CN100454900C - Method and system for quickly responding to IP fragmentation packets - Google Patents

Abstract

The present invention relates to a method for rapidly responding an IP fragment message, which comprises the steps that an IP sending end sends the IP fragment message; an IP destination end receives the IP fragment message, and judges whether the IP fragment message needs a direct response; when the IP fragment message needs the direct response, the IP destination end immediately sends response information to the IP sending end on a network layer; when the IP fragment message does not need the direct response, the IP destination end recombines the IP fragment message. The response time to the IP fragment message is shortened for satisfying the very high real-time requirement of response processing by the response processing of the IP fragment message. Because the IP sending end is not responded after recombination on the IP destination end, the recombination overhead of the response time is reduced, and simultaneously, the possibility of attack suffering caused by establishing a recombination queue is reduced.

Description

Method and system for quickly responding to IP fragmentation packets

technical field

The invention relates to message processing technology in network communication, in particular to a method and system for quickly responding to IP fragment messages.

Background technique

When transmitting data in the network, the physical network layer generally limits the maximum length of each data frame sent. Whenever the IP (Internet Protocol, network protocol) layer receives an IP message to be sent, it determines which interface to send data to locally, and queries the interface to obtain its MTU (Maximum Transmission Unit, maximum transmission unit). At the IP layer, the MTU of the receiving interface is compared with the length of the IP packet to be sent, and the IP packet is fragmented as needed, and divided into several IP fragmented packets, that is, except the last piece of The size of a fragment packet reaches the transmission capacity of the MTU.

The destination interface is reassembled, that is, reassembled, only after all IP packet fragments constituting a complete IP packet arrive. Reassembly is done by the IP layer at the destination, and its purpose is to make the fragmentation and reassembly process transparent to the transport layer.

The data contained in the IP fragmentation header provides enough information for fragmentation and reassembly:

For example, the IP fragmentation message structure of IPV4 (Internet Protocol version 4, the fourth generation network protocol) is shown in Figure 1: the first 20 bytes are the IP basic header, and the following fields are used for the identification, sign, slice offset, etc.

For each piece of IP fragment message sent by the sender, its identification field contains a unique value, and this value is copied into each piece of IP fragment message when the message is fragmented.

The flag field uses one of the bits (bit) to indicate that the IP message to be fragmented is divided into more fragments. Except for the last fragment, this bit must be set to 1 for other IP fragmented messages.

The fragment offset field refers to the position where the IP fragment packet is offset from the beginning of the original IP packet.

After the IP packet is fragmented, the total length value of each IP fragmented packet should be changed to the length value of the fragmented packet.

Finally, there is a bit in the flag field called the "don't fragment" bit. If this bit is set to 1, IP will not fragment the datagram. If the message should be discarded, an ICMP (Internet Control Message Protocol, Network Control Information Protocol) error message to the sender of the IP message.

After the IP message is fragmented, each piece becomes an IP fragment message, has its own IP basic header, and is independent from other IP fragment messages when routing. When the IP fragmented message arrives at the IP destination, it may be out of order, but there is enough information in the IP header to allow the receiving end to correctly assemble these IP fragmented messages.

The fragmentation reassembly process of the message is shown in Figure 2: the IP destination end receives the IP fragmentation message, hangs it in the reassembly queue according to the identification field of the IP basic header, and waits for the rest of the fragmentation messages. When all IP fragmented packets are collected in the reassembly queue, the packet will be reassembled into an original IP packet according to the flag and fragment offset field of each fragmented packet, and handed over to the transport layer for processing .

The existing technology may not meet the requirements for some services that have high requirements on real-time response processing.

For example: when the IP destination needs a quick response service, the IP destination reassembles the fragments of the IP packet, and after the reassembly is completed, it responds to the assembled original IP packet, which occupies a large amount of resources during reassembly. The time cannot meet the needs of rapid response. In particular, the IP destination adopts a distributed structure. Different IP fragmented packets may reach different interface boards of the IP destination. Reassembly needs to be transmitted between boards, which further affects the real-time performance of response processing.

For example: in the distributed structure shown in FIG. 3 , the packet reassembly process. The IP destination is composed of interface board 1, interface board 2, and the main control board. The first IP fragment message and the third IP fragment message arrive at interface board 2, and the second IP fragment message arrives at the interface board. 1. In order to achieve reassembly, all IP fragmented messages are delivered to the main control board for centralized reassembly. In this case, in addition to the time-consuming reassembly, the transfer between boards also takes a certain amount of time.

