcap format to avoid data that is not in pcap format from affecting the analysis results; secondly, it uses The libpcap library judges whether the data packet conforms to the UDP protocol, so as to avoid the data packet that is not the UDP protocol from affecting the analysis result. Therefore, this application can improve the accuracy of analyzing the UDP protocol and the accuracy of locating faults in the UDP protocol. At the same time, this application can also visually display the analysis results of the data packets conforming to the UDP protocol, so that the user can further determine the faults in the UDP protocol based on the analysis results, thereby facilitating the location of the UDP protocol faults. This embodiment also adds data packet modification and sending functions, which further facilitates the location of UDP protocol failures.

Referring to FIG. 4, the embodiment of the present application discloses a third method for analyzing UDP protocol based on a pcap format file, including:

S401. Grab a file in pcap format from the network configured with the UDP protocol:

S402: Invoke the filter to filter the file, and obtain the target file;

S403: Split the target file into a file header and multiple data packets;

S404. Extract any data packet, and use the libpcap library to determine whether the data packet conforms to the UDP protocol; if so, execute S405; if not, execute S407;

S405: Parse the data packet to obtain a parsing result;

S406: Visually display the analysis result, so that the user can analyze the UDP protocol according to the analysis result, and execute S408;

S407. Discard the data packet.

S408: Determine the generation timestamp of the analysis result, and store the generation timestamp and the analysis result.

S409. If the UDP protocol configured in the network fails, determine the time period of occurrence of the failure according to the playback instruction input by the user;

S410: Query the target generation timestamp corresponding to the appearance time period;

S411: Visually display the analysis result corresponding to the target generation timestamp.

In this embodiment, a data packet playback function is added, that is, the content described in S408-S411. Specifically, this embodiment can store the analysis result of each data packet conforming to the UDP protocol, and the generation timestamp corresponding to each analysis result. Therefore, when the UDP protocol configured in the network fails, the user can query the analysis results corresponding to the time period of the failure, so as to determine the failure problem that occurred during this period, and realize the tracing of the failure problem.

It can be seen from the above that in order to analyze the UDP protocol more accurately and locate the faults in the UDP protocol, this embodiment first calls the filter to filter files in pcap format to avoid data that is not in pcap format from affecting the analysis results; secondly, it uses The libpcap library judges whether the data packet conforms to the UDP protocol, so as to avoid the data packet that is not the UDP protocol from affecting the analysis result. Therefore, this application can improve the accuracy of analyzing the UDP protocol and the accuracy of locating faults in the UDP protocol. At the same time, this application can also visually display the analysis results of data packets conforming to the UDP protocol, so that the user can further determine the faults in the UDP protocol based on the analysis results, thereby facilitating the location of the UDP protocol faults. This embodiment also adds a data packet playback function, which further facilitates the location of UDP protocol failures.

According to the method for analyzing the UDP protocol based on the pcap format provided by this application, the following analysis tool can be designed. The analysis tool is used in combination with the existing packet capture tool, that is, first use the existing packet capture tool to capture the pcap format file, and then The analysis tool provided in this embodiment is used to analyze the pcap format file. The analysis tool provided in this embodiment includes four software packages, specifically:

com.wangdianqing.packet;

com.wangdianqing.pacpparser;

ProtocolJudge;

com.wangdianqing.UI.

Among them, the ExtensionFileFilter class filter can be implemented in com.wangdianqing.packet, and the ExtensionFileFilter class is used to open files in pcap format and filter the files.

com.wangdianqing.packet can also be used to parse data packets to output the corresponding analysis results.

com.wangdianqing.pacpparser can implement the Pcappparser class. The Pcappparser class is used to split a pcap format file into a file header and multiple data packets, and each data packet is split into a data packet header and data.

The ProtocolJudge class can be implemented in ProtocolJudge. The ProtocolJudge class is used to determine the protocol type, that is, to determine whether the data packet conforms to the UDP protocol.

The MyUI class can be implemented in com.wangdianqing.UI. The MyUI class is used to implement a user interaction interface, select a file, create an input stream according to the file path, and display the analysis result according to user requirements.

Specifically, please refer to FIG. 5 and FIG. 6 for the user interaction interface implemented by the analysis tool in this embodiment. Figure 5 is a schematic diagram of a file selection interface, and Figure 6 is a schematic diagram of a display of analysis results. It can be seen from Figure 6 that the analysis result of a certain data packet is: the protocol is UDP, the source IP address is 127.0.0.1, the destination IP address is 127.0.0.1, the service type is 0x00, the total length is 28, the identifier is 0x9F24, the identifier is 0x00, and TTL. It is 64, the protocol type is 0x11, the first checksum is 0xDDAA, the UDP source port number is 12345, the destination port number is 53, the total length is 8, and the checksum is 0x0000.

