WO2022121660A1

WO2022121660A1 - Method, apparatus and system for implementing remote automatic packet capture

Info

Publication number: WO2022121660A1
Application number: PCT/CN2021/131762
Authority: WO
Inventors: 杨娅娅; 李胜平; 姚瑞; 章霞
Original assignee: 展讯半导体(成都)有限公司
Priority date: 2020-12-10
Filing date: 2021-11-19
Publication date: 2022-06-16
Also published as: CN112688916A

Abstract

Provided are a method, apparatus and system for implementing remote automatic packet capture. The method is applied to a local master control device. The method comprises: establishing a connection with a remote device; issuing an automatic packet capture instruction to the remote device, such that the remote device performs packet capture according to a preset filtering condition, and after it is determined, according to a preset trigger condition, that packet capture needs to be stopped, the remote device returns an acquired packet capture file to a local master control device; storing the packet capture file returned by the remote device; and parsing and classifying the packet capture file returned by the remote device, so as to obtain frames of different types. By means of the present invention, automatic packet capture can be implemented, thereby saving on labor input and improving working efficiency; and after packet capture is completed, a local master control device can run an automatic program to unpack wireless packets, automatically classify captured wireless air interface packets, and store packets of different types in different file folders, thereby facilitating quick positioning of a frame to be checked, simplifying subsequent work, and saving on labor costs.

Description

Implementation method, device and system for remote automatic packet capture

technical field

The present invention relates to the technical field of wireless networks, and in particular, to a method, device and system for realizing remote automatic packet capture.

Background technique

With the widespread use of smart phones, tablet computers, and smart homes, traditional Internet access methods can no longer meet people's daily lives. Wi-Fi technology is widely used due to its fast transmission speed and wide coverage. The increasing number of wireless users also makes the wireless network environment more and more complex. Therefore, when a problem occurs in the wireless network, it is usually necessary to capture the frames transmitted in the wireless network to analyze the current network operation. The traditional packet capture method requires technicians to build an environment on site to capture packets, which undoubtedly increases labor costs, and cannot analyze the current wireless network environment in a timely manner, resulting in poor real-time performance.

SUMMARY OF THE INVENTION

The implementation method, device and system for remote automatic packet capture provided by the present invention can realize automatic packet capture, save manpower input and improve work efficiency.

In a first aspect, the present invention provides a method for realizing remote automatic packet capture. The method is applied to a local master control device, and the method includes:

establish a connection with a remote device;

Send an automatic packet capture command to the remote device, so that the remote device can capture packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, the obtained packet capture file is sent back to the local master equipment;

Store the packet capture files returned by the remote device;

Parse and classify the packet capture files returned by the remote device to obtain frames of different types.

Optionally, the establishing a connection with the remote device includes: establishing a connection with the remote device in a key-based SSH manner.

Optionally, the packet capture files are classified into management frames, control frames and data frames according to categories, and are respectively stored in different folders.

In a second aspect, the present invention provides a method for realizing remote automatic packet capture, the method is applied to a remote device, and the method includes:

Parse the automatic packet capture command sent by the local main control device and start the packet capture;

Capture packets according to preset filter conditions;

Determine whether to stop capturing packets according to the preset trigger conditions;

After judging to stop the packet capture, the obtained packet capture file is sent back to the local master control device, so that the local master control device stores the packet capture file, parses and classifies the packet, and obtains frames of different types.

Optionally, the filtering conditions include multi-level filtering parameters: the first level is the mode, the second level is the channel, the third level is the MAC address of the device, and the fourth level is the packet type, wherein the first level and the third level are the message types. The second level is a mandatory parameter, and the third and fourth levels are optional parameters.

Optionally, the trigger condition is a specific time period, a specific packet size or a specific frame.

In a third aspect, the present invention provides a device for realizing remote automatic packet capture, the device is located in a local master control device, and the device includes:

A remote connection module for establishing a connection with a remote device;

The automatic packet capture module is used to send an automatic packet capture command to the remote device, so that the remote device can capture packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, the captured packets will be captured. The file is transferred back to the local master device;

The storage module is used to store the packet capture files returned by the remote device;

The packet parsing module is used to parse and classify the packet capture files returned by the remote device to obtain different types of frames.

In a fourth aspect, the present invention provides an implementation device for remote automatic packet capture, the device is located in a remote device, and the device includes:

The command parsing module is used to parse the automatic packet capture command sent by the local main control device and start the packet capture;

The filtering module is used to capture packets according to the preset filtering conditions;

The condition judgment module is used to judge whether to stop capturing packets according to the preset trigger conditions;

The file transmission module is used to transmit the obtained packet capture file back to the local master control device after the condition judgment module determines that the packet capture is to be stopped, so that the local master control device can store and parse the packet capture file and classification to get frames of different classes.