Contents of the invention

The problem to be solved by the present invention is to provide a method and system for quickly responding to IP fragmented messages, shorten the response time to IP fragmented messages, and meet real-time requirements.

For realizing above object, technical scheme of the present invention is realized like this:

A method for quickly responding to IP fragmentation packets, including:

The IP sender sends the IP fragment message;

The IP destination end receives the IP fragment message, and judges whether the IP fragment message needs to respond directly, and if so, the IP destination end immediately sends response information to the IP sender at the network layer; otherwise, the IP destination end The IP destination end reassembles the IP fragmented message.

The IP fragment message is: an IP fragment message with reserved fields in the extended basic message header or an IP fragment message with protocol type information.

After the IP destination end receives the IP fragment message, it also includes steps:

The IP destination parses the IP fragment message to obtain the value of the reserved field or the protocol type information.

The reserved field in the extended message header uses a specified value to identify whether to respond directly;

The protocol type information includes: Network Control Message Protocol, Transmission Control Protocol or User Datagram Protocol.

Before the network layer immediately sends the response information to the IP sender, it further includes the step of modifying the information in the IP fragment message.

Described revising the information in this IP fragmentation message specifically comprises steps:

directly exchanging the source address and destination address of the IP fragment message;

modifying the fragmentation identification field of the basic header in the IP fragmentation message to be a local fragmentation identification, wherein, using a linear function algorithm, calculating the fragmentation identification field of the basic header in the IP fragmentation message to obtain the local Fragment ID;

Adjust the checksum of the IP fragment message.

Described modification this IP fragmentation message specifically comprises steps:

Modifying the time-to-live TTL of the basic header in the IP fragmentation message is the specified TTL;

For the first IP fragment message, modify the load content in the IP fragment message;

For the non-first IP fragment message, it is judged according to the application whether the IP payload content needs to be modified, and if modification is required, the IP payload content in the IP fragment message is modified.

The response information is the modified IP fragment message information.

For the IP fragment message that needs to respond directly, the IP destination end further fragments the IP fragment message for a second time according to the fragmentation condition of the sent message.

The present invention also provides a system for quickly responding to IP fragmentation messages, including: IP sending end: used to send IP fragmentation messages; IP destination end: connected to the IP sending end, receiving the IP fragmentation Fragment message, and reassemble the received IP fragment message;

The IP destination also includes,

Message processing module: analyze the IP fragment message, and judge whether the IP fragment message needs to respond directly;

Response module: connected with the message processing module, when the message processing module judges that the IP fragment message needs to respond directly according to the analysis of the IP fragment message, it immediately sends the response information to the IP at the network layer end.

The judging whether the IP fragment message needs a direct response is judging by acquiring the value of the reserved field or the protocol type information.

The response module specifically includes:

Message modifying unit: directly exchange the source address and destination address of the IP fragment message, modify the fragment identification field of the basic header in the IP fragment message to be a local fragment identification, and adjust the IP fragment The checksum of the message, modifying the TTL of the basic header of the IP fragment message is the specified TTL, and modifying the load content in the IP fragment message;

Message return unit: receive the modified IP fragment message, and send the modified IP fragment message to the IP sender.

The present invention improves the response time to the IP fragment message by processing the response to the IP fragment message, and satisfies the high real-time requirement of the response processing; since there is no need to wait for all the fragment messages at the destination Respond when both are reached, thus reducing the reorganization overhead of the system; at the same time, the destination end of the network responds to the sending end in real time, and the possibility of being attacked due to the establishment of a reorganization queue.

Description of drawings

FIG. 1 is the IP fragmentation packet structure of IPV4 in the prior art.

Fig. 2 is the process of IP packet fragment reassembly in the prior art.

FIG. 3 is the reassembly process of IP fragmented packets in the distributed structure in the prior art.

Fig. 4 is a flow chart of quick response IP fragmentation message in the present invention.

FIG. 5 is a flowchart of another quick response IP fragmentation message in the present invention.

Fig. 6 is a structural block diagram of the response system of the IP fragment message in the present invention.

Fig. 7 is a structural block diagram of the response module in the present invention.

Detailed ways

In the business that requires high real-time response processing, after the network layer of the IP destination waits for all IP fragmented packets to arrive, the transport layer responds to the reassembled IP packets, which may not meet the real-time requirements, especially Because the IP destination adopts a distributed structure, different fragments may reach different interface boards at the destination, and recombination needs to be transferred between boards, which further affects the real-time performance of response processing.

