CN102739473B - Network detection method applying intelligent network card - Google Patents

Abstract

A network detection method applying intelligent network card, the intelligent network card is connected in series at the exit of local area network or small enterprise network and stores ACL rule, firstly, network card management module is adopted to issue quintuple ACL rule of server end to intelligent network card storage module; then, the intelligent network card receives the network data and carries out stream restoration processing on the network data; and in a data processing module of the intelligent network card, matching the processed message with the existing ACL rule in the storage module, and taking corresponding actions of discarding, transmitting, labeling, sending the message or sending a log. The invention gives the analysis and detection actions of the server on the network data to the intelligent network card for processing, effectively reduces the burden of a background server CPU, provides various standard compatible interfaces, enables the existing related network processing programs to seamlessly use the intelligent network card, and further exerts the advantages of the intelligent network card on the analysis and detection of the network data. The method is suitable for various scenes such as network detection and the like.

Description

A network detection method using intelligent network card

technical field

The invention relates to the application field of network detection, in particular to a network detection method using an intelligent network card.

Background technique

In the local area network or small enterprise network, a series of intranet attacks such as ARP spoofing, IP spoofing, false IP, IP fragmentation, false MAC, oversized Ping packets, wrongly formatted data, excessive packet sending frequency, etc. Disconnected, stuck, etc. These intranet attacks are common in the network. The common detection method is that the network detection software on the background server scans the content of the IP packets entering and leaving the subnet, and matches the sensitive information according to the characteristic string, so as to judge whether the data packet is legal information. This network detection method undoubtedly increases the burden on the CPU of the background server and reduces system performance. When the network peak occurs, the application cannot quickly process the received data, resulting in the consequence of network card data discarding; at the same time, when the intruder splits sensitive information When it is divided into multiple IP fragments, the detection software cannot parse out illegal information from a single IP packet.

Contents of the invention

The purpose of the present invention is to use the software on the backstage server to detect the network information received by the network card in the network detection of local area network or small enterprise network. The burden of the existing backstage server CPU is heavy, the system performance is poor, and the application program cannot be processed quickly. Receiving data, network card data is easy to discard and illegal information cannot be detected from IP fragmentation. In order to effectively control and prevent the spread of bad information and the leakage of confidential information, complete network content detection of LAN or small enterprise network information, A network detection method for an intelligent network card is proposed. The smart network card performs IP fragmentation reorganization and TCP flow reorganization on the received data, and then preprocesses the network data incoming to the server according to the stored ACL rules and the DPI function, and directly detects protocol viruses, etc. on the smart network card. The network attack packet is intercepted and controlled, and the detection range is extended to the network entrance and exit of the LAN or small enterprise network, which realizes the analysis and detection function of network data, reduces the CPU burden of the server, and improves the system performance.

Technical scheme of the present invention is:

A network detection method using a smart network card, storing ACL rules in the smart network card, the network detection method comprising the following steps:

A. Use the network card management module to send the quintuple ACL rules on the server side to the smart network card storage module;

B. The smart network card receives network data, and performs IP fragment reassembly and TCP stream reassembly on the received data;

C. In the data processing module of the smart network card, match the received message with the existing ACL rules in the storage module, and take corresponding actions of discarding, transparent transmission, labeling, sending a message or sending a log.

The smart network card of the present invention includes a storage module, a data processing module and a data transceiver module; the storage module is used to store ACL rules; the data transceiver module is used to realize the data receiving and sending from the smart network card to the network; the data processing module realizes the received report The text is matched with the existing ACL rules after IP fragmentation reorganization and TCP flow reorganization; the data processing module is connected with the corresponding signal end of the storage module and the data transceiver module;

The server end is configured with a network card management module and a smart network card driver module; the network card management module is used to realize the operation of adding, deleting and querying the smart network card ACL rules; the smart network card driver module is used to realize data reception from the smart network card to the server end and send.

The intelligent network card of the present invention also includes a DPI module, which is used to detect the deep packet of the received data.

The intelligent network card of the present invention provides various standard or special programming interfaces, and opens the function of network data analysis and detection of the intelligent network card to the upper layer software of the server.

