WO2023050816A1 - 网络数据包抓取方法和客户端、服务端 - Google Patents
网络数据包抓取方法和客户端、服务端 Download PDFInfo
- Publication number
- WO2023050816A1 WO2023050816A1 PCT/CN2022/091513 CN2022091513W WO2023050816A1 WO 2023050816 A1 WO2023050816 A1 WO 2023050816A1 CN 2022091513 W CN2022091513 W CN 2022091513W WO 2023050816 A1 WO2023050816 A1 WO 2023050816A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- packet capture
- port
- packet
- server
- task
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 105
- 230000015654 memory Effects 0.000 claims description 36
- 230000004044 response Effects 0.000 claims description 17
- 238000004590 computer program Methods 0.000 claims description 12
- 230000006870 function Effects 0.000 description 13
- 238000012545 processing Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 230000008569 process Effects 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 238000013500 data storage Methods 0.000 description 4
- 238000001914 filtration Methods 0.000 description 4
- 238000009434 installation Methods 0.000 description 4
- 238000005457 optimization Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000012217 deletion Methods 0.000 description 2
- 230000037430 deletion Effects 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 230000000717 retained effect Effects 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/141—Setup of application sessions
Definitions
- the present application relates to the technical field of communication, in particular to a method for capturing network data packets, a client and a server.
- Network packet capture refers to the operations of intercepting, retransmitting, editing, and dumping data packets sent and received in network transmission.
- Network development and operation and maintenance personnel can quickly locate the cause of network failures by analyzing the captured data packets.
- a dedicated packet capture server is often deployed to capture packets of service nodes.
- the packet capture server needs to occupy nodes or other hardware resources in the network system for a long time.
- no packet capture task it still monopolizes the computing resources of the hardware, resulting in a waste of resources. Upgrading is more difficult.
- Embodiments of the present application provide a method for capturing network data packets, a client, a server, and a computer-readable storage medium, which can capture data packets of service nodes through a packet capturing entity in a mirror port and reduce the impact on system hardware resources. Occupy, and avoid causing security risks to the host machine.
- the embodiment of the present application provides a network data packet capture method, which is applied to the client, and the method includes that the packet capture task information includes the identification information of the source port of the data packet to be captured, and the packet capture The task execution request is used to enable the server to establish a mirror relationship between the source port and the mirror port according to the identification information, and to enable the packet capture entity in the server to capture data packets from the mirror port, the The mirror port is pre-created by the server.
- the embodiment of the present application provides a method for capturing network data packets, which is applied to the server.
- the method includes: receiving a packet capture task execution request sent by the client, and the packet capture task execution request carries the user's capture Packet task information, the packet capture task information includes the identification information of the source port of the data packet to be captured; the mirror relationship between the source port and the mirror port is established according to the identification information, so as to mirror the data packet of the source port to the mirror port, the mirror port is pre-created by the server; and the packet capture task execution request is forwarded to the packet capture entity, so that the packet capture entity captures the data packet from the mirror port.
- the embodiment of the present application provides a client, including a memory, a processor, and a computer program stored in the memory and operable on the processor.
- the processor executes the computer program, the above first A method for grabbing network packets provided by the aspect.
- the embodiment of the present application provides a server, including a memory, a processor, and a computer program stored in the memory and operable on the processor.
- the processor executes the computer program, the above second A method for grabbing network packets provided by the aspect.
- the embodiment of the present application provides a computer-readable storage medium, which stores a computer program.
- the computer program is executed by a processor, the method for capturing network data packets as provided in the first aspect or the second aspect above is implemented. .
- Fig. 1 is a schematic diagram of the implementation environment of a method for capturing network data packets provided in the embodiment of the present application;
- Fig. 2 is a schematic flow diagram of a method for capturing network data packets provided in the embodiment of the present application
- FIG. 3 is a schematic flow diagram of a method for capturing network data packets provided in an embodiment of the present application
- FIG. 4 is a schematic flow diagram of a method for capturing network data packets provided in an embodiment of the present application
- Fig. 5 is a schematic structural diagram of a client provided by an embodiment of the present application.
- FIG. 6 is a schematic structural diagram of a server provided by an embodiment of the present application.
- At least one of the following and similar expressions refer to any group of these items, including any group of single or plural items.
- at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or, a and b and c, where a, b, c can be a single , or more than one.
- the embodiment of the present application provides a method for capturing network data packets, a client, a server, and a computer-readable storage medium.
- FIG. 1 is a schematic diagram of an implementation environment of a method for capturing network data packets provided by an embodiment of the present application.
- the implementation environment includes a client 110 , a service node 120 , a service node 121 , and a server 130 deployed in the service node 120 and a server 131 deployed in the service node 121 .
- the client 110 and the server 130, 131 are interactively connected through a wired network or a wireless network.
- a service node refers to an entity that can independently provide a certain service.
- a service node may be an entity that can receive and forward data packets transmitted by the network.
- the network data packet capture method provided by the embodiment of the present application can be applied to a virtualized network.
- the service nodes can be virtual nodes and physical nodes.
- the virtual nodes include, for example, virtual machines, etc.
- the physical nodes include, for example, physical hosts, switches, and routers. wait.
- the client 110 is a terminal device capable of providing packet capture services for users.
- the client may be a handheld device or a computing device with a wireless communication function.
- mobile phone mobile phone
- tablet computer laptop computer
- desktop computer etc.
- the servers 130 and 131 are used to receive client requests, process related services of the clients, and return processing results.
- FIG. 2 is a schematic flow chart of a method for capturing network data packets provided by an embodiment of the present application.
- the method for capturing network data packets shown in FIG. 2 can be executed by a client in the implementation environment shown in FIG. 1 .
- the network packet capture method that the embodiment of the present application provides includes the following steps:
- Step S110 obtain the packet capture task information of the user, and the packet capture task information includes the identification information of the source port of the data packet to be captured.
- the source port of the data packet to be captured may be a port of any service node in the above implementation environment, such as a port of a virtual machine, a port of a switch, or a port of a router. Therefore, the embodiment of the present application is applicable to the task of capturing packets of virtual ports and physical ports in a virtual network.
- the identification information may include the identification information of the service node where the source port is located and the port number of the source port.
- the identification information includes the above-mentioned The Internet Protocol (Internet Protocol, IP) address and/or Media Access Control Address (Media Access Control Address, MAC) of the switch and the port number of the device port; when the source port of the data packet to be captured is the above-mentioned implementation environment
- the virtual port of the virtual machine the identification information includes the name identification of the above virtual machine and virtual port.
- the source port of the data packet to be captured corresponds to the unique identification information, that is, the identification information can find the unique corresponding source Port, the identification information required to identify the source ports of different service nodes in different networks is different, and will not be described here.
- the client terminal displays the identification information list of the source port in the network, so that the user can search and select the source port of the data packet to be captured from the identification information list, so as to obtain the capture information including the above identification information.
- Package task information It can be understood that the client can obtain the user's packet capture task information through a web application or a desktop application.
- Step S120 sending a packet capture task execution request to the server, the packet capture task execution request carries the packet capture task information, and the packet capture task execution request is used to enable the server to establish the The mirror relationship between the source port and the mirror port, so that the data packet of the source port is mirrored to the mirror port, and the packet capture entity in the server is captured from the mirror port.
- the mirror port is pre-created by the server.
- the server 130 in response to the packet capture task execution request sent by the client 110, the server 130 establishes an The mirror relationship between the source port corresponding to the identification information and the mirror port created in advance by the server 130, and mirror the data packet of the source port to the mirror port, so that the packet capture entity in the server 130 grabs the data packet from the mirror port .
- the packet capture entity is a virtual machine, container or other carrier dynamically created by the server for intercepting, retransmitting, editing, and dumping data packets sent and received during network transmission.