The present invention provides a method for quickly responding to an IP fragment message, the core of which includes: the IP destination terminal receives the IP fragment message, determines that the IP fragment message needs a direct response, and immediately sends the IP fragment message at the network layer. The fragment message response information is sent to the IP sender, which improves the real-time performance of the response.

As shown in Figures 1 and 4, it is the IPV4 packet structure and the steps used in the specific principle of the response to the IP fragment message in IPV4:

Step 401, the IP sender sends an IP fragment packet with an identifier.

When the IP fragment message is the first fragment message, the message includes message protocol information in the IP payload content, which is used to determine whether to immediately respond to the IP fragment message.

For example: TCP (Transfer Control Protocol, Transmission Control Protocol), ICMP and other messages need to directly respond to the IP sender; and UDP (User Datagram Protocol, User Datagram Protocol) and other messages do not need to directly respond to the IP sender.

Described IP fragmentation message uses the reserved bit in the extended flag bit as the mark of whether to respond to the IP sender immediately, as shown in Figure 1, wherein uses the reserved bit in the 3 flag bits in the above-mentioned figure, expands this reserved bit as: when When the value of the reserved bit is 0, it means that the IP fragment message needs to be reassembled before responding; when the value of the reserved bit is 1, it means that the IP sender needs to be responded immediately without reassembly; at the same time, it can also be used as the value of the reserved bit When it is 1, it means that the IP fragment message needs to be reassembled before responding; when the value of the reserved bit is 0, it means that no reassembly is required and the IP sender needs to be responded immediately.

Step 402, after receiving the IP fragment message, the IP destination terminal judges whether the IP fragment message needs to respond directly, and the specific methods include:

a) According to the information carried in the IP basic header, determine the bearer protocol type, such as the protocol (Protocol) field in the IPv4 basic header or the next header (Next) in the IPv6 (Internet Protocol Version 6, sixth-generation network protocol) basic header. Header) field.

b) For the first IP fragment message, determine whether to directly respond to the fragment message because it contains protocol type information.

c) When the IP fragment message is not the first piece of IP fragment message, analyze the IP fragment to obtain the value of the reserved field in the flag bit, to identify whether this piece of fragment message will respond immediately without reassembly .

Step 403, if it is determined that the fragment does not respond directly, the IP destination end stores the fragmented message and waits for reassembly.

Step 404, if it is determined that the fragment responds directly, directly modify the fragment packet as the response content.

a) Directly exchange the source and destination addresses of the received IP fragment message, or specify other source addresses, thereby modifying the source address and destination address of the IP basic header.

b) Modify the TTL of the IP basic header, specifying the required TTL.

c) Modify the fragment identification field of the IP basic header to be a local fragment identification, and use an existing algorithm such as a linear function algorithm to calculate the fragment identification of the received message to obtain a local fragment identification.

d) It is also possible to modify other IP basic header fields, such as the service category field, if necessary.

e) For the first IP fragment message, because it also includes: part of the IP payload content, such as TCP/UDP or application data other than the IP header content, the corresponding IP payload content can be modified.

f) For non-first IP fragments, whether to modify the IP payload content depends on the specific application, for example: for the application of the command ping, no modification is required; for the application of the command tracert, it needs to be modified, if the IP can be identified The content carried in the fragmented packet can also be modified.

g) Adjust the checksum of the modified response IP fragment message without recalculating the entire IP header.

Adjust the new checksum according to the content before modification and the content after modification, and modify the content of the transport layer may also need to adjust the checksum.

Step 405: After the IP fragmented message is modified, the IP destination end directly responds to the IP sender end.

The IP destination responds immediately to the IP sender at the network layer.

The IP sender can reassemble the response information according to the standard process, and can also directly return it to the IP destination.

In the present invention, in order to improve the reliability processing, the fragmented message can also choose to recombine the IP fragmented message at the destination end while responding directly.

In the present invention, the fragmented message that is directly responded to by the IP destination end continues to be fragmented in order to meet the fragmentation condition of the IP destination end for sending the message: directly use the fragmentation of the fragmented message before the second fragmentation. Fragment identification field, while adjusting the fragment flag bit and fragment offset field, as well as the total length field.

The above description mainly takes IPv4 as an example. Due to the similarity between IPv6 and IPv4, the present invention is also applicable to IPv6 fragment response processing.

The following concrete description present invention responds to the IPV4 fragmentation message that has ICMP protocol once concrete implementation process:

Step 4001, the IP sender sends a fragmented message.