In a fifth aspect, the present invention provides an implementation system for remote automatic packet capture, including a local master control device and a remote device, wherein,

The local master control device is used to establish a connection with the remote device, issue an automatic packet capture instruction to the remote device, store the packet capture file returned by the remote device, and perform analysis and classification to obtain different types of frames;

The remote device is used to parse the automatic packet capture instruction sent by the local main control device, start the packet capture, capture the packet according to the preset filter condition, and judge whether to stop the packet capture according to the preset trigger condition. After stopping the packet capture, send the obtained packet capture file back to the local master device.

In the implementation method, device, and system for remote automatic packet capture provided by the embodiments of the present invention, after a remote connection is established between the local main control device and the remote device, the local main control device controls the remote device to actively start capturing packets, without the need to manually configure packet capture environment, which can save manpower investment and improve work efficiency; the remote device is set with multiple optional trigger conditions for stopping packet capture, which can be selected according to different user needs; after the packet capture is completed, the local master device can run the automated program Unpack the wireless packets, automatically classify the captured wireless air interface packets, and store different types of packets in different folders, which is convenient to quickly locate the frames to be viewed, simplifies the follow-up work, and saves a lot of money. Labor costs.

Description of drawings

1 is a flowchart of a method for realizing remote automatic packet capture according to an embodiment of the present invention;

2 is a flowchart of a method for realizing remote automatic packet capture according to another embodiment of the present invention;

3 is a flowchart of a method for realizing remote automatic packet capture according to yet another embodiment of the present invention;

4 is a schematic structural diagram of a device for implementing remote automatic packet capture according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an 802.11 radio frame;

6 is a schematic structural diagram of a device for implementing remote automatic packet capture according to another embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a system for realizing remote automatic packet capture according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

An embodiment of the present invention provides a method for realizing remote automatic packet capture. The method is applied to a local master control device. As shown in Figure 1, the method includes:

S11. The local master device establishes a connection with the remote device.

S12. The local main control device sends an automatic packet capture instruction to the remote device, so that the remote device captures packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, captures the captured packets. The file is transferred back to the local master device.

S13. The local master control device stores the packet capture file returned by the remote device.

S14 , the local main control device parses and classifies the packet capture file returned by the remote device, and obtains frames of different types.

In the method for realizing remote automatic packet capture provided by the embodiment of the present invention, after a remote connection is established between the local master control device and the remote device, the local master control device controls the remote device to actively start capturing packets, without the need to manually configure the packet capture environment, so that the Save manpower investment and improve work efficiency; after the packet capture is completed, the local main control device can run an automated program to unpack the wireless packet, automatically classify the captured wireless air interface packets, and store different types of packets in different It is convenient and quick to locate the frames to be viewed, which simplifies the follow-up work and greatly saves labor costs.

An embodiment of the present invention provides a method for realizing remote automatic packet capture. The method is applied to a remote device. As shown in FIG. 2 , the method includes:

S21. The remote device parses the automatic packet capture instruction sent by the local master device, and starts packet capture.

S22. The remote device captures packets according to preset filter conditions.

S23. The remote device determines whether to stop capturing packets according to a preset trigger condition.

S21. After judging that the packet capture is to be stopped, the remote device sends the obtained packet capture file back to the local master control device, so that the local master control device stores the packet capture file, parses and classifies it, and obtains different types of packet capture files. frame.

In the method for realizing remote automatic packet capture provided by the embodiment of the present invention, after a remote connection is established between the local master control device and the remote device, the local master control device controls the remote device to actively start capturing packets, without the need to manually configure the packet capture environment, so that the Save manpower investment and improve work efficiency; the remote device is set with multiple optional trigger conditions for stopping packet capture, which can be selected according to different user needs; after the packet capture is completed, the local main control device can run an automated program to process wireless packets. Unpack and automatically classify the captured wireless air interface packets, and store different types of packets in different folders to facilitate and quickly locate the frames to be viewed, simplify subsequent work, and greatly save labor costs.

The method for realizing remote automatic packet capture of the present invention will be described in detail below with reference to specific embodiments.

As shown in Figure 3, the implementation method of remote automatic packet capture in this embodiment includes:

S31. The local master control PC and the remote PC establish a connection through the SSH (Secure Shell, secure shell) protocol.

S32, the local master control PC issues an automatic packet capture instruction, and controls the remote PC to start the packet capture.