- the server dynamically creates different types of packet capture entities to improve packet capture efficiency and save system resources.
- a mirror port is a virtual port created by the server. By establishing a mirror relationship between the source port and the mirror port, the data packets of the source port are copied without affecting the normal processing flow of the data packets. forwarded to the mirrored port. It can be understood that the mirroring relationship is a corresponding relationship of port numbers between the source port and the mirroring port.
- the packet capture task information also includes task configuration information, and the task configuration information includes at least one of the following: packet capture filter rules, packet capture duration, whether to save the packet capture file and whether to display the summary content of the message.
- the task configuration information of the packet capture and filtering rules is obtained, so that the packet capture entity captures specific packets in the mirror port.
- the packet capture and filter rules can be the source port address, destination Restrictions on port addresses, etc.
- the packet capture filter rules can be restrictions on multiple source port addresses or destination port addresses. According to the actual needs of users, the packet capture filter rules can be adjusted accordingly, and there is no limit here.
- the packet capture entity is instructed to capture the data packet in the mirror port, so that the user can customize the packet capture time, so as to avoid the packet capture time being too long. It takes too long to occupy too many resources; or, to prevent the packet capture time from being too short, the packet capture results cannot meet the actual needs of users.
- the network data packet capture method may also include the following steps:
- a list of task configuration information is displayed, and target configuration information selected by the user from the list of task configuration information is acquired.
- the display includes task configuration information including packet capture filtering rules, packet capture duration, whether to save the packet capture file, and whether to display the summary content of the packet.
- the client can also display the specific content list of the summary content of the message, such as the source port address of the message, the destination port address, the number of messages and the type of the message, etc. , so that the user can select or input the summary content of the message to be displayed in the specific content list.
- the network data packet grabbing method provided by the embodiment of the present application further includes the following steps: receiving the summary content of the message returned by the server, and displaying the summary content of the message;
- the summary content includes at least one of the following: source port address, destination port address, packet quantity and packet type.
- the client can display the summary content of the message returned from the server through a Web page.
- the readability of the captured packet content to the user is improved.
- the task configuration information may also include the data length of the data packet, and by obtaining the data length information, instruct the packet capture entity to capture a data packet with a specific data length in the mirror port, for example, to capture a data packet with a data length greater than 1000 bytes Data packets; or, capture data packets whose data length is less than 1000 bytes.
- the method for grabbing network data packets further includes the following steps: in response to an instruction for downloading summary content of a message input by a user, sending a request for downloading summary content of a message to the server, the The download message summary content request is used to make the server return the message summary content file according to the download message summary content request; download the message summary content file returned by the server end.
- the network data packet capture method may also include the following steps of displaying the function keys for downloading the message summary content, so as to obtain the user input instruction: Command to download the summary content of the message.
- the function button for downloading the summary content of the message may be a button in a web application program, or a button in a desktop application program.
- the user-input download message summary content instruction may be acquired through an interface interacting with the user, and is not limited to the above-mentioned embodiment.
- the summary content of the message can be downloaded by using the Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) or the Web Socket protocol.
- HTTP Hyper Text Transfer Protocol
- Web Socket protocol Hyper Text Transfer Protocol
- the network data packet capture method provided by the embodiment of the present application further includes the following steps: in response to the download capture file instruction input by the user, sending a request for downloading the capture file to the server, the download capture file
- the packet file request is used to make the server return the packet capture file according to the download packet capture file request; download the packet capture file returned by the server end.
- the network data packet capture method may also include the following steps: displaying the function button for downloading the packet capture file, so as to obtain the downloading file input by the user. Capture file command.
- the function button for downloading the packet capture file may be a button in a web application or a button in a desktop application.
- the instruction for downloading the packet capture file input by the user may be acquired through an interface interacting with the user, which is not limited to the above-mentioned embodiment.
- HTTP protocol or Web Socket protocol can be used to download the captured file.
- the network data packet capture method provided by the embodiment of the present application further includes the following steps: in response to a stop capture command input by the user, sending a stop capture request to the server, the stop capture request It is used to make the packet capture entity of the server stop capturing data packets from the mirror port.
- the network data packet capture method may further include the following steps: displaying a function key to stop capturing the package, so as to obtain the stop capturing package input by the user instruction.
- the function button for stopping packet capture may be a button in a web application or a button in a desktop application.
- the packet capture stop instruction input by the user may be obtained through an interface interacting with the user, and is not limited to the above-mentioned embodiment.
- the method for capturing network data packets provided by the embodiment of the present application further includes the following steps: in response to the instruction of continuing to capture packets input by the user, sending a request for continuing to capture packets to the server, the continuing capturing The packet request is used to enable the packet capture entity of the server to capture data packets from the mirror port.
- a packet capture stop request is sent to the server, so that the packet capture entity of the server stops capturing packets from the mirror port. At this time, the mirror relationship between the source port and the mirror port still exists.
- the input continuation packet capture command sends a continuation packet capture request to the server, so that the packet capture entity of the server continues to capture data packets on the mirror port based on the previous mirror relationship.
- the method for capturing network data packets provided in the embodiments of the present application further includes the following steps: in response to a command to delete a packet capturing task input by a user, sending a request to the server to delete a packet capturing task, the deleting The packet task request is used to cause the server to delete the mirror relationship between the source port and the mirror port.
- the network data packet capture method may further include the following steps: displaying a function key for deleting the packet capture task, so as to obtain the delete command input by the user. Packet capture task command.
- the function button for deleting the packet capture task may be a button in a web application or a button in a desktop application.
- the command to delete the packet capture task input by the user may be obtained through an interface interacting with the user, and is not limited to the above-mentioned embodiment.
- the request to delete the packet capture task is to make the server delete the mirror relationship between the source port and the mirror port, and reserve the mirror port for performing the next packet capture task.
- the network data packet capture method provided by the embodiment of the present application further includes the following steps: in response to the command input by the user to delete the packet capture entity, sending a request to the server to delete the packet capture entity.
- the packet entity request is used to cause the server to delete the packet capture entity, the mirror port, and the mirror relationship between the source port and the mirror port.
- the network data packet capture method may further include the following steps: displaying the function button of deleting the packet capture entity, so as to obtain the deletion input by the user Packet capture entity command.
- the function button for deleting the packet capture entity may be a button in a web application or a button in a desktop application.
- command to delete the packet capture entity input by the user may be acquired through an interface interacting with the user, and is not limited to the above-mentioned embodiment.
- the delete packet capture entity request is also used to stop the packet capture entity of the server from capturing packets from the mirror port .
- the server By sending a packet capture task execution request to the server, the server creates a packet capture entity to execute the packet capture task published by the user. After the packet capture task is completed, in response to the request to delete the packet capture entity sent by the client, the server will The packet capture entity, the mirror port, and the mirror relationship between the source port and the mirror port are deleted, thereby saving system resources and realizing resource optimization.
- Fig. 3 is a schematic flowchart of another method for capturing network data packets provided by an embodiment of the present application. Referring to Fig. 3, this method comprises the following steps:
- the method for capturing network data packets provided in the embodiment of the present application is applicable to any server in the above implementation environment.
- Step S210 Receive the packet capture task execution request sent by the client, the packet capture task execution request carries the user's packet capture task information, and the packet capture task information includes the identification information of the source port of the data packet to be captured.
- Step S220 Establish a mirroring relationship between the source port and the mirror port according to the identification information, so as to mirror the data packets of the source port to the mirror port, and the mirror port is pre-created by the server.
- Step S230 forwarding the packet capture task execution request to a packet capture entity, so that the packet capture entity captures data packets from the mirror port.
- the data packets of the source port are copied and forwarded to the mirror port without affecting the normal processing flow of the data packets, so that the packet capture entity can be carried out on the mirror port. Capture packets, so as to overcome the security risks caused by the packet capture process to the host.