In step C of the present invention:

If the discarding action is adopted, the intelligent network card will ignore the packet adopting the discarding action according to the ACL rule;

If the transparent transmission action is adopted, the specified data message adopting the transparent transmission action is uploaded to different stream buffers of the background server, and then different threads of the upper-layer software read data from the corresponding stream buffers and send the data to multiple Go to the data queue of a thread;

If the labeling action is adopted, the smart network card will mark the packets matching the rules according to the requirements of the ACL rules and upload them to the server;

If the action of sending packets is adopted, the iNIC will act according to the matching ACL rules and send packets with the TCP flag.

If the action of sending logs is adopted, the iNIC will act according to the matching ACL rules and send log packets to the log server.

The quintuple of the present invention refers to: source IP address, destination IP address, IP protocol number, source port number of TCP/UDP, destination port number of TCP/UDP.

Beneficial effects of the present invention:

The network detection method of the smart network card of the present invention, in this method, the analysis and detection action of the network data by the server is handed over to the smart network card for processing, and the network attack packet is directly intercepted and controlled on the smart network card, and the detection range is extended to the end of the network , improve business management, make the network controllable, manageable, and preventable, and can effectively reduce the background server CPU burden; at the same time, it provides a variety of standard-compatible interfaces including custom dedicated interfaces and libpcap, libnet, libnids, etc. , can make the existing relevant network processing programs seamlessly use the smart network card, realize functions such as capturing and analyzing network data packets, and further exert the advantages of the smart network card in analyzing and detecting network data. This method can be used for network detection and many other kinds of places.

Description of drawings

Fig. 1 is a schematic diagram of the smart network card data analysis and detection of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

As shown in Figure 1, a kind of network detection method of smart network card, store ACL rule in described smart network card, network detection method comprises the following steps:

A. Use the network card management module to send the quintuple ACL rules on the server side to the smart network card storage module;

B. The smart network card receives network data, and performs IP fragment reassembly and TCP stream reassembly on the received data;

C. In the data processing module of the smart network card, match the received message with the existing ACL rules in the storage module, and take corresponding actions of discarding, transparent transmission, labeling, sending a message or sending a log;

If the discarding action is adopted, the intelligent network card will ignore the packet adopting the discarding action according to the ACL rule;

If the transparent transmission action is adopted, the specified data message adopting the transparent transmission action is uploaded to different stream buffers of the background server, and then different threads of the upper-layer software read data from the corresponding stream buffers and send the data to multiple Go to the data queue of a thread;

If the labeling action is adopted, the smart network card will mark the packets matching the rules according to the requirements of the ACL rules and upload them to the server;

If the action of sending packets is adopted, the iNIC will act according to the matching ACL rules and send packets with the TCP flag.

If the action of sending logs is adopted, the iNIC will act according to the matching ACL rules and send log packets to the log server.

The smart network card of the present invention includes a storage module, a data processing module and a data transceiver module; the storage module is used to store ACL rules; the data transceiver module is used to realize the data receiving and sending from the smart network card to the network; the data processing module realizes the received report The text is matched with the existing ACL rules after IP fragmentation reorganization and TCP flow reorganization; the data processing module is connected with the corresponding signal end of the storage module and the data transceiver module;

The server end of the present invention is configured with a network card management module and a smart network card driver module; the network card management module is used to realize the operation of adding, deleting and querying the ACL rules of the smart network card; the smart network card driver module is used to realize data reception from the smart network card to the server end and send.

The intelligent network card of the present invention also includes a detection module, which is used to detect the deep packet of the received data. Deep packet inspection not only analyzes the content below layer 4 of IP packets, including source address, destination address, source port, destination port and protocol type, but also adds application layer analysis to identify various applications and their contents.

The intelligent network card of the present invention provides various standard or special programming interfaces, and opens the function of network data analysis and detection of the intelligent network card to the upper layer software of the server.

When implementing it:

A network detection method for a smart network card. The smart network card can perform IP fragmentation reorganization and TCP flow reorganization on received IP packets according to existing algorithms, and then according to basic protocols such as IP, TCP, and UDP of the TCP/IP protocol family and port To analyze the data packet, so as to judge the network information flow, the route passed, the size of the data packet, the content of the data packet and so on.

The smart network card internally provides a deep packet inspection function for received data.

The smart network card driver customizes a set of network card management tools in the user space to implement operations such as adding, deleting and querying ACL rules for the smart network card. The method comprises the steps of:

In step 101, the user sends the five-tuple ACL rule to the memory of the smart network card by using the network card management tool provided by the smart network card. The quintuple refers to: source IP address, destination IP address, IP protocol number, TCP/UDP source port number, and TCP/UDP destination port number.

