CN112583936A - Method for recombining transmission conversation flow - Google Patents
Method for recombining transmission conversation flow Download PDFInfo
- Publication number
- CN112583936A CN112583936A CN202011589533.XA CN202011589533A CN112583936A CN 112583936 A CN112583936 A CN 112583936A CN 202011589533 A CN202011589533 A CN 202011589533A CN 112583936 A CN112583936 A CN 112583936A
- Authority
- CN
- China
- Prior art keywords
- request
- linked list
- response
- message
- reorganization
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/141—Setup of application sessions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/90—Buffering arrangements
- H04L49/9057—Arrangements for supporting packet reassembly or resequencing
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明提供一种重组传输会话流的方法，包括以下步骤：从网卡上采集报文信息，根据所述报文信息，获取五元组信息；提供请求重组链表和响应重组链表，并在采集首个报文信息后，初始化所述请求重组链表和响应重组链表；对所述报文信息进行递归分治重组后插入到所述请求重组链表或所述响应重组链表；将所述请求重组链表和所述响应重组链表组成会话内容，并以所述五元组信息作为关键字，以所述会话内容作为关键字值形成会话哈希表，完成数据重组，本发明能够有效完成对数据的重组还原过程，可有效解决现有技术中重组TCP会话存在交替输出能力缺陷，以及存在抖动和缺包的问题。
The present invention provides a method for reorganizing a transmission session flow, comprising the following steps: collecting message information from a network card, and obtaining quintuple information according to the message information; After each piece of message information, initialize the request reorganization linked list and the response reorganization linked list; perform recursive divide-and-conquer reorganization on the message information and insert it into the request reorganization linked list or the response reorganization linked list; The response reorganization linked list forms session content, and uses the quintuple information as a key, and uses the session content as a key value to form a session hash table to complete data reorganization, and the present invention can effectively complete data reorganization and restoration The process can effectively solve the problems of alternate output capability, jitter and lack of packets in the prior art when recombining TCP sessions.
Description
Technical Field
The invention belongs to the technical field of data transmission, and particularly relates to a method for recombining a transmission session stream.
Background
Since the popularization of the mobile internet technology, although the moore's law of performance of the CPU has failed, the number of users and data traffic of LTE 4G and 5G are increasing exponentially. When analyzing data traffic, TCP data occupies most of components, and in order to restore a real data transmission scenario, a tool for restoring a complete session of TCP is required.
When the existing tool such as a cognate network analysis system wireshark recombines TCP data, the defect of alternate output capability exists under the condition that TCP messages are seriously out of order, and the problems of jitter and packet loss exist.
Disclosure of Invention
In view of the above-mentioned drawbacks of the prior art, the present invention provides a method for reassembling a transport session stream, which is used to solve the problems of the prior art that the reassembling of a TCP session has alternate output capability defects, and jitter and packet loss.
To achieve the above and other related objects, the present invention provides a method for reassembling a transmission session stream, comprising the steps of: collecting message information from a network card, and acquiring quintuple information according to the message information; providing a request recombination linked list and a response recombination linked list, and initializing the request recombination linked list and the response recombination linked list after acquiring first message information; inserting the message information into the request recombination linked list or the response recombination linked list after carrying out recursion division and recombination on the message information; forming session content by using the request reorganization linked list and the response reorganization linked list, forming a session hash table by using the quintuple information as a keyword and the session content as a keyword value, and finishing data reorganization; wherein, the process of performing recursive divide-and-conquer reassembly on the message information to be inserted into the request reassembly linked list and the response reassembly linked list comprises: extracting the message serial number, the message response number and the data load part of the message information; traversing the request reorganization linked list and the response request linked list, judging the covering relationship between the message serial number and the new node corresponding to the message information and the request reorganization linked list and the response reorganization linked list, and correspondingly inserting the message information to be stored in the request reorganization linked list or the response request linked list according to the covering relationship.
In an embodiment of the present invention, traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship includes: traversing the request reorganization linked list and the response request linked list; if the request reassembly linked list is empty or the sequencing result of the message sequence number in the request reassembly linked list is minimum, directly inserting the message information into the head of the request reassembly linked list; and if the response request linked list is empty or the sequencing result of the message sequence number in the response request linked list is minimum, directly inserting the message information into the head of the response request linked list.