S33 , after receiving the automatic packet capture instruction sent by the master control PC, the remote PC captures packets according to preset filter conditions.

S34. The remote PC determines whether to stop capturing packets according to a preset trigger condition, and if so, executes step S35, otherwise proceeds to step S33.

S35. Stop capturing packets.

S36, the remote PC sends the obtained packet capture file back to the local master control PC.

S37 , the local main control PC stores the packet capture file, parses and classifies it, and obtains frames of different types.

An embodiment of the present invention further provides a device for realizing remote automatic packet capture, where the device is located in a local master control device, as shown in FIG. 4 , the device includes:

a remote connection module 11 for establishing a connection with a remote device;

The remote connection module 11 connects the remote device through the key-based SSH method, thereby realizing the control of the remote device. The local master device generates a pair of key pairs in advance: a public key and a private key, and then puts the public key in the root directory of the remote device to be accessed, and then automatically generates the authorized_keys file to store the public key. By using the SSH method of key-based login, you can save the step of entering a password.

The automatic packet capture module 12 is used to send an automatic packet capture instruction to the remote device, so that the remote device can capture packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, the captured packets are captured. The package file is sent back to the local master device;

Since there are multiple wireless devices in the remote environment, it is inevitable to encounter various problems, such as dropped calls, wireless clients cannot receive signals, cannot connect to wireless signals, slow Wi-Fi network speeds, and more. When encountering problems, it is often necessary to capture the air interface packets in the wireless network for analysis. Therefore, an automated way to capture packets is used here. Specifically, the corresponding packet capture parameters are configured on the local master control device, and then the automated packet capture script is run locally, and the command is sent to the remote device. After the remote device receives the automatic packet capture command sent by the local master device, The packet capture tool will be triggered to obtain wireless air interface packets in the environment.

The storage module 13 is used to store the packet capture file returned by the remote device;

After the packet capture is completed, the remote device needs to send the packet capture result back to the local main control device, and the storage module is used to save the packet capture file returned by the remote device.

The packet parsing module 14 is used for parsing and classifying the packet capture files returned by the remote device to obtain frames of different types.

Since there are many wireless devices in the wireless network environment, the captured air interface packets are huge and complex. If they are not processed accordingly, it is not conducive to filtering out valid information from them. In view of this situation, and taking into account the characteristics of wireless frames, a packet analysis module is set to classify and store the captured packets.

Specifically, if the user has no specific requirements, the automation scripts are used to divide them into 3 categories: management frames, control frames, and data frames, and store them in different folders. If it is some specific problems, you can continue to refine the above three types of frames, which makes the analysis process convenient and fast. For example: STA

When there is a problem in the process of obtaining the IP address at the (station, station) end, it is only necessary to filter out the DHCP (Dynamic Host Configuration Protocol) frame from the data frame.

Figure 5 shows the structure of an 802.11 wireless frame. The first two bytes are the frame control field. The Type and Sub Type fields of the frame control field specify the type of the frame. 00 is a management frame, 01 is a control frame, and 10 is a data frame. . According to these two fields, all frames can be preliminarily classified into three categories. If you want to view a specific frame, you can search directionally according to the type of the frame, and you can quickly obtain the required information from many wireless frames. Also, once the package is sorted, it is automatically stored in a new folder, named according to its type. In this way, the entire packet capture file can be subdivided into multiple sub-files, which can be quickly located to different folders according to user needs, which saves a lot of time and solves the problem of too many packets captured by wireshark, resulting in a large workload for subsequent analysis. The problem.

For example, when conducting a Wi-Fi roaming test, generally only two key frames need to be concerned: deauth frame and reassociate frame. These two frames are management frames, so you can use the packet parsing module to filter out the management frames, and then filter out these two frames from the management frames. If there are reassociate request and reassociate response frames in the packet capture file and there is no deauth frame , the roaming is successful.

In the implementation device for remote automatic packet capture provided by the embodiment of the present invention, after a remote connection is established between the local master control device and the remote device, the local master control device controls the remote device to actively start capturing packets, without the need to manually configure the packet capture environment, so that the Save manpower investment and improve work efficiency; after the packet capture is completed, the local main control device can run an automated program to unpack the wireless packet, automatically classify the captured wireless air interface packets, and store different types of packets in different It is convenient and quick to locate the frames to be viewed, which simplifies the follow-up work and greatly saves labor costs.

The apparatus of this embodiment can be used to implement the technical solution of the above-mentioned method embodiment corresponding to FIG. 1 , and the implementation principle and technical effect thereof are similar, which will not be repeated here.