- you need to upgrade the packet capture service you only need to update the packet capture image installation source, which makes the upgrade operation of the packet capture service simpler and easier to implement.
- the server determines whether there is a packet capture entity capable of performing the packet capture task by obtaining the unique identifier of the packet capture entity, and creates a packet capture entity if it does not exist.
- the server checks whether there is a mirror port that can establish a mirror relationship with the source port, and if not, creates a mirror port.
- steps S210 to S230 For the specific implementation process of steps S210 to S230, refer to the related descriptions of steps S110 to S120 above, and details will not be repeated here.
- the packet capture entity uses a message filtering technology based on an express data path (extreme data path, XDP) technology to capture data packets from the mirror port, so as to reduce system resource occupation and improve packet capture performance.
- XDP extreme data path
- the method provided by the embodiment of the present application may further include the following steps: the packet capture task information also includes the user's task configuration information, and the task configuration information includes whether to save the packet capture file; when according to the task configuration information If it is determined that the user requires to save the packet capture file, the method further includes: saving the captured data packets locally through the packet capture entity to generate the packet capture file.
- the method provided by the embodiment of the present application may further include the following steps: receiving the request for downloading the packet capture file sent by the client; copying the packet capture file from the packet capture entity; and returning the packet capture file to the client.
- the method provided by the embodiment of the present application may further include the following steps: the packet capture task information also includes task configuration information, and the task configuration information includes whether to display the summary content of the message; when determined according to the task configuration information
- the user requests to display the summary content of the message
- the method also includes: obtaining the summary content of the message through the packet capture entity and storing the summary content of the message locally, generating a summary content file of the message, and the summary content of the message Including at least one of the following: source port address, destination port address, number of packets, and packet type; sending the summary content of the message to the client, so that the client can carry out the summary content of the message exhibit.
- the method provided by the embodiment of the present application may further include the following steps: receiving a download message summary content request sent by the client; copying the message summary content file from the packet capture entity; The message summary content file is returned to the client.
- the network data packet capture method provided by the embodiment of the present application further includes the following steps: in response to the download capture file instruction input by the user, sending a request for downloading the capture file to the server, the download capture file The packet file request is used to make the server return the packet capture file according to the download packet capture file request; download the packet capture file returned by the server end.
- the method provided by the embodiment of the present application may further include the following steps: the packet capture task information further includes task configuration information, and the task configuration information includes at least one of the following: packet capture filter rules, the capture The packet filtering rule is used to instruct the packet capture entity to filter the data packets obtained from the mirror port; The mirror port grabs packets.
- the method provided by the embodiment of the present application may further include the following steps: receiving the stop packet capture request sent by the client; forwarding the stop packet capture request to the packet capture entity, so that the The packet capture entity stops capturing data packets from the mirror port according to the packet capture stop request.
- the method provided by the embodiment of the present application may further include the following steps: receiving the request for deleting the packet capture task sent by the client; deleting the mirror relationship according to the request for deleting the packet capture task, and The packet capture task deletion request is forwarded to the packet capture entity, so that the packet capture entity stops capturing data packets from the mirror port.
- the method provided by the embodiment of the present application may further include the following steps: receiving the request for deleting the packet capture entity sent by the client; The mirror port and the mirror relationship between the source port and the mirror port are deleted.
- FIG. 4 is a schematic flowchart of a method for capturing network data packets provided by an embodiment of the present application.
- the network packet capture method provided by the embodiment of the present application comprises the following steps:
- Step S310 receiving a packet capture task execution request sent by the client
- Step S320 judging whether there is a packet capture entity that can perform the packet capture task, if yes, execute step S340, if not, execute step S330;
- Step S330 creating a packet capture entity
- Step S340 judging whether there is a mirror port that can establish a mirror relationship with the source port, if so, execute step S360, if not, execute step S350;
- Step S350 creating a mirror port
- Step S360 establishing a mirroring relationship between the source port and the mirror port according to the identification information, so as to mirror the data packets of the source port to the mirror port;
- Step S370 forwarding the packet capture task execution request to the packet capture entity, so that the packet capture entity captures the data packet from the mirror port.
- the server in response to the packet capture task execution request sent by the client, the server first determines whether there is a packet capture entity that can perform the packet capture task by obtaining the unique identifier of the packet capture entity, and then determines whether there is a packet capture entity that can communicate with the source
- the mirror port that establishes a mirror relationship with the port, after determining that there is a packet capture entity and a mirror port, establishes a mirror relationship between the source port and the mirror port through the identification information, so as to mirror the data packets of the source port to the mirror port, and finally capture
- the packet task execution request is forwarded to the packet capture entity, so that the packet capture entity captures the data packet from the mirror port.
- the client obtains the user's packet capture task information
- the packet capture task information includes the identification information of the source port of the data packet to be captured
- the packet capture task execution request carries Packet capture task information.
- the server establishes a mirror relationship between the source port corresponding to the identification information and the mirror port created in advance by the server, so as to mirror the data packets of the source port to the mirror port, and then the packet capture in the server The entity grabs packets from the mirror port.
- the packet capture entity is created on the server side to execute the packet capture task released by the user.
- the packet capture entity can be retained or recycled according to actual needs, thereby saving system resources and realizing resource optimization.
- the data packet of the source port is copied and forwarded to the mirror port without affecting the normal processing flow of the data packet, so that the packet capture entity can capture the mirror port at the mirror port. Packets, so as to overcome the security risks caused by the packet capture process to the host.
- you need to upgrade the packet capture service you only need to update the packet capture image installation source, which makes the upgrade operation of the packet capture service simpler and easier to implement.
- FIG. 5 shows a client 200 provided by the embodiment of the present application.
- the client 200 includes but is not limited to:
- memory 210 for storing programs
- the processor 220 is configured to execute the program stored in the memory 210.
- the processor 220 executes the program stored in the memory 210, the processor 220 is configured to execute the method for capturing network packets described in Embodiment 1 above.
- the processor 220 and the memory 210 may be connected through a bus or in other ways.
- the memory 210 can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the method for capturing network data packets described in any embodiment of the present application.
- the processor 220 executes the non-transitory software programs and instructions stored in the memory 210 to implement the method for capturing network data packets described in the first embodiment above.
- the memory 210 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application program required by at least one function; the data storage area may store the method for executing the above-mentioned network packet capture.
- the memory 210 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices.
- the memory 210 may optionally include memory located remotely relative to the processor 220, and these remote memories may be connected to the processor 220 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
- the non-transitory software programs and instructions required to realize the above-mentioned method for capturing network data packets are stored in the memory 210, and when executed by one or more processors 220, the network data packet capturing provided by any embodiment of the present application is executed. method of taking.
- FIG. 6 shows a server 300 provided by the embodiment of the present application.
- the server 300 includes but is not limited to:
- memory 310 for storing programs
- the processor 320 is configured to execute the program stored in the memory 310.
- the processor 320 executes the program stored in the memory 310, the processor 320 is configured to execute the method for capturing network packets described in the second embodiment above.
- the processor 320 and the memory 310 may be connected through a bus or in other ways.
- the memory 310 can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the method for capturing network data packets described in any embodiment of the present application.
- the processor 320 executes the non-transitory software program and instructions stored in the memory 310 to implement the method for capturing network data packets described in the second embodiment above.
- the memory 310 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application program required by at least one function; the data storage area may store the method for executing the above-mentioned network packet capture.
- the memory 310 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices.
- the memory 310 may optionally include memory located remotely relative to the processor 320, and these remote memories may be connected to the processor 320 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
- the non-transitory software programs and instructions required to realize the above-mentioned method for capturing network data packets are stored in the memory 310, and when executed by one or more processors 320, the network data packet capturing provided by any embodiment of the present application is executed. method of taking.
- the embodiment of the present application also provides a computer storage medium, storing computer-executable instructions, and the computer-executable instructions are used to execute the above-mentioned method for capturing network data packets.