In an embodiment of the present invention, the process of directly inserting the packet information into the head of the request reassembly chain table or directly inserting the packet information into the head of the response request chain table includes: and acquiring a reorganization node from a memory pool, storing the message serial number, the message response number and the data load part into the reorganization node, and inserting the reorganization node into the request reorganization linked list or the first node of the corresponding request linked list.
In an embodiment of the present invention, traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship includes: traversing the request reorganization linked list and the response request linked list; if the message serial number of the message information is equal to the expected serial number of a certain node in the request reassembly linked list, and the message serial number plus the length of the data load part is not overlapped with other nodes in the request reassembly linked list, inserting the message information into the node position behind the certain node; and if the message serial number of the message information is equal to the expected serial number of a certain node in the response request linked list, and the message serial number plus the length of the data load part is not overlapped with other nodes in the response request linked list, inserting the message information into the node position behind the certain node.
In an embodiment of the present invention, traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship includes: traversing the request reorganization linked list and the response request linked list; and if the sum of the message sequence number and the length of the data load part is less than the expected sequence number of the request reassembly linked list or the expected sequence number of the response request linked list, discarding the message information.
In an embodiment of the present invention, the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further includes: traversing the request reorganization linked list and the response request linked list; if the message serial number is smaller than the serial number of a certain node in the request reassembly linked list or the serial number of a certain node in the response request linked list, and the sum of the message serial number and the length of the data load part is larger than the sum of the serial number of the certain node and the load length of the certain node, cutting the message information and obtaining two new message information; and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
In an embodiment of the present invention, the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further includes: traversing the request reorganization linked list and the response request linked list; if the message serial number is smaller than the serial number of a certain node in the request reorganization linked list or the serial number of a certain node in the response request linked list, the sum of the lengths of the message serial number and the data load part is larger than the serial number of a certain node in the request reorganization linked list or the serial number of a certain node in the response request linked list, and the sum of the lengths of the message serial number and the data load part is smaller than the sum of the serial number of a certain node in the request reorganization linked list or the response reorganization linked list and the load length of a certain node, the message information is cut to obtain two new message information; and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
In an embodiment of the present invention, the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further includes: traversing the request reorganization linked list and the response request linked list; if the message serial number is greater than the serial number of a certain node in the request reorganization linked list or the response request linked list, the message serial number is less than the sum of the serial number of the certain node in the request reorganization linked list or the response request linked list and the load length of the certain node, and the sum of the message serial number and the length of the data load part is greater than the sum of the serial number of the certain node and the load length of the certain node, the message information is cut to obtain two new message information; and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
In an embodiment of the present invention, the data stream reassembly method further includes: if the data discontinuity exists in the request reorganization linked list or the response request linked list after the reorganization is finished, generating a segment of vacant data, and reporting to an upper application layer when the vacant data is output.
In an embodiment of the present invention, the five-tuple information includes source IP information, destination IP information, source port information, destination port information, and a TCP protocol, and the process of acquiring the five-tuple information includes: and after determining that the data link layer is a TCP protocol, extracting source port information and target port information from the transmission layer data.
As described above, the method for recombining transmission session streams according to the present invention has the following beneficial effects:
compared with the prior art, the method and the device have the advantages that after the message information on the network card is acquired, the message information is recursively divided and recombined and then inserted into the request recombination linked list or the corresponding recombination linked list, the quintuple information is acquired through the message information and is used as a key word, the session content consisting of the request recombination linked list and the response recombination linked list is used as a key word value to form the hash table, so that a user can conveniently check the content after session reduction through the hash table, the recombination process of TCP data is completed, the defect of TCP recombination under the situation of serious disorder of the messages during session recombination in the prior art can be overcome, and good jitter resistance and packet missing resistance effects are achieved.
Drawings
Fig. 1 is a flow chart illustrating a method for reassembling a transmission session stream according to an embodiment of the present invention.
FIG. 2 is a flow chart illustrating an embodiment of the present invention for recursively demultiplexing and reassembling packet information for insertion into a request reassembly chain and a response reassembly chain.
Detailed Description
The following description of the embodiments of the present invention is provided by way of specific examples, and other advantages and effects of the present invention will be readily apparent to those skilled in the art from the disclosure herein. The invention is capable of other and different embodiments and of being practiced or of being carried out in various ways, and its several details are capable of modification in various respects, all without departing from the spirit and scope of the present invention. It is to be noted that the features in the following embodiments and examples may be combined with each other without conflict.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present invention, and the drawings only show the components related to the present invention rather than being drawn according to the number, shape and size of the components in actual implementation, and the type, number and proportion of the components in actual implementation may be changed arbitrarily, and the layout of the components may be more complicated. .