It can be seen that the analysis tool provided in this embodiment can analyze the UDP protocol based on the file in pcap format, and realize a more accurate analysis of the UDP protocol, locate the faults in the UDP protocol, and at the same time, can also analyze the data packets conforming to the UDP protocol. The results are displayed visually, so that users can further determine the faults in the UDP protocol based on the analysis results, which facilitates the location of UDP protocol faults.

The UDP protocol-based file analysis device based on pcap format provided by the embodiments of the present application will be introduced below. The following describes a pcap format-based file analysis UDP protocol device and the above-described pcap format-based file analysis device. The methods of the UDP protocol can be cross-referenced.

As shown in FIG. 7, an embodiment of the present application discloses an apparatus for analyzing a UDP protocol based on a pcap format file, including:

The capture module 701 is used to capture files in pcap format from the network configured with the UDP protocol:

The filtering module 702 is used to call the filter to filter the file to obtain the target file; the filter is provided with a pcap_complie() filtering function and a pcap_setfilter() filtering function;

The splitting module 703 is used to split the target file into a file header and multiple data packets;

The judging module 704 is used to extract any data packet and use the libpcap library to judge whether the data packet complies with the UDP protocol;

The parsing module 705 is used for parsing the data packet if the data packet conforms to the UDP protocol, obtaining the parsing result, and visually displaying the parsing result, so that the user can analyze the UDP protocol according to the parsing result.

In a specific implementation, the parsing module includes:

Splitting unit, used to split the data packet into data packet header and data;

The first parsing unit is used to parse the data packet header to obtain the components of the data packet header;

The second parsing unit is used to parse the data to obtain the length of the data;

The determining unit is used to determine the components and length of the data packet header as the analysis result.

In a specific implementation, the parsing module includes:

The statistical unit is used to perform statistics on the analysis results and obtain statistical results;

The display unit is used to display the statistical results using a preset visualization tool.

In a specific implementation manner, the grabbing module is specifically used for:

Use a packet capture tool to grab files from the Internet.

In a specific embodiment, it further includes:

The discarding module is used to discard the data packet if the data packet does not conform to the UDP protocol.

In a specific embodiment, it further includes:

The calling module is used to call the data packet editor according to the data packet modification instruction input by the user;

Modification module, used to modify the data package using the data package editor, and transmit the modified data package to the network;

The obtaining module is used to obtain the processing result of the modified data packet by the network;

The first determining module is configured to determine that the UDP protocol configured in the network is faulty if the processing result is wrong.

In a specific embodiment, it further includes:

The storage module is used to determine the generation timestamp of the analysis result, and store the generation timestamp and the analysis result.

In a specific embodiment, it further includes:

The second determination module is used to determine the time period of occurrence of the failure according to the playback instruction input by the user if the UDP protocol configured in the network fails;

The query module is used to query the target generation timestamp corresponding to the time period of occurrence;

The display module is used to visually display the analysis result corresponding to the target generation timestamp.

For the more specific working process of each module and unit in this embodiment, reference may be made to the corresponding content disclosed in the foregoing embodiment, which will not be repeated here.

It can be seen that this embodiment provides a device for analyzing UDP protocol based on pcap format files, which can analyze UDP protocol more accurately, locate faults in UDP protocol, and improve the accuracy of UDP protocol analysis, and UDP protocol The location accuracy of the fault. At the same time, the analysis results of data packets conforming to the UDP protocol can also be visually displayed, so that users can further determine the faults in the UDP protocol based on the analysis results, thereby facilitating the location of the UDP protocol faults.

The following describes a device based on the pcap format file analysis UDP protocol provided by the embodiments of the present application. The device based on the pcap format file analysis UDP protocol described below is the same as the file analysis device based on the pcap format described above. The methods and devices of the UDP protocol can be cross-referenced.

As shown in FIG. 8, an embodiment of the present application discloses a device for analyzing UDP protocol based on a pcap format file, including:

The memory 801 is used to store computer programs;

The processor 802 is configured to execute the computer program to implement the method disclosed in any of the foregoing embodiments.