- the storage medium stores computer-executable instructions
- the computer-executable instructions are executed by one or more control processors, for example, executed by one or more processors in the above-mentioned client, or by the above-mentioned Execution by one or more processors in the server end may cause the above-mentioned one or more processors to execute the method for capturing network data packets provided in any embodiment of the present application.
- each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
- the above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.
- Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can Any other medium used to store desired information and which can be accessed by a computer.
- communication media typically embody computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .
- the client obtains the user's packet capture task information, the packet capture task information includes the identification information of the source port of the data packet to be captured, and sends a packet capture task execution request to the server, the packet capture task execution request Carrying packet capture task information.
- the server establishes a mirror relationship between the source port corresponding to the identification information and the mirror port created in advance by the server, so as to mirror the data packets of the source port to the mirror port, and then the packet capture in the server The entity grabs packets from the mirror port.
- the packet capture entity is created on the server side to execute the packet capture task released by the user.
- the packet capture entity can be retained or recycled according to actual needs, thereby saving system resources and realizing resource optimization.
- the data packet of the source port is copied and forwarded to the mirror port without affecting the normal processing flow of the data packet, so that the packet capture entity can capture the mirror port at the mirror port. Packets, so as to overcome the security risks caused by the packet capture process to the host.
- you need to upgrade the packet capture service you only need to update the packet capture image installation source, which makes the upgrade operation of the packet capture service simpler and easier to implement.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
一种网络数据包抓取方法和客户端、服务端，其中所述方法包括获取用户的抓包任务信息，所述抓包任务信息包括待抓取数据包的源端口的标识信息(S110)；向服务端发送抓包任务执行请求，所述抓包任务执行请求携带有所述抓包任务信息，所述抓包任务执行请求用于使所述服务端根据所述标识信息建立所述源端口与镜像端口的镜像关系，以将所述源端口的数据包镜像到所述镜像端口，并使所述服务端中的抓包实体从所述镜像端口抓取数据包，所述镜像端口由所述服务端预先创建(S120)。
Description
相关申请的交叉引用
本申请基于申请号为202111152106.X、申请日为2021年09月29日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
本申请涉及通信技术领域，特别是涉及一种网络数据包抓取方法和客户端、服务端。
网络抓包指将网络传输发送与接收的数据包进行截获、重发、编辑、转存等操作，网络开发、运维人员通过对抓取的数据包进行分析，可快速定位网络故障原因。
相关技术中，常通过部署专门的抓包服务器对业务节点进行抓包。但是在这种模式下，抓包服务器需要长期占用网络系统中的节点或其他硬件资源，特别是在没有抓包任务执行时，依然独占硬件的计算资源，造成资源的浪费，而且抓包服务器的升级难度较高。也可通过在待抓包端口的宿主机中输入命令来执行临时抓包操作，但是这在操作上十分繁琐，而且对宿主机存在安全隐患。
发明内容
本申请实施例提供一种网络数据包抓取方法、客户端、服务端和计算机可读存储介质，能够实现在镜像端口中通过抓包实体抓取业务节点的数据包，减少对系统硬件资源的占用，及避免对宿主机造成安全隐患。
第一方面，本申请实施例提供一种网络数据包抓取方法，应用于客户端，所述方法包括所述抓包任务信息包括待抓取数据包的源端口的标识信息，所述抓包任务执行请求用于使所述服务端根据所述标识信息建立所述源端口与镜像端口的镜像关系，并使所述服务端中的抓包实体从所述镜像端口抓取数据包，所述镜像端口由所述服务端预先创建。
第二方面，本申请实施例提供一种网络数据包抓取方法，应用于服务端，所述方法包括：接收客户端发送的抓包任务执行请求，所述抓包任务执行请求携带用户的抓包任务信息，所述抓包任务信息包括待抓取数据包的源端口的标识信息；根据所述标识信息建立所述源端口与镜像端口的镜像关系，以将所述源端口的数据包镜像到所述镜像端口，所述镜像端口由所述服务端预先创建；以及将所述抓包任务执行请求转发至抓包实体，以使所述抓包实体从所述镜像端口抓取数据包。
第三方面，本申请实施例提供一种客户端，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现如上第一方面提供的网络数据包抓取的方法。
第四方面，本申请实施例提供一种服务端，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现如上第二方面提供的网络数据包抓取的方法。
第五方面，本申请实施例提供一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时，实现如上第一方面或者第二方面提供的网络数据包抓取的方法。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是本申请实施例提供的一种网络数据包抓取方法的实施环境示意图；
图2是本申请实施例提供的一种网络数据包抓取方法的流程示意图；
图3是本申请实施例提供的一种网络数据包抓取方法的流程示意图；
图4是本申请实施例提供的一种网络数据包抓取方法的流程示意图；
图5是本申请实施例提供的一种客户端的结构示意图；以及
图6是本申请实施例提供的一种服务端的结构示意图。
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