As shown in fig. 1, in an embodiment, the method for reassembling a transmission session stream of the present invention includes the following steps:
s1, collecting message information from the network card, and acquiring quintuple information according to the message information.
And S2, providing a request reorganization linked list and a response reorganization linked list, and initializing the request reorganization linked list and the response reorganization linked list after acquiring the first message information.
S3, inserting the message information into the request recombination linked list or the response recombination linked list after carrying out recursion divide-conquer recombination.
As shown in fig. 2, in an embodiment, performing recursive divide-and-conquer reassembly on the packet information to be inserted into the request reassembly linked list and the response reassembly linked list includes the following steps:
s31, extracting the message serial number, the message response number and the data load part of the message information.
S32, traversing the request reorganization linked list and the response request linked list, judging the covering relationship between the message serial number and the new node corresponding to the message information and the request reorganization linked list and the response reorganization linked list, and inserting the message information correspondingly to be stored in the request reorganization linked list or the response request linked list according to the covering relationship.
By the recombination method, after the message information is collected, the message information is recombined by a recursive division recombination method and then is respectively inserted into the request recombination linked list and the response request linked list, the contents in the request recombination linked list and the response request linked list are jointly used as the information of the session content, the session recombination can be completed, meanwhile, the quintuple information of the message information is collected, the quintuple information is used as a keyword, the session content is used as a keyword value and is inserted into the hash table, and the session is stored in the hash table on the basis of the session recombination, so that the storage and the search of the recombined session are facilitated.
In one embodiment, the process of step S31 includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the request reassembly linked list is empty or the result of the ordering of the message sequence numbers in the request reassembly linked list is minimum, the message information is directly inserted into the head of the request reassembly linked list; and if the response request linked list is empty or the sequencing result of the message sequence number in the response request linked list is minimum, directly inserting the message information into the head of the response request linked list.
In an embodiment, the process of directly inserting the packet information into the head of the request reassembly chain table or directly inserting the packet information into the head of the response request chain table includes: and acquiring a reorganization node from a memory pool, storing the message serial number, the message response number and the data load part into the reorganization node, and inserting the reorganization node into the request reorganization linked list or the first node of the corresponding request linked list.
In one embodiment, the process of step S32 includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the message sequence number of the message information is equal to the expected sequence number of a certain node (POS node) in the request reassembly chain table, and the message sequence number plus the length of the data load portion is not overlapped with other nodes in the request reassembly chain table, the message information is inserted into the node position behind the certain node.
Specifically, that is, the TCP message information and the POS node are in a continuous and non-overlapping relationship, the current message information is directly inserted into the position behind the POS node.
It should be noted that, if the message sequence number of the message information is equal to the expected sequence number of a certain node in the response request linked list, and the length of the data load part added to the message sequence number is not overlapped with other nodes in the response request linked list, the message information is inserted into the node position behind the certain node.
In one embodiment, the process of step S32 includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the sum of the message sequence number and the length of the data load part is less than the expected sequence number of the request reassembly linked list or the expected sequence number of the response request linked list, that is, if the message information has a message duplication relationship with a certain node (PSO node) in the request reassembly linked list or the response request linked list, the message information is discarded.
In one embodiment, the step S32 further includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the message sequence number is smaller than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the message sequence number and the data load part is greater than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the message sequence number and the data load part is smaller than the sum of the sequence number of a certain node in the request reassembly chain table and the load length of the certain node or the sum of the sequence number of a certain node in the response request chain table and the load length of the certain node, the message information is clipped to obtain two new message information.
It should be noted that, in the above process, the packet sequence number is smaller than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the packet sequence number and the length of the data load portion is greater than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the packet sequence number and the length of the data load portion is smaller than the sum of the sequence number of a certain node in the request reassembly chain table or the length of a load of a certain node in the response request chain table, which is specifically expressed in that a tail overlapping relationship exists between the current packet information and information of a certain node (POS node) in the request reassembly chain table or the response request chain table, that is, the tail of the current packet information is covered by information of the POS node.
It should be noted that the recursive subdivision and reassembly method is adopted to perform reassembly until the new message information is placed in a proper position or discarded.