Step 4002: After receiving the IP fragment message, the IP destination terminal determines whether the IP fragment message needs to respond directly.

a) The packet is judged to be an IPV4 packet according to the protocol field in the header of the fragmented packet.

b) Analyzing the protocol type information in the header of the fragmented message, obtaining ICMP, and determining that the message requires a direct response.

Step 4003, directly modify the response content of the fragmented message.

a) Directly exchange the source and destination addresses of the received IP fragments.

b) Modify the TTL of the IP basic header, and specify the required TTL, which can be 1 second, 2 seconds, etc.

c) modifying the fragment identifier field of the IP basic header to a local fragment identifier, and calculating the local fragment identifier of the fragment identifier of the received message through an algorithm.

d) Modify other IP basic header fields, such as the 8-bit service type field shown in FIG. 1 .

e) Adjust the checksum of the modified response IP fragment message without recalculating the entire IP header.

Step 4004, after the IP fragmented message is modified, the IP destination end directly responds to the IP sender end.

The IP destination responds immediately to the IP sender at the network layer.

The present invention also provides a method for quickly responding to the IP fragment message. The IP destination end receives the IP fragment message sent by the IP sender, and immediately responds to the IP sender at the network layer.

Below in conjunction with accompanying drawing 5, specifically illustrate the step of IPV4 message response:

Step 501, the IP sender sends an IP fragment packet.

When the IP fragment message is the first fragment message, the message includes the IP payload content including message protocol information, which is used to determine to immediately send the IP fragment message response information to the IP sender.

For example, packets such as TCP and ICMP need to directly respond to the IP sender.

Described IP fragmentation message uses the reserved field in the extended flag bit as the mark of whether to respond to the IP sender immediately, as shown in Figure 1, wherein uses the reserved bit in the 3 flag bits in the above-mentioned figure, expands this reserved bit as: use If the value of the reserved bit is 1, it means that there is no need to reassemble and the response information needs to be sent to the IP sender immediately; at the same time, when the value of the reserved bit is 0, it means that the IP fragment message does not need to be reassembled and then sent immediately. The network layer sends a response message to the IP sender.

Step 502, the IP destination end receives the IP fragmented message.

The bearer protocol type is determined according to the information carried in the basic IP header, for example, the protocol field in the basic IPv4 header or the next header field in the basic IPv6 header.

Step 503, modifying the IP fragmentation message as response information, and sending it to the IP sending end.

a) Directly exchange the source and destination addresses of the received IP fragment message, or specify other source addresses, thereby modifying the source address and destination address of the IP basic header.

b) Modify the TTL of the IP basic header, specifying the required TTL.

c) modifying the fragment identification field of the IP basic header to a local fragment identification, using an existing algorithm, such as a linear function algorithm, to local fragment identification of the fragment identification of the received message.

d) It is also possible to modify other IP basic header fields, such as the service category field, if necessary.

e) For the first IP fragment message, because it also includes: part of the IP payload content, such as TCP/UDP or application data other than the IP header content, the corresponding IP payload content can be modified.

f) For non-first IP fragments, whether to modify the IP payload content depends on the specific application, for example: for the application of the command ping, no modification is required; for the application of the command tracert, it needs to be modified, if the IP can be identified The content carried in the fragmented packet can also be modified.

g) Adjust the checksum of the modified response IP fragment message without recalculating the entire IP header.

Step 504: After the IP fragmented message is modified, the IP destination end directly responds to the IP sender end.

The IP destination responds immediately to the IP sender at the network layer.

In the present invention, in order to improve reliability processing, the IP destination end can also choose to recombine the received IP fragment message while directly responding to the IP sender end.

In the present invention, the fragmented message that is directly responded to by the IP destination end continues to be fragmented in order to meet the fragmentation condition of the IP destination end for sending the message: directly use the fragmentation of the fragmented message before the second fragmentation. Fragment identification field, while adjusting the fragment flag bit and fragment offset field, as well as the total length field.

The above description mainly takes IPv4 as an example. Due to the similarity between IPv6 and IPv4, the present invention is also applicable to IPv6 fragment response processing.

A response system for an IP fragment message, comprising: an IP sender: used to send an IP fragment message; an IP destination end: connected to the IP sender, receiving the IP fragment message, and reorganizing message; the IP destination also includes,

Message processing module: analyze the IP fragment message, and judge whether the IP fragment message needs to respond directly;

Response module: connected to the message processing module, when it is determined that a direct response is required, the response information is immediately sent to the IP sender at the network layer.