应了解，在本申请实施例的描述中，如果有描述到“第一”、“第二”等只是用于区分技术特征为目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量或者隐含指明所指示的技术特征的先后关系。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示单独存在A、同时存在A和B、单独存在B的情况。其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至 少一项”及其类似表达，是指的这些项中的任意组，包括单项或复数项的任意组。例如，a、b和c中的至少一项可以表示：a，b，c，a和b，a和c，b和c，或者，a和b和c，其中a，b，c可以是单个，也可以是多个。
此外，下面所描述的本申请各个实施方式中所涉及到的技术特征只要彼此之间未构成冲突就可以相互组合。
本申请实施例提供了一种网络数据包抓取方法、客户端、服务端和计算机可读存储介质，通过建立待抓取数据包的源端口和服务端预先创建的镜像端口的镜像关系，在不影响数据包正常处理流程的情况下，将源端口的数据包复制转发到镜像端口，以使抓包实体能在镜像端口进行抓包，从而克服抓包过程对宿主机造成安全隐患问题，在需要对抓包服务进行升级时，只需要更新抓包镜像安装源即可，使得抓包服务的升级操作更加简单和容易实现。
为了方便本领域技术人员理解本申请实施例，下面先对本申请实施例提供的网络数据包抓取方法的实施环境进行说明。
图1是本申请实施例提供的一种网络数据包抓取方法的实施环境示意图。参见图1，该实施环境中包括客户端110、业务节点120、业务节点121以及部署在业务节点120中的服务端130和部署在业务节点121中的服务端131。其中客户端110和服务端130、131通过有线网络或无线网络交互连接。
需要说明的是，业务节点是指能独立地提供某种业务的实体，在本申请实施例中，业务节点可以是能接收、转发网络传输的数据包的实体。本申请实施例提供的网络数据包抓取方法可应用于虚拟化网络中，业务节点可以是虚拟节点和物理节点，虚拟节点包括如：虚拟机等，物理节点包括如：物理主机、交换机、路由器等。
客户端110是能够为用户提供抓包服务的终端设备。客户端具体可以是具有无线通信功能的手持式设备或计算设备。例如，手机(mobile phone)、平板电脑、笔记本电脑、台式计算机等，但并不局限于此。
服务端130、131用于接收客户端请求，对客户端的相关业务进行处理,并返回处理结果。
实施例一
图2是本申请实施例提供的一种网络数据包抓取方法的流程示意图，图2所示的网络数据包抓取方法可由图1所示的实施环境中的客户端执行。参见图2，本申请实施例提供的网络数据包抓取方法包括以下步骤：
步骤S110，获取用户的抓包任务信息,所述抓包任务信息包括待抓取数据包的源端口 的标识信息。
可以理解的是，待抓取数据包的源端口可以是上述实施环境中的任意一个业务节点的端口，如虚拟机端口、交换机端口或路由器端口等。因此，本申请实施例适用于虚拟网络下对虚拟端口和物理端口的抓包任务。
需要说明的是，标识信息可以包括源端口所在业务节点的标识信息和源端口的端口号，例如，当待抓取数据包的源端口是上述实施环境中交换机的设备端口，标识信息就包括上述交换机的网际互连协议(Internet Protocol，IP)地址和/或媒体存取控制地址(Media Access Control Address，MAC)以及设备端口的端口号；当待抓取数据包的源端口是上述实施环境中虚拟机的虚拟端口，标识信息包括有上述虚拟机以及虚拟端口的名称标识，可以理解的是，待抓取数据包的源端口对应着唯一的标识信息，也就是标识信息能够找到唯一对应的源端口，识别不同网络中不同业务节点的源端口需要的标识信息不尽相同，在此不作赘述。
在一个具体实施例中，客户端通过显示网络中源端口的标识信息列表，以使用户可以从标识信息列表中搜索并选择待抓取数据包的源端口，从而获取包括有上述标识信息的抓包任务信息。可以理解的是，客户端可以通过Web应用程序或桌面应用程序获取用户的抓包任务信息。
步骤S120，向服务端发送抓包任务执行请求，所述抓包任务执行请求携带有所述抓包任务信息,所述抓包任务执行请求用于使所述服务端根据所述标识信息建立所述源端口与镜像端口之间的镜像关系，以将所述源端口的数据包镜像到所述镜像端口，并使所述服务端中的抓包实体从所述镜像端口抓取数据包，所述镜像端口由所述服务端预先创建。
参见图1，以客户端110向服务端130发送抓包任务执行请求为例，响应于客户端110发送的抓包任务执行请求，服务端130根据抓包任务执行请求中携带的标识信息，建立标识信息对应的源端口与服务端130预先创建的镜像端口之间的镜像关系，并将源端口的数据包镜像到镜像端口，以使服务端130中的抓包实体从镜像端口抓取数据包。
需要说明的是，抓包实体是由服务端动态创建，用于对网络传输发送与接收的数据包进行截获、重发、编辑、转存的虚拟机、容器或其他载体。服务端根据网络的构成类型，动态创建不同类型的抓包实体，以提高抓包效率和节约系统资源。
需要说明的是，镜像端口是由服务端创建的一种虚拟端口，通过建立源端口和镜像端口之间的镜像关系，在不影响数据包正常处理流程的情况下，将源端口的数据包复制转发到镜像端口。可以理解的是，镜像关系是源端口和镜像端口之间端口号的对应关系。
在一些实施例中，抓包任务信息还包括任务配置信息，所述任务配置信息包括以下至 少一项：抓包过滤规则、抓包时长、是否保存抓包文件和是否展示报文概要内容。
可以理解的是，获取抓包过滤规则的任务配置信息，以使抓包实体在镜像端口中抓取特定的数据包，示例性的，抓包过滤规则可以是对数据包的源端口地址、目的端口地址等的限制，其中，抓包过滤规则可以是对多条源端口地址或目标端口地址的限制，根据用户实际需要，抓包过滤规则可以作相应调整，在此不作限制。
可以理解的是，通过获取抓包时长的任务配置信息，指示抓包实体在镜像端口中进行数据包抓取的时长，以使用户可以自定义抓包时长，以免进行数据包抓取的时间过长，占用过多资源；又或者，以免进行数据包抓取的时间过短，抓包结果不能满足用户实际需求。
可以理解的是，根据用户需求，通过获取是否保存抓包文件的任务配置信息，指示抓包实体在抓取数据包之后，是否对数据包进行本地保存，以免用户不需要对已抓取的数据包进行下一步处理，而抓包实体保存过多无用的数据包，导致占用过多的存储资源。
在一个具体的实施例中，在获取用户的抓包任务信息之前，所述网络数据包抓取方法还可以包括以下步骤：
显示任务配置信息列表，并获取用户从所述任务配置信息列表中选择的目标配置信息。
示例性的，显示包括有抓包过滤规则、抓包时长、是否保存抓包文件和是否展示报文概要内容的任务配置信息。可以理解的是，在关于是否展示报文概要内容的列表中，客户端还可以显示报文概要内容的具体内容列表，如报文源端口地址、目的端口地址、报文数量和报文类型等，以使用户在具体内容列表中选择或输入将要展示的报文概要内容。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：接收所述服务端返回的报文概要内容，并对所述报文概要内容进行展示；所述报文概要内容包括以下至少一项：源端口地址、目的端口地址、报文数量和报文类型。
可以理解的是，客户端可以通过Web页面的方式，显示从所述服务端返回的报文概要内容。
通过获取包括有展示报文概要任务的任务配置信息，接收服务端根据任务配置信息返还的报文概要内容，并将其展示给用户，提高了抓包内容对用户的可读性。
示例性的，任务配置信息还可以包括数据包的数据长度，通过获取数据长度信息，指示抓包实体在镜像端口中抓取特定数据长度的数据包，例如，抓取数据长度大于1000字节的数据包；或者，抓取数据长度小于1000字节的数据包。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的下载报文概要内容指令，向所述服务端发送下载报文概要内容请求，所述下载 报文概要内容请求用于使所述服务端根据所述下载报文概要内容请求返回所述报文概要内容文件；下载所述服务端返回的所述报文概要内容文件。
在一个具体的实施例中，在响应于用户输入的下载报文概要内容指令之前，所述网络数据包抓取方法还可以包括以下步骤显示下载报文概要内容的功能按键，以获取用户输入的下载报文概要内容指令。可以理解的是，下载报文概要内容的功能按键可以是Web应用程序中的按键，也可以是桌面应用程序的按键。
需要说明的是，可以通过与用户交互的接口获取用户输入的下载报文概要内容指令，不限于上述实施例。
需要说明的是，可以采用超文本传输协议(Hyper Text Transfer Protocol，HTTP)或者Web Socket协议进行报文概要内容下载。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的下载抓包文件指令，向所述服务端发送下载抓包文件请求，所述下载抓包文件请求用于使所述服务端根据所述下载抓包文件请求返回所述抓包文件；下载所述服务端返回的所述抓包文件。
在一个具体的实施例中，在响应于用户输入的下载抓包文件指令之前，所述网络数据包抓取方法还可以包括以下步骤：显示下载抓包文件的功能按键，以获取用户输入的下载抓包文件指令。可以理解的是，下载抓包文件的功能按键可以是Web应用程序中的按键，也可以是桌面应用程序的按键。
需要说明的是，可以通过与用户交互的接口获取用户输入的下载抓包文件指令，不限于上述实施例。
需要说明的是，可以采用HTTP协议或者Web Socket协议进行抓包文件下载。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的停止抓包指令，向所述服务端发送停止抓包请求，所述停止抓包请求用于使所述服务端的抓包实体停止从所述镜像端口抓取数据包。
在一个具体的实施例中，在响应于用户输入的停止抓包指令之前，所述网络数据包抓取方法还可以包括以下步骤：显示停止抓包的功能按键，以获取用户输入的停止抓包指令。可以理解的是，停止抓包的功能按键可以是Web应用程序中的按键，也可以是桌面应用程序的按键。