The following introduces a readable storage medium provided by an embodiment of the present application. The readable storage medium described below and the method, device, and device for analyzing UDP protocol based on pcap format described above can be cross-referenced.

A readable storage medium used to store a computer program, where the computer program, when executed by a processor, implements the method for analyzing the UDP protocol based on the pcap format file disclosed in the foregoing embodiments. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the foregoing embodiments, and details are not described herein again.

The “first”, “second”, “third”, “fourth”, etc. (if any) involved in this application are used to distinguish similar objects, and not necessarily used to describe a specific sequence or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments described herein can be implemented in a sequence other than the content illustrated or described herein. In addition, the terms "including" and "having" and any variations of them are intended to cover non-exclusive inclusion. For example, a process, method, or device that includes a series of steps or units is not necessarily limited to those clearly listed. , But may include other steps or units that are not clearly listed or are inherent to these processes, methods, or equipment.

It should be noted that the descriptions related to "first", "second", etc. in this application are only for descriptive purposes, and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of indicated technical features . Therefore, the features defined with "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on what can be achieved by a person of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that such a combination of technical solutions does not exist. , Is not within the scope of protection required by this application.

The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or all areas in the technical field. Any other form of well-known readable storage medium.

Specific examples are used in this article to illustrate the principles and implementation of the application. The descriptions of the above examples are only used to help understand the methods and core ideas of the application; at the same time, for those of ordinary skill in the art, according to the application The idea of, there will be changes in the specific implementation and the scope of application. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

A method for analyzing UDP protocol based on files in pcap format, which is characterized in that it includes:

Grab a file in pcap format from the network where the UDP protocol is configured:

Calling a filter to filter the file to obtain a target file; the filter is provided with a pcap_complie() filtering function and a pcap_setfilter() filtering function;

Split the target file into a file header and multiple data packets;

Extract any of the data packets, and use the libpcap library to determine whether the data packets conform to the UDP protocol;

If so, parse the data packet to obtain the analysis result, and visually display the analysis result, so that the user can analyze the UDP protocol according to the analysis result.
The method according to claim 1, wherein the parsing the data packet to obtain a parsing result comprises:

Split the data packet into a data packet header and data;

Parse the data packet header to obtain the components of the data packet header;

Parse the data to obtain the length of the data;

The component part of the data packet header and the length are determined as the analysis result.
The method according to claim 1, wherein the visually displaying the analysis result comprises:

Perform statistics on the analysis results to obtain statistical results;

Use a preset visualization tool to display the statistical results.
The method according to claim 1, further comprising:

If the data packet does not conform to the UDP protocol, the data packet is discarded.
The method according to any one of claims 1 to 4, wherein after the visual display of the analysis result, the method further comprises:

Call the data packet editor according to the data packet modification instruction entered by the user;

Use the data packet editor to modify the data packet, and transmit the modified data packet to the network;

Acquiring a processing result of the modified data packet by the network;

If the processing result is wrong, it is determined that the UDP protocol configured in the network is faulty.
The method according to claim 1, wherein after the visual display of the analysis result, the method further comprises:

The generation timestamp of the analysis result is determined, and the generation timestamp and the analysis result are stored.
The method according to claim 6, characterized in that, after storing the generation timestamp and the analysis result, the method further comprises:

If the UDP protocol configured in the network fails, the time period of occurrence of the failure is determined according to the playback instruction input by the user;

Query the target generation timestamp corresponding to the occurrence time period;

Visually display the analysis result corresponding to the target generation timestamp.
A device for analyzing UDP protocol based on files in pcap format, which is characterized in that it comprises:

The capture module is used to capture files in pcap format from the network configured with the UDP protocol:

The filtering module is used to call a filter to filter the file to obtain the target file; the filter is provided with a pcap_complie() filtering function and a pcap_setfilter() filtering function;

A splitting module for splitting the target file into a file header and multiple data packets;

The judgment module is used to extract any one of the data packets, and use the libpcap library to judge whether the data packet conforms to the UDP protocol;

The parsing module is configured to, if the data packet conforms to the UDP protocol, analyze the data packet to obtain the analysis result, and visually display the analysis result, so that the user can analyze the UDP protocol according to the analysis result.
A file analysis UDP protocol device based on pcap format, which is characterized in that it includes:

Memory, used to store computer programs;

The processor is configured to execute the computer program to implement the method according to any one of claims 1 to 7.
A readable storage medium, characterized in that it is used to store a computer program, wherein the computer program is executed by a processor to implement the method according to any one of claims 1 to 7.