In step 103, the smart network card matches the received message with the existing rules, and takes actions such as discarding, transparent transmission, labeling, sending a message, and sending a log;

In step 104, the intelligent network card ignores the message that adopts the discarding action according to the ACL rule;

In step 105, the specified data message of the transparent transmission action is uploaded to the background server, and the data is distributed to the data queue of the required thread;

A message with a TCP flag can be sent according to the requirements of the ACL rule (step 106);

Can act according to the matching ACL rule, send the log message to the log server (step 107);

The smart network card encapsulates standard API interface functions in the server user space, maximizing the open function of the smart network card, and at the same time, further provides support for various standard compatible interfaces such as libpcap, libnet, libnids, etc., and realizes existing related Network handlers seamlessly use the SmartNIC.

Use the dedicated interface of the smart network card or libpcap, libnet, libnids and other tools to maximize the use of the smart network card's IP fragmentation reorganization, TCP data reorganization, ACL rule filtering, DPI and other functions to achieve data capture processing, filtering processing and structure data packets Preprocessing of outgoing and other data packets.

When the network card programming interface is used to realize the packet capture function of the smart network card, the smart network card sends the data evenly to each thread of the multi-thread processing server through the network card interface according to the requirements of load balancing according to the data preprocessing requirements of the server. When the network card programming interface is used to realize the intelligent network card filtering function, according to the rules issued by the network card driver, actions such as transparent transmission and discarding of qualified data streams are performed according to the rules.

The parts not involved in the present invention are the same as the prior art or can be realized by adopting the prior art.

Claims (4)

1. apply a network detecting method for intelligent network adapter, it is characterized in that described intelligent network adapter is serially connected with local area network (LAN) or small-scale intranet exit, transparent transmission is done to all packets, simultaneously to by way of flow carry out analyzing and detect; Comprise the following steps:

The five-tuple acl rule of server end is issued in intelligent network adapter memory module by A, employing network interface card administration module;

B, intelligent network adapter receiving network data, and IP fragmentation restructuring and TCP flow restructuring are carried out to the data received;

C, in the data processing module of intelligent network adapter, the message reduced through overcurrent to be mated with acl rule existing in memory module, and take to abandon accordingly, transparent transmission, label, send message or send the action of daily record;

Described five-tuple refers to: the destination slogan of the protocol number of source IP address, object IP address, IP, the source port number of TCP/UDP, TCP/UDP;

Intelligent network adapter does protocal analysis and fragment restructuring the IP packet received, and then does the Protocol State Analysis of TCP layer and the splicing of packet;

In step C:

If adopt and abandon action, intelligent network adapter is ignored adopting the message abandoning action according to acl rule;

If adopt transparent transmission action, background server is uploaded to not in homogeneous turbulence buffering by adopting the data message of specifying of transparent transmission action, then the different threads of upper layer software (applications) reads data again from the stream of correspondence buffering, and data is sent in the data queue of multiple thread and goes;

If adopt the action that labels, intelligent network adapter requires to mark the message of hit rule according to acl rule, and the end that uploaded onto the server;

Send message action if adopted, intelligent network adapter, according to the acl rule action of coupling, sends the message with TCP mark;

Send diary action if adopted, intelligent network adapter, according to the acl rule action of coupling, sends daily record message to log server.

2. the network detecting method of application intelligent network adapter according to claim 1, is characterized in that:

Described intelligent network adapter comprises memory module, data processing module and data transmit-receive module; Memory module is for storing acl rule; Data transmit-receive module is for realizing the digital received and sent of intelligent network adapter to network; With the mating of existing acl rule after data processing module realizes the message received being carried out IP fragmentation restructuring and TCP flow restructuring;

Described server end configuration network interface card administration module and intelligent network adapter driver module; Network interface card administration module is for realizing the operation of interpolation to intelligent network adapter acl rule, deletion and query function; Intelligent network adapter driver module is for realizing the digital received and sent of intelligent network adapter to server end.

3. the network detecting method of application intelligent network adapter according to claim 1, is characterized in that, described intelligent network adapter also comprises DPI module, for detecting the deep layer bag receiving data.

4. the network detecting method of application intelligent network adapter according to claim 1, it is characterized in that, described intelligent network adapter provides multiple standards or special DLL (dynamic link library), by the function opening of intelligent network adapter network data analysis, detection to server end upper layer software (applications), upper layer software (applications) can catch bag analysis to the data of the portal.