In one embodiment, the process of step S32 further includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the message sequence number is greater than the sequence number of a certain node in the request reassembly chain table or the response request chain table, the message sequence number is less than the sum of the sequence number of the certain node and the load length of the certain node, and the sum of the message sequence number and the information length of the message information is greater than the sum of the sequence number of the certain node and the load length of the certain node, the message information is clipped to obtain two new message information.
It should be noted that, in the above process, the message sequence number is greater than the sequence number of a certain node in the request reassembly chain table or the response request chain table, the message sequence number is less than the sum of the sequence number of the certain node and the load length of the certain node, and the sum of the message sequence number and the information length of the message information is greater than the sum of the sequence number of the certain node and the load length of the certain node, that is, there is a head overlap relationship between the current message information and the information of the certain node in the request reassembly chain table or the response request chain table, that is, the head of the current message information is covered by the information of the POS node.
It should be noted that the recursive subdivision and reassembly method is adopted to perform reassembly until the new message information is placed in a proper position or discarded.
In one embodiment, the process of step S32 further includes traversing the request reassembly chain table and the response request chain table.
Specifically, if the message sequence number is smaller than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the message sequence number and the length of the data load part is greater than the sum of the sequence number of the certain node and the load length of the certain node, the message information is cut and two new message information is obtained.
It should be noted that, when the message sequence number is smaller than the sequence number of a certain node in the request reassembly chain table or the sequence number of a certain node in the response request chain table, and the sum of the message sequence number and the data load length is greater than the sum of the sequence number of the certain node and the load length of the certain node, it indicates that there is a message continuous crossing relationship between the message information and the certain node (POS node) in the request reassembly chain table or the response request chain table, that is, the current message information overlaps the data portions with the information of the multiple nodes existing in the request reassembly chain table or the response request chain table.
It should be noted that the recursive subdivision and reassembly method is adopted to perform reassembly until the new message information is placed in a proper position or discarded.
It should be noted that, in the above process, the certain node is referred to as a POS node, and both specifically refer to any one node that meets the corresponding requirement in the process of traversing the request reassembly chain table and the response request chain table.
In a further embodiment, the process of cutting the message information and obtaining two new message information includes: calculating an offset value, namely a compensation value, wherein the offset value is equal to a difference value obtained by subtracting a message serial number of the current message information from a serial number of a POS node, and the current message information is cut according to the obtained offset value to respectively obtain two new message information, wherein the serial number of the first new message information is equal to the message serial number of the current message information, the response number is equal to the response number of the current message information, the data start is equal to the start of the current message information, and the data length is equal to the offset value; the serial number of the second new message is equal to the sum of the message serial number and the offset value of the current message, the answer number is also equal to the answer number of the current message, the data start is equal to the position of the current message after the offset value is offset from the start position, and the data length is equal to the difference value obtained by subtracting the offset value from the data load length of the current message.
Further, after two new message information are obtained, the new message information is continuously recombined by adopting a recursive division and recombination method until the new message information is placed at a proper position or discarded, so that the data recombination process is completed.
In an embodiment, the data stream reorganization method further includes generating a segment of vacant data if there is data discontinuity in the request reorganization linked list or the response request linked list after the reorganization is completed, and reporting to an upper application layer when outputting, so as to notify the upper application layer to process in time.
S4, forming session content by the request reorganization linked list and the response reorganization linked list, forming a session hash table by taking the quintuple information as a key word and the session content as a key word value, and finishing data reorganization.
In an embodiment, the five-tuple information includes source IP information, destination IP information, source port information, destination port information, and a TCP protocol, and the process of obtaining the five-tuple information includes: and after determining that the data link layer is a TCP protocol, extracting source port information and target port information from the transmission layer data.
In some embodiments, when initializing in a reassembly process, setting a maximum disorder tolerance value, if a packet loss situation occurs in a TCP message information reassembly process, then TCP reassembly enters a disorder tolerance opportunity, until the number of packets after packet loss is greater than the disorder tolerance value, the TCP packet is continuously reassembled and output, otherwise, the TCP packet is continuously received and is not output.
Further, only the out-of-order messages are recombined, and if the message serial number of the message information arriving in the current direction is equal to the expected serial number of the last time and the response number of the TCP in the opposite direction is greater than the current TCP message serial number, the data of the current message is directly output to the application. Otherwise, adding the current message information into the recombination linked list. In addition, when the response value in the current direction is increased, whether the sequence number in the opposite-end direction is smaller than the response number of the message information is detected, and if the sequence number in the opposite-end direction is smaller than the response number of the message information, the TCP message information of the opposite end is output.