The judging whether the IP fragment message needs a direct response is judged by obtaining the value of the reserved field or the type information of the transport layer protocol.

The response modules include:

Message modifying unit: directly exchange the source address and destination address of the IP fragment message, modify the fragment identification field of the basic header in the IP fragment message to be a local fragment identification, and adjust the IP fragment The checksum of the message, modifying the TTL of the basic header of the IP fragment message is the specified TTL, and modifying the load content in the IP fragment message;

Message return unit: receive the modified IP fragment message, and send the modified IP fragment message to the IP sender.

The technical effect of the present invention: through the response processing to IP fragmentation message, shorten the response time to IP fragmentation message, satisfy the real-time requirement of response processing very high requirement; Respond to the IP sender, reduce the reorganization overhead of the response time; at the same time reduce the possibility of being attacked due to the establishment of a reorganization queue.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (12)

1, a kind of method of quick responding IP banding message is characterized in that, comprising:

The IP transmitting terminal sends the IP fragmentation message;

The IP destination receives described IP fragmentation message, judges whether described IP fragmentation message needs direct response, if described IP destination sends response message to described IP transmitting terminal immediately in network layer; Otherwise, the described IP destination described IP fragmentation message of recombinating.

2, method according to claim 1 is characterized in that, described IP fragmentation message is: the IP fragmentation message of reserved field or have the IP fragmentation message of protocol type information in this heading of expansion base.

3, method according to claim 2 is characterized in that, described IP destination receives described IP fragmentation message and also comprises step afterwards:

The IP destination is resolved described IP fragmentation message, obtains the value or the protocol type information of described reserved field.

4, method according to claim 3 is characterized in that, whether directly reserved field uses the response of designated value sign in the described amplifying message head; Described protocol type information comprises: network control messaging protocol, transmission control protocol or User Datagram Protoco (UDP).

5, method according to claim 1 is characterized in that, describedly sends response message immediately in network layer also comprised step before described IP transmitting terminal: revise the information in this IP fragmentation message.

6, method according to claim 5 is characterized in that, the information in this IP fragmentation message of described modification specifically comprises step:

Directly exchange the source address and the destination address of described IP fragmentation message;

The segmental identification field of revising in the described IP fragmentation message basic header is local segmental identification, wherein, uses the linear function algorithm, and the segmental identification of basic header in the described IP fragmentation message is calculated local segmental identification;

Adjust described IP fragmentation message verification and.

7, method according to claim 5 is characterized in that, this IP fragmentation message of described modification specifically comprises step:

The life span TTL that revises basic header in the described IP fragmentation message is the TTL of appointment;

For first IP fragmentation message, revise the load content in the described IP fragmentation message;

For non-first IP fragmentation message, judge whether needs modification IP load content according to applicable cases, if need to revise, then the load of the IP in described IP fragmentation message content is made amendment.

8, method according to claim 5 is characterized in that, described response message is amended IP fragmentation message information.

According to any described method in the claim 1 to 8, it is characterized in that 9, the described IP fragmentation message that described IP destination directly responds for needs according to the burst condition that sends message, also carries out the secondary burst to described IP fragmentation message.

10, a kind of system of quick responding IP banding message comprises: the IP transmitting terminal: be used to send the IP fragmentation message; The IP destination: be connected with described IP transmitting terminal, receive described IP fragmentation message, and the IP fragmentation message of recombinating received; It is characterized in that described IP destination also comprises,

Message processing module (MPM): resolve described IP fragmentation message, judge whether this IP fragmentation message needs direct response;

Respond module: be connected with message processing module (MPM), when described message processing module (MPM) directly responds according to these IP fragmentation message needs of analysis judgment to described IP fragmentation message, send response message immediately to the IP transmitting terminal in network layer.

11, system according to claim 10 is characterized in that, describedly judges whether this IP fragmentation message needs directly response for to judge by value or the protocol type information of obtaining reserved field in this heading of expansion base.

12, system according to claim 11 is characterized in that, described respond module specifically comprises:

Message is revised the unit: the source address and the destination address that directly exchange described IP fragmentation message, the segmental identification field of revising basic header in the described IP fragmentation message is local segmental identification, adjust described IP fragmentation message verification and, the TTL that revises the basic header of described IP fragmentation message is the TTL of appointment, revises the load content in the described IP fragmentation message;

Message loopback cell: receive amended IP fragmentation message, send and revise back IP fragmentation message to the IP transmitting terminal.

Images