An embodiment of the present invention further provides a device for realizing remote automatic packet capture, where the device is located in a remote device, as shown in FIG. 6 , the device includes:

The instruction parsing module 21 is used for parsing the automatic packet capturing instruction sent by the local main control device, and starting the packet capturing;

The communication between the local main control device and the remote device mainly depends on the interaction of commands. The command parsing module 21 is responsible for processing the automatic packet capture command sent by the local main control device, and parses out key information and executes it.

The filtering module 22 is used to capture packets according to preset filtering conditions;

When there are many wireless devices in the remote environment, there will be a lot of wireless data interaction at this time. If no filtering is performed before capturing packets, a lot of useless packets will be captured and resources will be wasted. Therefore, filter conditions need to be set before capturing packets, so as to capture eligible packets. The filter conditions use multi-level filter parameters, which can be selected according to different scenarios. Among them, the first level is the mode, mode={bgn, ac, ...}, the second level is the channel, channel={1～13, 36～44, 149～165}, the third level is the MAC address of the concerned device , and the fourth level is the message type. Among them, the first and second levels are mandatory parameters, and the third and fourth levels are optional parameters.

The condition judgment module 23 is used for judging whether to stop capturing packets according to a preset trigger condition;

Since the requirements for the captured packets are different in different scenarios, it is necessary to set multiple optional trigger conditions for stopping packet capture in the script in advance. In actual work, it can be selected according to different scene requirements, or according to the time of packet capture, or according to the size of the captured packet, or according to a certain frame and so on.

Packet capture time: If you only need to obtain the air interface status of a specific time period, you only need to set the packet capture time to the corresponding time;

Capture packet size: If there is no special requirement, you can stop capturing packets after capturing a certain size of packets;

Specific frame: Set the packet capture stop condition according to a certain frame. If the user only needs to capture a specific frame, set the frame as the condition for stopping packet capture. Once the wireless frame is captured, the packet capture will be stopped and the result will be returned.

Specifically, the size of the period T can be dynamically adjusted according to different scenarios, and then periodically determine whether the condition for stopping packet capture is reached, if so, stop packet capture, otherwise, continue to capture wireless air interface packets. The periodic detection scheme can not only judge whether the packet capture can be stopped, but also detect whether the packet capture process is interrupted. The periodicity T can be set according to the empirical value. If theoretically one period T should stop, but it has not stopped after two periods of 2T, it means that there may be some problems in the process of capturing packets, so it is necessary to check the packet capture at this time. environment to avoid packet capture errors.

The file transmission module 24 is used to transmit the obtained packet capture file back to the local master control device after the condition judgment module determines that the packet capture is to be stopped, so that the local master control device stores the packet capture file and performs Parse and classify to get frames of different classes.

After the packet capture is stopped, use the SFTP (Secure File Transfer Protocol) method to transfer the packet capture file back to the local master device. In the SSH package, a secure file information transfer subsystem called SFTP is already included. SFTP is a part of SSH and requires no additional configuration. The port is the SSH port. SFTP uses encryption to transmit authentication information and transmitted data, so using SFTP is very secure.

In the implementation device for remote automatic packet capture provided by the embodiment of the present invention, after a remote connection is established between the local master control device and the remote device, the local master control device controls the remote device to actively start capturing packets, without the need to manually configure the packet capture environment, so that the Save manpower investment and improve work efficiency; the remote device is set with multiple optional trigger conditions for stopping packet capture, which can be selected according to different user needs; after the packet capture is completed, the local main control device can run an automated program to process wireless packets. Unpack and automatically classify the captured wireless air interface packets, and store different types of packets in different folders to facilitate and quickly locate the frames to be viewed, simplify subsequent work, and greatly save labor costs.

The apparatus of this embodiment can be used to execute the technical solution of the above-mentioned method embodiment corresponding to FIG. 2 , and the implementation principle and technical effect thereof are similar, which will not be repeated here.

An embodiment of the present invention also provides a system for realizing remote automatic packet capture. As shown in FIG. 7 , the system includes a local main control device 01 and a remote device 02, wherein,

The local main control device 01 includes a main control PC, which is used to establish a connection with the remote PC in the remote device 03 through the Internet 02, issue an automatic packet capture instruction to the remote PC, and store the captured packet file returned by the remote PC, And parse and classify to get frames of different categories;

The remote device 03 includes a remote PC, a router 031 and an intelligent device 032, and is used to parse the automatic packet capture instruction sent by the local master PC, start packet capture, and capture packets according to preset filtering conditions. The trigger condition judges whether to stop the packet capture, and after judging to stop the packet capture, the obtained packet capture file is sent back to the main control PC.