Furthermore, in the process of TCP message information transmission and reassembly, two TCP streams (TCP streams) multiplex the last quintuple information, and the difference between the last-ended sequence number and the new required sequence number is large, which, if not handled specially, will generate a false packet loss phenomenon, at this time, the rst and fin marks of TCP are detected and accumulated, and if a new TCP message information with a length greater than zero length is reached, the application program is notified that a TCP Port Reuse behavior has occurred.
In some embodiments, after the two directions (request and response) are recombined, alignment is required to be performed for alternate output, the two linked lists (request recombination linked list and response recombination linked list) are operated, and when the TCP acknowledgment number of the head node of the linked list at the opposite end is greater than or equal to the TCP sequence number of the home end, it is described that the TCP node of the home end should output before the TCP acknowledgment number of the opposite end, and how many TCP nodes should output until the TCP response number of the opposite end is no longer greater than or equal to the TCP sequence number of the home end. In the TCP chain table of the opposite end of the chain table, if the minimum TCP confirmation number of the local end is more than or equal to the sequence number of the minimum TCP node of the opposite end, the TCP node of the opposite end is output by the number of the TCP node of the local end until the confirmation number of the TCP node of the local end is no more than or equal to the TCP sequence number of the opposite end. And repeating the processes, repeatedly detecting the state values of the two-way linked list, and outputting all the data, wherein the output effect is the effect of alternately outputting in the forward direction and the reverse direction, and the data recombination process can be completed.
Compared with the prior art, the method for recombining the transmission session flow comprises the steps of obtaining the message information on the network card, performing recursive division recombination on the message information, inserting the message information into the request recombination linked list or the corresponding recombination linked list, obtaining quintuple information through the message information, taking the quintuple information as a keyword, and taking the session content formed by the request recombination linked list and the response recombination linked list as a keyword value to form a hash table, so that a user can conveniently check the content after session reduction through the hash table to complete the recombination process of TCP data, thereby not only solving the defect of recombining TCP under the condition of serious disorder of the message during session recombination in the prior art, but also having good jitter resistance and packet missing resistance effects, effectively overcoming various defects in the prior art and having high industrial utilization value.
The foregoing embodiments are merely illustrative of the principles and utilities of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Accordingly, it is intended that all equivalent modifications or changes which can be made by those skilled in the art without departing from the spirit and technical spirit of the present invention be covered by the claims of the present invention.
Claims (10)
1. A method of reassembling a transport session stream, comprising the steps of:
collecting message information from a network card, and acquiring quintuple information according to the message information;
providing a request recombination linked list and a response recombination linked list, and initializing the request heavy chain list and the response recombination linked list after acquiring first message information;
inserting the message information into the request recombination linked list or the response recombination linked list after carrying out recursion division and recombination on the message information;
forming session content by using the request reorganization linked list and the response reorganization linked list, forming a session hash table by using the quintuple information as a keyword and the session content as a keyword value, and finishing data reorganization;
wherein, the process of performing recursive divide-and-conquer reassembly on the message information to be inserted into the request reassembly linked list and the response reassembly linked list comprises:
extracting the message serial number, the message response number and the data load part of the message information;
traversing the request reorganization linked list and the response request linked list, judging the covering relationship between the message serial number and the new node corresponding to the message information and the request reorganization linked list and the response reorganization linked list, and correspondingly inserting the message information to be stored in the request reorganization linked list or the response request linked list according to the covering relationship.
2. The method for reassembling a transmission session flow according to claim 1, wherein traversing the request reassembling link list and the response request link list, determining a covering relationship between the packet sequence number and a node sequence number in the request reassembling link list and the response reassembling link list, and inserting the packet information to be stored in the request reassembling link list or the response request link list according to the covering relationship comprises:
traversing the request reorganization linked list and the response request linked list;
if the request reassembly linked list is empty or the sequencing result of the message sequence number in the request reassembly linked list is minimum, directly inserting the message information into the head of the request reassembly linked list;
and if the response request linked list is empty or the sequencing result of the message sequence number in the response request linked list is minimum, directly inserting the message information into the head of the response request linked list.
3. The method according to claim 2, wherein the inserting the packet information directly into the head of the request reassembly chain table or the packet information directly into the head of the response request chain table comprises: and acquiring a reorganization node from a memory pool, storing the message serial number, the message response number and the data load part into the reorganization node, and inserting the reorganization node into the request reorganization linked list or the first node of the corresponding request linked list.
4. The method for reassembling a transmission session flow according to claim 1, wherein traversing the request reassembling link list and the response request link list, determining a covering relationship between the packet sequence number and a node sequence number in the request reassembling link list and the response reassembling link list, and inserting the packet information to be stored in the request reassembling link list or the response request link list according to the covering relationship comprises:
traversing the request reorganization linked list and the response request linked list;
if the message serial number of the message information is equal to the expected serial number of a certain node in the request reassembly chain table, and the node is connected with the request reassembly chain table
After the message serial number plus the length of the data load part is not overlapped with other nodes in the request recombination linked list, inserting the message information into the node position behind the certain node;
if the message serial number of the message information is equal to the expected serial number of a certain node in the response request linked list, and the node is connected with the network
And after the length of the data load part added by the message sequence number is not overlapped with other nodes in the response request linked list, inserting the message information into the node position behind the certain node.
5. The method for reassembling a transmission session stream according to claim 2, wherein traversing the request reassembling link list and the response request link list, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembling link list and the response reassembling link list, and inserting the packet information to be stored in the request reassembling link list or the response request link list according to the coverage relationship comprises:
traversing the request reorganization linked list and the response request linked list;
and if the sum of the message sequence number and the length of the data load part is less than the expected sequence number of the request reassembly linked list or the expected sequence number of the response request linked list, discarding the message information.
6. The method according to claim 2, wherein the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further comprises:
traversing the request reorganization linked list and the response request linked list;
if the message serial number is smaller than the serial number of a certain node in the request reassembly linked list or the serial number of a certain node in the response request linked list, and the sum of the message serial number and the length of the data load part is larger than the sum of the serial number of the certain node and the load length of the certain node, cutting the message information and obtaining two new message information;
and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
7. The method according to claim 2, wherein the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further comprises:
traversing the request reorganization linked list and the response request linked list;
if the message sequence number is less than the sequence number of a certain node in the request reassembly chain table or the response request chain table
The sum of the message serial number and the length of the data load part is greater than the serial number of a certain node in the request reorganization linked list or the serial number of a certain node in the response request linked list, and the sum of the message serial number and the length of the data load part is less than the sum of the serial number of a certain node in the request reorganization linked list or the response reorganization linked list and the load length of the certain node, the message information is cut, and two new message information is obtained;
and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
8. The method according to claim 2, wherein the traversing the request reassembly chain table and the response request chain table, determining a coverage relationship between the packet sequence number and a node sequence number in the request reassembly chain table and the response reassembly chain table, and inserting the packet information to be stored in the request reassembly chain table or the response request chain table according to the coverage relationship further comprises:
traversing the request reorganization linked list and the response request linked list;
if the message serial number is greater than the serial number of a certain node in the request reorganization linked list or the response request linked list, the message serial number is less than the sum of the serial number of the certain node in the request reorganization linked list or the response request linked list and the load length of the certain node, and the sum of the message serial number and the length of the data load part is greater than the sum of the serial number of the certain node and the load length of the certain node, the message information is cut to obtain two new message information;
and adopting the recursive subdivision recombination method to recombine until the new message information is placed in a proper position or is discarded.
9. The method of reassembling a transmission session stream according to claim 2, wherein the data stream reassembling method further comprises: if the data discontinuity exists in the request reorganization linked list or the response request linked list after the reorganization is finished, generating a segment of vacant data, and reporting to an upper application layer when the vacant data is output.
10. The method according to claim 1, wherein the five-tuple information comprises source IP information, destination IP information, source port information, destination port information, and a TCP protocol, and the process of obtaining the five-tuple information comprises: and after determining that the data link layer is a TCP protocol, extracting source port information and target port information from the transmission layer data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011589533.XA CN112583936B (en) | 2020-12-29 | 2020-12-29 | Method for recombining transmission conversation flow |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011589533.XA CN112583936B (en) | 2020-12-29 | 2020-12-29 | Method for recombining transmission conversation flow |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112583936A true CN112583936A (en) | 2021-03-30 |
| CN112583936B CN112583936B (en) | 2022-09-09 |
Family
ID=75143832
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011589533.XA Active CN112583936B (en) | 2020-12-29 | 2020-12-29 | Method for recombining transmission conversation flow |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112583936B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114615355A (en) * | 2022-05-13 | 2022-06-10 | 恒生电子股份有限公司 | Message processing method and message analysis module |
| CN114928638A (en) * | 2022-06-16 | 2022-08-19 | 上海斗象信息科技有限公司 | Network behavior analysis method and device and monitoring equipment |
| CN115348332A (en) * | 2022-07-08 | 2022-11-15 | 宜通世纪科技股份有限公司 | Recombination method of HTTP data stream session in signaling analysis scene |
| CN116032894A (en) * | 2022-12-30 | 2023-04-28 | 杭州西软计算机工程有限公司 | Method and device for TCP session reassembly |
| CN117812068A (en) * | 2024-01-05 | 2024-04-02 | 湖北安博通科技有限公司 | SMB protocol file restoration method and system |
Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020095512A1 (en) * | 2000-11-30 | 2002-07-18 | Rana Aswinkumar Vishanji | Method for reordering and reassembling data packets in a network |
| US6473425B1 (en) * | 1997-10-02 | 2002-10-29 | Sun Microsystems, Inc. | Mechanism for dispatching packets via a telecommunications network |
| US20090161568A1 (en) * | 2007-12-21 | 2009-06-25 | Charles Kastner | TCP data reassembly |
| CN101795230A (en) * | 2010-02-23 | 2010-08-04 | 西安交通大学 | Network flow recovery method |
| US8606772B1 (en) * | 2011-01-26 | 2013-12-10 | Trend Micro Incorporated | Efficient multiple-keyword match technique with large dictionaries |
| US20140053085A1 (en) * | 2012-08-15 | 2014-02-20 | Calgary Scientific Inc. | Methods and systems for collaborative browsing |
| CN103888449A (en) * | 2014-03-05 | 2014-06-25 | 亿赞普(北京)科技有限公司 | Method and device for packet reassembly |
| CN106878304A (en) * | 2017-02-15 | 2017-06-20 | 国网天津市电力公司 | A Method for Link Multiplexing of Distributed Agents |
| WO2017167098A1 (en) * | 2016-03-31 | 2017-10-05 | 阿里巴巴集团控股有限公司 | Method and apparatus for tcp stream reassembly |
| CN107995130A (en) * | 2017-12-05 | 2018-05-04 | 西安交大捷普网络科技有限公司 | A kind of fast shifting method of fragment message |
| CN108011850A (en) * | 2017-12-18 | 2018-05-08 | 北京百度网讯科技有限公司 | The recombination method and device of data packet, computer equipment and computer-readable recording medium |
| CN108600049A (en) * | 2018-04-16 | 2018-09-28 | 苏州云杉世纪网络科技有限公司 | A kind of performance measurement method and device of data center network TCP connection |
-
2020
- 2020-12-29 CN CN202011589533.XA patent/CN112583936B/en active Active
Patent Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6473425B1 (en) * | 1997-10-02 | 2002-10-29 | Sun Microsystems, Inc. | Mechanism for dispatching packets via a telecommunications network |
| US20020095512A1 (en) * | 2000-11-30 | 2002-07-18 | Rana Aswinkumar Vishanji | Method for reordering and reassembling data packets in a network |
| US20090161568A1 (en) * | 2007-12-21 | 2009-06-25 | Charles Kastner | TCP data reassembly |
| CN101795230A (en) * | 2010-02-23 | 2010-08-04 | 西安交通大学 | Network flow recovery method |
| US8606772B1 (en) * | 2011-01-26 | 2013-12-10 | Trend Micro Incorporated | Efficient multiple-keyword match technique with large dictionaries |
| US20140053085A1 (en) * | 2012-08-15 | 2014-02-20 | Calgary Scientific Inc. | Methods and systems for collaborative browsing |
| CN103888449A (en) * | 2014-03-05 | 2014-06-25 | 亿赞普(北京)科技有限公司 | Method and device for packet reassembly |
| WO2017167098A1 (en) * | 2016-03-31 | 2017-10-05 | 阿里巴巴集团控股有限公司 | Method and apparatus for tcp stream reassembly |
| CN106878304A (en) * | 2017-02-15 | 2017-06-20 | 国网天津市电力公司 | A Method for Link Multiplexing of Distributed Agents |
| CN107995130A (en) * | 2017-12-05 | 2018-05-04 | 西安交大捷普网络科技有限公司 | A kind of fast shifting method of fragment message |
| CN108011850A (en) * | 2017-12-18 | 2018-05-08 | 北京百度网讯科技有限公司 | The recombination method and device of data packet, computer equipment and computer-readable recording medium |
| CN108600049A (en) * | 2018-04-16 | 2018-09-28 | 苏州云杉世纪网络科技有限公司 | A kind of performance measurement method and device of data center network TCP connection |
Non-Patent Citations (4)
| Title |
|---|
| WEIXIN_33834628: "TCP报文重组和会话的唯一确定规则", 《CSDN》 * |
| 李安琪: "HTTP协议采集系统的设计实现与应用", 《中国优秀硕士学位论文全文数据库（电子期刊）》 * |
| 林冠洲: "网络流量识别关键技术研究", 《中国优秀硕士学位论文全文数据库（电子期刊）》 * |
| 赵晓碧等: "NIDS中的应用层并行重组技术", 《辽宁石油化工大学学报》 * |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114615355A (en) * | 2022-05-13 | 2022-06-10 | 恒生电子股份有限公司 | Message processing method and message analysis module |
| CN114928638A (en) * | 2022-06-16 | 2022-08-19 | 上海斗象信息科技有限公司 | Network behavior analysis method and device and monitoring equipment |
| CN114928638B (en) * | 2022-06-16 | 2024-08-02 | 上海斗象信息科技有限公司 | A network behavior analysis method, device and monitoring equipment |
| CN115348332A (en) * | 2022-07-08 | 2022-11-15 | 宜通世纪科技股份有限公司 | Recombination method of HTTP data stream session in signaling analysis scene |
| CN115348332B (en) * | 2022-07-08 | 2023-08-29 | 宜通世纪科技股份有限公司 | Method for reorganizing HTTP data stream session in signaling analysis scene |
| CN116032894A (en) * | 2022-12-30 | 2023-04-28 | 杭州西软计算机工程有限公司 | Method and device for TCP session reassembly |
| CN116032894B (en) * | 2022-12-30 | 2025-09-05 | 杭州西软计算机工程有限公司 | A method and device for TCP session reorganization |
| CN117812068A (en) * | 2024-01-05 | 2024-04-02 | 湖北安博通科技有限公司 | SMB protocol file restoration method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112583936B (en) | 2022-09-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112583936A (en) | Method for recombining transmission conversation flow | |
| US8792360B2 (en) | Duplicate packet suppression | |
| WO2008067743A1 (en) | A pattern matching method and apparatus | |
| TW201501556A (en) | Apparatus and method for uniquely enumerating paths in a parse tree | |
| Jayasumana et al. | Improved packet reordering metrics | |
| CN113328915B (en) | An SRv6-based measurement method of the associated network | |
| EP3900269A1 (en) | Hardware-friendly mechanisms for in-band oam processing | |
| CN112468365A (en) | Data quality detection method, system and medium for network mirror flow | |
| CN106685862B (en) | Fragmented data packet processing method and device | |
| EP3422643A1 (en) | Method and apparatus for sending message | |
| CN112929239B (en) | Detection method for resetting TCP link by firewall | |
| CN115913910A (en) | Method and device for determining message transmission path fault | |
| CN110401513B (en) | Data transmission method and device | |
| US20040148417A1 (en) | Method and system for distinguishing higher layer protocols of the internet traffic | |
| CN106411924A (en) | Method of building session forwarding entry, and method and device for forwarding message | |
| CN106789446B (en) | Node peer-to-peer cluster distributed test system and method | |
| CN111641729A (en) | Inter-domain path identification prefix conflict detection and decomposition method based on prefix tree | |
| CN104660636B (en) | Point-to-point application identifying processing method and apparatus | |
| Khin et al. | Reducing packet-in messages in OpenFlow networks | |
| JP4320433B2 (en) | Overlay link calculation device, calculation method thereof, and program | |
| CN112491655B (en) | Method and device for determining TCP transmission exception type, electronic equipment and storage medium | |
| Liu | Verification of the SIP transaction using coloured petri nets | |
| CN116915608A (en) | Configuration information checking methods, equipment, and storage media | |
| CN109547389B (en) | Code stream file recombination method and device | |
| CN113067819A (en) | Distributed asynchronous parallel detection algorithm for multi-path attack of MPTCP (Multi-path Transmission control protocol) |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Reconstructing the method of transmitting session flow Granted publication date: 20220909 Pledgee: Industrial and Commercial Bank of China Limited Shanghai Zhabei sub branch Pledgor: Shanghai Yuewei Science and Technology Co.,Ltd. Registration number: Y2025980036017 |
|
| PE01 | Entry into force of the registration of the contract for pledge of patent right |