需要说明的是，可以通过与用户交互的接口获取用户输入的停止抓包指令，不限于上述实施例。
在一个具体的实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤： 响应于用户输入的继续抓包指令，向所述服务端发送继续抓包请求，所述继续抓包请求用于使所述服务端的抓包实体从所述镜像端口抓取数据包。
需要说明的是，向所述服务端发送停止抓包请求，以使服务端的抓包实体停止从镜像端口抓取数据包，此时，源端口与镜像端口的镜像关系仍存在，在响应于用户输入的继续抓包指令，向服务端发送继续抓包请求，以使服务端的抓包实体在之前的镜像关系上，继续在镜像端口抓取数据包。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的删除抓包任务指令，向所述服务端发送删除抓包任务请求，所述删除抓包任务请求用于使所述服务端删除所述源端口和所述镜像端口的镜像关系。
在一个具体的实施例中，在响应于用户输入的删除抓包任务指令之前，所述网络数据包抓取方法还可以包括以下步骤：显示删除抓包任务的功能按键，以获取用户输入的删除抓包任务指令。可以理解的是，删除抓包任务的功能按键可以是Web应用程序中的按键，也可以是桌面应用程序的按键。
需要说明的是，可以通过与用户交互的接口获取用户输入的删除抓包任务指令，不限于上述实施例。
可以理解的是，删除抓包任务请求是使服务端删除源端口和镜像端口的镜像关系，保留镜像端口用于执行下次抓包任务。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的删除抓包实体指令，向所述服务端发送删除抓包实体请求，所述删除抓包实体请求用于使所述服务端删除所述抓包实体、所述镜像端口以及所述源端口与所述镜像端口之间的镜像关系。
在一个具体的实施例中，在响应于用户输入的删除抓包实体指令之前，所述网络数据包抓取方法还可以包括以下步骤：显示删除抓包实体的功能按键，以获取用户输入的删除抓包实体指令。可以理解的是，删除抓包实体的功能按键可以是Web应用程序中的按键，也可以是桌面应用程序的按键。
需要说明的是，可以通过与用户交互的接口获取用户输入的删除抓包实体指令，不限于上述实施例。
在一个具体实施例中，在删除抓包实体、镜像端口以及源端口与镜像端口之间的镜像关系之前，删除抓包实体请求还用于使服务端的抓包实体停止从镜像端口抓取数据包。
通过向服务端发送抓包任务执行请求，以使在服务端创建抓包实体执行用户发布的抓包任务，在抓包任务结束后，响应于客户端发送的删除抓包实体请求，服务端将抓包实体、 镜像端口以及源端口与镜像端口之间的镜像关系删除，从而节约系统资源，并实现资源的优化。
实施例二
图3是本申请实施例提供的另一种网络数据包抓取方法的流程示意图。参见图3，该方法包括以下步骤：
需要说明的是，本申请实施例提供的网络数据包抓取方法应用于上述实施环境中的任意一个服务端。
步骤S210：接收客户端发送的抓包任务执行请求，所述抓包任务执行请求携带用户的抓包任务信息，所述抓包任务信息包括待抓取数据包的源端口的标识信息。
步骤S220：根据所述标识信息建立所述源端口与镜像端口之间的镜像关系，以将所述源端口的数据包镜像到所述镜像端口，所述镜像端口由所述服务端预先创建。
步骤S230：将所述抓包任务执行请求转发至抓包实体，以使所述抓包实体从所述镜像端口抓取数据包。
可以理解的是，通过建立源端口和镜像端口的镜像关系，在不影响数据包正常处理流程的情况下，将源端口的数据包复制转发到镜像端口，以使抓包实体能在镜像端口进行抓包，从而克服抓包过程对宿主机造成安全隐患问题。在需要对抓包服务进行升级时，只需要更新抓包镜像安装源即可，使得抓包服务的升级操作更加简单和容易实现。
示例性的，响应于抓包任务执行请求，服务端通过获取抓包实体的唯一标识，判断是否有可以执行抓包任务的抓包实体，若不存在，则创建抓包实体。
示例性的，响应于抓包任务执行请求，服务端检查是否存在可以与源端口建立镜像关系的镜像端口，若不存在，则创建镜像端口。
步骤S210至S230的具体的实现过程可参见前面步骤S110至S120的相关描述，此处不再赘述。
在一些具体实施例中，抓包实体使用基于特快数据路径(extreme data path，XDP)技术的报文过滤技术从所述镜像端口抓取数据包，以减少系统资源占用，提高抓包性能。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：所述抓包任务信息还包括用户的任务配置信息，所述任务配置信息包括是否保存抓包文件；当根据任务配置信息确定用户要求保存抓包文件，所述方法还包括：通过所述抓包实体对抓取的数据包进行本地保存，生成抓包文件。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：接收所述客户端发送的下载抓包文件请求；从所述抓包实体拷贝抓包文件；将所述抓包文件返回给所述客户 端。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：所述抓包任务信息还包括任务配置信息，所述任务配置信息包括是否展示报文概要内容；当根据任务配置信息确定用户要求展示报文概要内容，所述方法还包括：通过所述抓包实体获取报文概要内容并对所述报文概要内容进行本地保存，生成报文概要内容文件，所述报文概要内容包括以下至少一项：源端口地址、目的端口地址、报文数量和报文类型；将所述报文概要内容发送给所述客户端，以使所述客户端对所述报文概要内容进行展示。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：接收所述客户端发送的下载报文概要内容请求；从所述抓包实体拷贝所述报文概要内容文件；将所述报文概要内容文件返回给所述客户端。
在一些实施例中，本申请实施例提供的网络数据包抓取方法还包括以下步骤：响应于用户输入的下载抓包文件指令，向所述服务端发送下载抓包文件请求，所述下载抓包文件请求用于使所述服务端根据所述下载抓包文件请求返回所述抓包文件；下载所述服务端返回的所述抓包文件。在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：所述抓包任务信息还包括任务配置信息，所述任务配置信息包括以下至少一项：抓包过滤规则，所述抓包过滤规则用于指示所述抓包实体对从所述镜像端口得到的数据包进行过滤；抓包时长，所述抓包时长用于指示所述抓包实体根据所述抓包时长从所述镜像端口抓取数据包。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：接收所述客户端发送的停止抓包请求；将所述停止抓包请求转发至所述抓包实体，以使所述抓包实体根据所述停止抓包请求停止从所述镜像端口抓取数据包。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：接收所述客户端发送的删除抓包任务请求；根据所述删除抓包任务请求，将所述镜像关系删除，并将所述删除抓包任务请求转发至所述抓包实体，以使所述抓包实体停止从所述镜像端口抓取数据包。
在一些实施例中，本申请实施例提供的方法还可以包括以下步骤：接收所述客户端发送的删除抓包实体请求；根据所述删除抓包实体请求，将所述抓包实体、所述镜像端口以及源端口与所述镜像端口之间的镜像关系删除。
为了更清楚地说明本申请实施例提供的应用于服务端的网络数据包抓取方法，下面参照图4描述网络数据包抓取方法的示例性具体步骤。
图4是本申请实施例提供的一种网络数据包抓取方法的流程示意图。参见图4本申请 实施例提供的网络数据包抓取方法包括以下步骤：
步骤S310，接收客户端发送的抓包任务执行请求；
步骤S320，判断是否存在可以执行抓包任务的抓包实体，若是，执行步骤S340，若否，执行步骤S330；
步骤S330，创建抓包实体；
步骤S340，判断是否存在可以与源端口建立镜像关系的镜像端口，若是，执行步骤S360，若否，执行步骤S350；
步骤S350，创建镜像端口；
步骤S360，根据标识信息建立源端口与镜像端口之间的镜像关系，以将源端口的数据包镜像到镜像端口；
步骤S370，将抓包任务执行请求转发至抓包实体，以使抓包实体从镜像端口抓取数据包。
在本实施例中，响应于客户端发送的抓包任务执行请求，服务端先是通过获取抓包实体的唯一标识，判断是否有可以执行抓包任务的抓包实体，再判断是否存在可以与源端口建立镜像关系的镜像端口，在确定有抓包实体和镜像端口之后，通过标识信息建立源端口与镜像端口之间的镜像关系，以将源端口的数据包镜像到镜像端口，最后再将抓包任务执行请求转发至抓包实体，以使抓包实体从镜像端口抓取数据包。
需说明的是，在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本申请实施例，客户端获取用户的抓包任务信息，抓包任务信息包括有待抓取数据包的源端口的标识信息，并向服务端发送抓包任务执行请求，抓包任务执行请求携带有抓包任务信息。服务端根据抓包任务信息中的标识信息，建立标识信息对应的源端口与服务端预先创建的镜像端口的镜像关系，以将源端口的数据包镜像到镜像端口，之后服务端中的抓包实体从镜像端口抓取数据包。本申请实施例通过在服务端创建抓包实体执行用户发布的抓包任务，在抓包任务结束后，可根据实际需求对抓包实体进行保留或回收，从而节约系统资源，并实现资源的优化。本申请实施例通过建立源端口和镜像端口的镜像关系，在不影响数据包正常处理流程的情况下，将源端口的数据包复制转发到镜像端口，以使抓包实体能在镜像端口进行抓包，从而克服抓包过程对宿主机造成安全隐患问题。在需要对抓包服务进行升级时，只需要更新抓包镜像安装源即可，使得抓包服务的升级操作更加简单和容易实现。