The smart device 032 is connected to the router 031 wirelessly, and after the wireless network card is set to the monitor mode, the interaction information between the smart device 032 and the router 031 can be obtained.

In the implementation system for remote automatic packet capture provided by the embodiment of the present invention, after a remote connection is established between the local master control device and the remote device, the local master control device controls the remote device to actively start capturing packets, without the need to manually configure the packet capture environment, so that the Save manpower investment and improve work efficiency; the remote device is set with multiple optional trigger conditions for stopping packet capture, which can be selected according to different user needs; after the packet capture is completed, the local main control device can run an automated program to process wireless packets. Unpack and automatically classify the captured wireless air interface packets, and store different types of packets in different folders to facilitate and quickly locate the frames to be viewed, simplify subsequent work, and greatly save labor costs.

Those of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be implemented by instructing relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. During execution, the processes of the embodiments of the above-mentioned methods may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM) or the like.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical scope disclosed by the present invention can easily think of changes or substitutions. All should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

A method for realizing remote automatic packet capture, the method being applied to a local master control device, characterized in that the method comprises:

establish a connection with a remote device;

Send an automatic packet capture command to the remote device, so that the remote device can capture packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, the obtained packet capture file is sent back to the local master equipment;

Store the packet capture files returned by the remote device;

Parse and classify the packet capture files returned by the remote device to obtain frames of different types.
The method according to claim 1, wherein the establishing a connection with the remote device comprises: establishing a connection with the remote device in a key-based SSH manner.
The method according to claim 1 or 2, wherein the packet capture files are divided into management frames, control frames and data frames according to categories, and are respectively stored in different folders.
A method for realizing remote automatic packet capture, the method being applied to a remote device, characterized in that the method comprises:

Parse the automatic packet capture command sent by the local master device, and start the packet capture;

Capture packets according to preset filter conditions;

Determine whether to stop capturing packets according to the preset trigger conditions;

After judging to stop the packet capture, the obtained packet capture file is sent back to the local master control device, so that the local master control device stores the packet capture file, parses and classifies it, and obtains frames of different types.
The method according to claim 4, wherein the filtering conditions include multi-level filtering parameters: the first level is the mode, the second level is the channel, the third level is the MAC address of the device, and the fourth level is the message Type, where the first and second levels are mandatory parameters, and the third and fourth levels are optional parameters.
The method according to claim 4 or 5, wherein the trigger condition is a specific time period, a specific packet size or a specific frame.
A device for realizing remote automatic packet capture, the device is located in a local master control device, characterized in that the device comprises:

Remote connection module, used to establish connection with remote equipment;

The automatic packet capture module is used to send an automatic packet capture command to the remote device, so that the remote device can capture packets according to the preset filter conditions, and after judging to stop the packet capture according to the preset trigger conditions, the captured packets will be captured. The file is transferred back to the local master device;

The storage module is used to store the packet capture files returned by the remote device;

The packet parsing module is used to parse and classify the packet capture files returned by the remote device to obtain different types of frames.
The device according to claim 7, wherein the packet capture files are classified into management frames, control frames and data frames according to categories, and are respectively stored in different folders.
A device for realizing remote automatic packet capture, the device is located in a remote device, wherein the device comprises:

The command parsing module is used to parse the automatic packet capture command sent by the local main control device and start the packet capture;

The filtering module is used to capture packets according to the preset filtering conditions;

The condition judgment module is used to judge whether to stop capturing packets according to the preset trigger conditions;

The file transmission module is used to transmit the obtained packet capture file back to the local master control device after the condition judgment module determines that the packet capture is to be stopped, so that the local master control device can store and parse the packet capture file and classification to get frames of different classes.
The device according to claim 9, wherein the filtering conditions include multi-level filtering parameters: the first level is the mode, the second level is the channel, the third level is the MAC address of the device, and the fourth level is the message Type, where the first and second levels are mandatory parameters, and the third and fourth levels are optional parameters.
The apparatus according to claim 9 or 10, wherein the trigger condition is a specific time period, a specific packet size or a specific frame.
A realization system for remote automatic packet capture, characterized in that it includes a local master control device and a remote device, wherein,

The local master control device is used to establish a connection with the remote device, issue an automatic packet capture instruction to the remote device, store the packet capture file returned by the remote device, and perform analysis and classification to obtain different types of frames;

The remote device is used to parse the automatic packet capture instruction sent by the local main control device, start the packet capture, capture the packet according to the preset filter condition, and judge whether to stop the packet capture according to the preset trigger condition. After stopping the packet capture, send the obtained packet capture file back to the local master device.