图5示出了本申请实施例提供的一种客户端200。如图5所示，该客户端200包括但 不限于：
存储器210，用于存储程序；
处理器220，用于执行存储器210存储的程序，当处理器220执行存储器210存储的程序时，处理器220用于执行上述实施例一描述的网络数据包抓取的方法。
处理器220和存储器210可以通过总线或者其他方式连接。
存储器210作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序，如本申请任意实施例描述的网络数据包抓取的方法。处理器220通过运行存储在存储器210中的非暂态软件程序以及指令，从而实现上述实施例一描述的网络数据包抓取的方法。
存储器210可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储执行上述的网络数据包抓取的方法。此外，存储器210可以包括高速随机存取存储器，还可以包括非暂态存储器，比如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器210可选包括相对于处理器220远程设置的存储器，这些远程存储器可以通过网络连接至该处理器220。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
实现上述的网络数据包抓取的方法所需的非暂态软件程序以及指令存储在存储器210中，当被一个或者多个处理器220执行时，执行本申请任意实施例提供的网络数据包抓取的方法。
图6示出了本申请实施例提供的一种服务端300。如图6所示，该服务端300包括但不限于：
存储器310，用于存储程序；
处理器320，用于执行存储器310存储的程序，当处理器320执行存储器310存储的程序时，处理器320用于执行上述实施例二描述的网络数据包抓取的方法。
处理器320和存储器310可以通过总线或者其他方式连接。
存储器310作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序，如本申请任意实施例描述的网络数据包抓取的方法。处理器320通过运行存储在存储器310中的非暂态软件程序以及指令，从而实现上述实施例二描述的网络数据包抓取的方法。
存储器310可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储执行上述的网络数据包抓取的方法。 此外，存储器310可以包括高速随机存取存储器，还可以包括非暂态存储器，比如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器310可选包括相对于处理器320远程设置的存储器，这些远程存储器可以通过网络连接至该处理器320。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
实现上述的网络数据包抓取的方法所需的非暂态软件程序以及指令存储在存储器310中，当被一个或者多个处理器320执行时，执行本申请任意实施例提供的网络数据包抓取的方法。
本申请实施例还提供了一种计算机存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述的网络数据包抓取的方法。
在一实施例中，该存储介质存储有计算机可执行指令，该计算机可执行指令被一个或多个控制处理器执行，比如，被上述客户端中的一个或多个处理器执行，或者被上述服务端中的一个或多个处理器执行，可使得上述一个或多个处理器执行本申请任意实施例提供的网络数据包抓取的方法。
以上所描述的实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包括计算机可读指令、数据结构、程 序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
根据本申请的实施例，客户端获取用户的抓包任务信息，抓包任务信息包括有待抓取数据包的源端口的标识信息，并向服务端发送抓包任务执行请求，抓包任务执行请求携带有抓包任务信息。服务端根据抓包任务信息中的标识信息，建立标识信息对应的源端口与服务端预先创建的镜像端口的镜像关系，以将源端口的数据包镜像到镜像端口，之后服务端中的抓包实体从镜像端口抓取数据包。本申请实施例通过在服务端创建抓包实体执行用户发布的抓包任务，在抓包任务结束后，可根据实际需求对抓包实体进行保留或回收，从而节约系统资源，并实现资源的优化。本申请实施例通过建立源端口和镜像端口的镜像关系，在不影响数据包正常处理流程的情况下，将源端口的数据包复制转发到镜像端口，以使抓包实体能在镜像端口进行抓包，从而克服抓包过程对宿主机造成安全隐患问题。在需要对抓包服务进行升级时，只需要更新抓包镜像安装源即可，使得抓包服务的升级操作更加简单和容易实现。
以上是对本申请的较佳实施进行了具体说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请精神的。共享条件下还可作出种种等同的变形或替换，这些等同的变形或替换均包括在本申请权利要求所限定的范围内。
Claims (20)
- 一种网络数据包抓取方法，应用于客户端，所述方法包括：获取用户的抓包任务信息，所述抓包任务信息包括待抓取数据包的源端口的标识信息；以及向服务端发送抓包任务执行请求，所述抓包任务执行请求携带有所述抓包任务信息，所述抓包任务执行请求用于使所述服务端根据所述标识信息建立所述源端口与镜像端口的镜像关系，并使所述服务端中的抓包实体从所述镜像端口抓取数据包，所述镜像端口由所述服务端预先创建。
- 根据权利要求1所述的方法，其中，所述抓包任务信息还包括任务配置信息，所述任务配置信息包括以下至少一项：抓包过滤规则、抓包时长、是否保存抓包文件和是否展示报文概要内容。
- 根据权利要求1所述的方法，还包括：接收所述服务端返回的报文概要内容，并对所述报文概要内容进行展示；以及所述报文概要内容包括以下至少一项：源端口地址、目的端口地址、报文数量和报文类型。
- 根据权利要求3所述的方法，还包括：响应于用户输入的下载报文概要内容指令，向所述服务端发送下载报文概要内容请求，所述下载报文概要内容请求用于使所述服务端根据所述下载报文概要内容请求返回所述报文概要内容文件；以及下载所述服务端返回的所述报文概要内容文件。
- 根据权利要求1所述的方法，还包括：响应于用户输入的下载抓包文件指令，向所述服务端发送下载抓包文件请求，所述下载抓包文件请求用于使所述服务端根据所述下载抓包文件请求返回所述抓包文件；以及下载所述服务端返回的所述抓包文件。
- 根据权利要求1所述的方法，还包括：响应于用户输入的停止抓包指令，向所述服务端发送停止抓包请求，所述停止抓包请求用于使所述服务端的抓包实体停止从所述镜像端口抓取数据包。
- 根据权利要求1所述的方法，还包括：响应于用户输入的删除抓包任务指令，向所述服务端发送删除抓包任务请求，所述删除抓包任务请求用于使所述服务端删除所述源端口和所述镜像端口的镜像关系。
- 根据权利要求1所述的方法，还包括：响应于用户输入的删除抓包实体指令，向所述服务端发送删除抓包实体请求，所述删除抓包任务请求用于使所述服务端删除所述抓包实体、所述镜像端口以及源端口与所述镜像端口的镜像关系。
- 一种网络数据包抓取方法，应用于服务端，所述方法包括：接收客户端发送的抓包任务执行请求，所述抓包任务执行请求携带用户的抓包任务信息，所述抓包任务信息包括待抓取数据包的源端口的标识信息；根据所述标识信息建立所述源端口与镜像端口的镜像关系，以将所述源端口的数据包镜像到所述镜像端口，所述镜像端口由所述服务端预先创建；将所述抓包任务执行请求转发至抓包实体，以使所述抓包实体从所述镜像端口抓取数据包。
- 根据权利要求9所述的方法，其中，所述抓包任务信息还包括用户的任务配置信息，所述任务配置信息包括是否保存抓包文件；当根据任务配置信息确定用户要求保存抓包文件，所述方法还包括：通过所述抓包实体对抓取的数据包进行本地保存，生成抓包文件。
- 根据权利要求10所述的方法，其中，所述方法还包括：接收所述客户端发送的下载抓包文件请求；从所述抓包实体拷贝抓包文件；将所述抓包文件返回给所述客户端。
- 根据权利要求9所述的方法，其中，所述抓包任务信息还包括任务配置信息，所述任务配置信息包括是否展示报文概要内容；当根据任务配置信息确定用户要求展示报文概要内容，所述还包括：通过所述抓包实体获取报文概要内容并对所述报文概要内容进行本地保存，生成报文概要内容文件，所述报文概要内容包括以下至少一项：源端口地址、目的端口地址、报文数量和报文类型；将所述报文概要内容发送给所述客户端，以使所述客户端对所述报文概要内容进行展示。
- 根据权利要求12所述的方法，其中，所述方法还包括：接收所述客户端发送的下载报文概要内容请求；从所述抓包实体拷贝所述报文概要内容文件；将所述报文概要内容文件返回给所述客户端。
- 根据权利要求9所述的方法，其中，所述抓包任务信息还包括任务配置信息，所 述任务配置信息包括以下至少一项：抓包过滤规则，所述抓包过滤规则用于指示所述抓包实体对从所述镜像端口得到的数据包进行过滤；抓包时长，所述抓包时长用于指示所述抓包实体根据所述抓包时长从所述镜像端口抓取数据包。
- 根据权利要求9所述的方法，其中，所述方法还包括：接收所述客户端发送的停止抓包请求；将所述停止抓包请求转发至所述抓包实体，以使所述抓包实体根据所述停止从所述镜像端口抓取数据包。
- 根据权利要求9所述的方法，其中，所述方法还包括：接收所述客户端发送的删除抓包任务请求；根据所述删除抓包任务请求，将所述镜像关系删除，并将所述删除抓包任务请求转发至所述抓包实体，以使所述抓包实体停止从所述镜像端口抓取数据包。
- 根据权利要求9所述的方法，其中，所述方法还包括：接收所述客户端发送的删除抓包实体请求；根据所述删除抓包实体请求，将所述抓包实体、所述镜像端口以及源端口与所述镜像端口的镜像关系删除。
- 一种客户端，其中，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现如权利要求1至8任一项所述的网络数据包抓取方法。
- 一种服务端，其中，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时，实现如权利要求9至17任一项所述的网络数据包抓取方法。
- 一种计算机可读存储介质，其中，存储有计算机程序，所述计算机程序被处理器执行时，实现如权利要求1至17任一项所述的网络数据包抓取方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111152106.XA CN115914253A (zh) | 2021-09-29 | 2021-09-29 | 网络数据包抓取方法和客户端、服务端 |
| CN202111152106.X | 2021-09-29 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2023050816A1 true WO2023050816A1 (zh) | 2023-04-06 |
Family
ID=85770656
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2022/091513 WO2023050816A1 (zh) | 2021-09-29 | 2022-05-07 | 网络数据包抓取方法和客户端、服务端 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN115914253A (zh) |
| WO (1) | WO2023050816A1 (zh) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116938895B (zh) * | 2023-09-15 | 2023-12-29 | 云粒智慧科技有限公司 | 媒体数据包采集方法、装置、电子设备和存储介质 |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060095377A1 (en) * | 2004-10-29 | 2006-05-04 | Young Jill D | Method and apparatus for scraping information from a website |
| CN102870377A (zh) * | 2012-06-30 | 2013-01-09 | 华为技术有限公司 | 虚拟端口监控方法和设备 |
| CN106961400A (zh) * | 2017-03-30 | 2017-07-18 | 深圳市神云科技有限公司 | 一种实现云平台虚拟端口镜像的方法和系统 |
| CN109525509A (zh) * | 2017-09-19 | 2019-03-26 | 中兴通讯股份有限公司 | 网卡镜像抓包方法、终端以及可读存储介质 |
| CN111399972A (zh) * | 2019-01-02 | 2020-07-10 | 中国移动通信有限公司研究院 | 一种虚拟机抓包的方法、装置及计算机可读存储介质 |
-
2021
- 2021-09-29 CN CN202111152106.XA patent/CN115914253A/zh active Pending
-
2022
- 2022-05-07 WO PCT/CN2022/091513 patent/WO2023050816A1/zh unknown
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060095377A1 (en) * | 2004-10-29 | 2006-05-04 | Young Jill D | Method and apparatus for scraping information from a website |
| CN102870377A (zh) * | 2012-06-30 | 2013-01-09 | 华为技术有限公司 | 虚拟端口监控方法和设备 |
| CN106961400A (zh) * | 2017-03-30 | 2017-07-18 | 深圳市神云科技有限公司 | 一种实现云平台虚拟端口镜像的方法和系统 |
| CN109525509A (zh) * | 2017-09-19 | 2019-03-26 | 中兴通讯股份有限公司 | 网卡镜像抓包方法、终端以及可读存储介质 |
| CN111399972A (zh) * | 2019-01-02 | 2020-07-10 | 中国移动通信有限公司研究院 | 一种虚拟机抓包的方法、装置及计算机可读存储介质 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115914253A (zh) | 2023-04-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP4009593A1 (en) | Data transmission method and apparatus, network card and storage medium | |
| EP2704398A1 (en) | A method for content change notification in a cloud storage system, a corresponding cloud broker and cloud agent | |
| CN115004673B (zh) | 消息推送方法、装置、电子设备及计算机可读介质 | |
| WO2019100266A1 (zh) | 移动边缘主机服务通知方法和装置 | |
| WO2021184551A1 (zh) | 基于多个网络的通信方法、装置、电子设备及存储介质 | |
| US8549582B1 (en) | Methods for handling a multi-protocol content name and systems thereof | |
| WO2023050816A1 (zh) | 网络数据包抓取方法和客户端、服务端 | |
| JP6858328B2 (ja) | パーソナルユーザデバイスおよびデータ分配デバイスを用いたストレージシステムの実現 | |
| WO2022007008A1 (zh) | 一种资源请求响应方法、重定向服务器及决策分发服务器 | |
| US9426246B2 (en) | Method and apparatus for providing caching service in network infrastructure | |
| WO2020232887A1 (zh) | 容器应用的配置修改方法、装置、计算机设备及存储介质 | |
| WO2023040833A1 (zh) | 任务创建方法、装置、电子设备和计算机可读存储介质 | |
| US20160156747A1 (en) | Management of transmission control blocks (tcbs) supporting tcp connection requests in multiprocessing environments | |
| CN108039968B (zh) | 网络优化方法、设备及计算机可读存储介质 | |
| EP2296317A2 (en) | Information processing apparatus for managing events upon identification of the event notification source, and control method and storage medium therefor | |
| CN106599323A (zh) | 在分布式文件系统中实现分布式管道的方法和装置 | |
| JP2014045238A (ja) | 情報処理システム、中継装置、情報処理装置、及び情報処理方法。 | |
| CN112532714B (zh) | 一种数据处理方法、处理装置、服务器及存储介质 | |
| WO2023246031A1 (zh) | 数据共享方法、系统及装置、终端设备及存储介质 | |
| WO2018032499A1 (zh) | 一种负载均衡的方法及相关装置 | |
| CN109413118B (zh) | 一种实现会话同步的方法、装置及存储介质、程序产品 | |
| EP4191907A1 (en) | Vnf instantiation method and apparatus | |
| CN112994928B (zh) | 一种虚拟机的管理方法、装置及系统 | |
| CN111711710B (zh) | 访问MongoDB复制集集群的方法、装置、设备及存储介质 | |
| CN114095550A (zh) | 一种服务端直接读取引用参数的远程过程调用方法 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22874214 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |