TWI664841B - Network packet side recording device capable of transmitting across networks and data processing method thereof - Google Patents

Abstract

The invention relates to a network packet recording device capable of transmitting across networks and a data processing method thereof, which are mainly composed of a network transmission device having more than one network recording interface and a group of network transmission interfaces. It is connected to the network equipment and Internet of the side recording target. The network side recording interface group will process the packet data recorded to generate the encrypted compressed file, and send the processed encrypted compressed file to the remote device or environment. Analyze; by setting up the network transmission device within an Ethernet network, perform real-time packet recording and compression encryption processing, and use the network transmission interface to transmit to the Internet, breaking through existing recording equipment Transmission distance limitation (referred to in the intranet), has long distance, cross-domain, and improves the convenience of packet acquisition, and achieves the purpose of real-time packet aggregation analysis.

Description

Network packet side recording device capable of transmitting across networks and data processing method thereof

The invention relates to a network device and a data processing method thereof, and more particularly to a network packet recording device and a data processing method capable of transmitting across a network.

In the current prior art, in order to obtain network packets (ie, packet recording) and perform network analysis, the network technology architecture used when performing network packet capture is usually SPAN (Switch Port Analysis) and TAP (Test Access Point), but SPAN and TAP are limited to the intranet (internal Internet), but the technology is changing rapidly. Nowadays, the network environment has various cloud environments besides the intranet, especially when there is a need for big data analysis. Network packet capture across multiple domains or clouds is sent to network devices for analysis. However, after collecting network packets in the prior art, they are limited to the intranet. Domain, not real-time, inefficient analysis of data aggregation.

On the other hand, the current commonly used SPAN network technology architecture cannot accurately determine the scale, nor can it monitor filtered irregular error packets, and there is a problem of inaccurate data obtained by the packets. The TAP network technology architecture is currently A more popular network data acquisition scheme, but it is limited to use in the intranet and can only see one link at a time; as shown in Figure 6, it is a known TAP network technology architecture, which is mainly composed of a device body 80 is connected to Ethernet through a group of network ports 81 to record the packet traffic passing through a pick-up terminal, and then send the copied packets to a network analysis device through a group of port 82 90.

From the above, it can be known that the methods for capturing and transmitting network packets in the prior art, whether it is software or hardware, are limited to the intranet, and the captured network packets cannot be transmitted through the Internet. ) To remote devices, so there are problems such as the inability to obtain long-distance, cross-domain, inaccurate, inaccurate, and inefficient data integration analysis of data, which is a problem for current big data analysis needs. Insufficient, so the need for a better solution is indeed to be proposed in terms of the prior art.

In view of the above-mentioned shortcomings of the prior art, the main object of the present invention is to provide a network packet skimming device and a data processing method that can be transmitted across the network. Organize, and then send the collated data to remote analysis through the Internet. It has long distance, cross-domain, and improves the convenience of packet acquisition to achieve the purpose of real-time packet aggregation analysis.

The main technical means adopted to achieve the above purpose is to make the data processing method of the aforementioned network packet skimming device that can be transmitted across the network, mainly by a network transmission device providing a sending end, a pick-up terminal, and the network The transmission device executes the following steps: receiving the packet data traffic recorded on the side; processing the data; and transmitting the processed data to a remote end through the Internet for analysis.

According to the above method, the network transmission device performs data processing on the packet data recorded on the receiving side, and then transmits the processed data to the remote end for analysis, and the network transmission device is set up on the Ethernet. Real-time packet data processing between roads has long distances, cross-domains, and improves the convenience of packet acquisition, achieving the purpose of real-time packet aggregation analysis.

Another technical means adopted to achieve the foregoing purpose is to make the aforementioned network packet recording device capable of transmitting across the network include: more than one network recording interface, having a sending end and a pick-up terminal, and passing through the pick-up terminal The packet data will be skimmed, and the packet data will be forwarded to the sender at the same time; a network transmission device is connected to the group of network side recording interfaces to process the sidelined packet data; the network transmission device further includes a compression Module and a transmission module, the compression module performs a compression process and encryption processing on the packets to generate more than one encrypted compression file, and the transmission compression module transmits the encrypted compression file; a group of networks The transmission interface is a transmission module connected to the network transmission device, and transmits the encrypted compressed file to a remote analysis device for analysis.

According to the above structure, by setting up the network transmission device in any Ethernet network, it performs real-time packet recording and compression and encryption processing, and uses this set of network transmission interfaces to transmit to the Internet, breaking through the existing The transmission distance limitation of the side recording device (referred to in the intranet) has long distance, cross-domain and improves the convenience of packet acquisition, and achieves the purpose of real-time packet aggregation analysis.

For a preferred embodiment of a network packet recording device capable of being transmitted across networks of the present invention, please refer to FIGS. 1, 2, and 3, which are mainly transmitted by a network transmission device 10 through more than one network recording interface. 11 is connected with the network equipment of the side recording target. The network transmission device 10 further includes a compression module 12 connected to a transmission module 13. The transmission module 13 is connected to a group of network transmission interfaces 14. The network transmission device 10 is connected to the Internet through the network transmission interface 14; in this embodiment, the network transmission interface 14 refers to an Internet transmission port, and the network transmission port may be a 1GB / 10GB network Port or a 4G LTE USB mobile network card.

In this embodiment, the group of network side recording interfaces 11 provides a pick-up terminal and a sending terminal; the packet data of the group of network side recording interfaces 11 passing through the pick-up terminal will be skimmed, and the packet data will be forwarded to the sending side at the same time. The compression module 12 of the transmission device 10 processes the packets. In the preferred embodiment, a compression process and an encryption process are performed to generate more than one encrypted compressed file, and the transmission module 13 The network transmission interface 14 transmits the processed data (such as the encrypted compressed files) to a remote analysis device 20 for analysis through the Internet; by transmitting the network transmission device 10 are set up in any Ethernet network to perform real-time packet recording and compression encryption, and use this group of network transmission interface 11 to transmit to the Internet, breaking the transmission distance limitation of existing recording equipment (referring to the intranet Medium), with long distance, cross-domain, and improve the convenience of packet acquisition, to achieve the purpose of real-time packet aggregation analysis.

The characteristics of the compression processing program in this comparative embodiment are highly common and high compression ratio. In this comparative embodiment, the compression processing program has a compression ratio, and the compression ratio may be "1:10"; further In the preferred embodiment, the format of the encrypted compressed file includes a gzip format, a bz2 format, a zip format, or a tar format.

In this comparative embodiment, the compression module 12 may further provide an encryption processing program and a tag processing program. The encryption processing program is mainly used to encrypt the encrypted compressed file, and the tag processing program is mainly used to encrypt the encrypted file. The compressed file is subjected to tag processing, and a tag (Tag) is assigned to the encrypted compressed file. In this comparative embodiment, the encryption processing program includes an RSA encryption algorithm, an ADS encryption algorithm, or an ISA encryption algorithm.

In the present invention, the network transmission device 10 compresses the packets through the compression module 12 to generate the encrypted compression file, and the transmission compression module 13 transmits the encrypted compression file, which is then transmitted by the network. The interface 14 sends the processed compressed compressed file to the analysis device 20 for analysis through the Internet, which can indeed achieve the goals of cross-domain, improving the accuracy of packet acquisition, and real-time packet aggregation analysis.

According to the content of the above-mentioned preferred embodiment of the present invention, a data processing method of a network packet recording device that can be transmitted across the network can be further summarized. Please refer to FIG. 2, which is provided by the network transmission device 10 The pick-up terminal and the send-end, and the network transmission device 10 perform the following steps: receive the packet data traffic recorded by the pick-up terminal (S10), and perform a copy of the record; copy the copied records The data is processed. In this comparative embodiment, a compression processing program and encryption processing are performed to generate more than one encrypted compressed file (S11); in this comparative embodiment, the characteristics of the compression processing program are highly common, High compression rate, which can reduce the bandwidth load during Internet transmission. In this comparative embodiment, the compression processing program has a compression rate, which can be "1:10"; further, in the preferred embodiment The format of the encrypted compressed file includes a gzip format, a bz2 format, a zip format, or a tar format; the encrypted compressed files are transmitted to a remote end for analysis through the Internet (S1) 2).

Further, when the above steps are performed to the step of "performing a compression processing procedure and encryption processing on the copied data, to generate more than one encrypted compressed file (S11)", please refer to FIG. 3, The method further includes the following steps: performing encryption processing and / or marking processing on the encrypted compressed file (S110); in the preferred embodiment, when the foregoing step performs "encrypting the encrypted compressed file", then The encryption method includes an RSA encryption algorithm, an ADS encryption algorithm, or an ISA encryption algorithm; when the above-mentioned step is performed "mark the encrypted compressed file", a tag information is given to the encrypted compressed file ( Tag) is used to record the source to avoid transmission interruption of the encrypted compressed file during transmission.

With the above method of a preferred embodiment of the present invention, the network transmission device 10 performs compression processing and encryption processing on most of the received data to generate most encrypted compressed files, and then transmits the encrypted compressed files through the Internet. Perform remote packet analysis by setting up the network transmission device 10 between the Ethernet networks for real-time packet data processing, compared with the SPAN (Switch Port Analysis) commonly used in existing network technology architectures. ) As far as TAP (Test Access Point) is concerned, although TAP can obtain 100% network packets, it is limited to an environment that can only monitor the intranet (internal Internet), and cannot capture network packets across domains or clouds. It is also impossible to perform real-time aggregate analysis of network packets. The present invention can not only perform 100% network packet capture across network domains, but also has the most real-time aggregate analysis capability of network packets.

10‧‧‧ Network Transmission Device

11‧‧‧Network recording interface

12‧‧‧ Compression Module

13‧‧‧Transmission Module

14‧‧‧ Network Delivery Interface

20‧‧‧analysis equipment

FIG. 1 is a block diagram of a system architecture according to a preferred embodiment of the present invention. FIG. 2 is a block diagram of another system architecture according to a preferred embodiment of the present invention. FIG. 3 is a block diagram of another system architecture according to a preferred embodiment of the present invention. FIG. 4 is a flowchart of a data processing method according to a preferred embodiment of the present invention. FIG. 5 is a flowchart of an encryption program according to a preferred embodiment of the present invention. Figure 6 shows a known TAP network technology architecture.

Claims (6)

A data processing method for a network packet skimming device that can be transmitted across networks. A network transmission device mainly provides a pick-up terminal and a sending end, and the network transmission device performs the following steps: Packet data traffic; processing the data; transmitting the processed data to a remote end for analysis via the Internet; when the above steps are performed to the step of "processing the data", the method further includes The following steps: the data is subjected to a compression processing program and encryption processing to generate more than one encrypted compressed file, the compression processing program has a compression rate, and the encrypted compressed file has a format; when the above steps are performed until "the The data is subjected to a compression process and an encryption process to generate more than one encrypted compressed file. The method further includes the following step: encrypting and / or marking the encrypted compressed file. The data processing method for a network packet skimming device that can be transmitted across the network as described in claim 1, the above encryption method includes an RSA encryption algorithm, an ADS encryption algorithm, or an ISA encryption algorithm; Executing the "tag processing of the encrypted compressed file", a tag information is given to the encrypted compressed file. A network packet recording device capable of transmitting across networks, comprising: a set of more than one network recording interface, having a sending end and a pick-up terminal, and packet data passing through the pick-up terminal will be skimmed and forwarded at the same time Data to the sending end; a network transmission device is connected to the network side recording interface to process the packet data recorded on the side; the network transmission device further includes a compression module and a transmission module, the compression module The group performs a compression processing procedure and encryption processing on the packets to generate more than one encrypted compression file, and transmits the encrypted compression file by the transmission module, wherein the compression module further provides a label processing program, The encrypted compressed file is given a tag information; a set of network transmission interface is a transmission module connected to the network transmission device, and the encrypted compressed file is transmitted to a remote analysis device for analysis. The network packet recording device according to claim 3, wherein the format of the encrypted compressed file includes a gzip format, a bz2 format, a zip format, or a tar format. The network packet skimming device as described in claim 3, wherein the compression processing program has a compression rate. The network packet recording device according to claim 3, wherein the compression module further provides an encryption processing program, which includes an RSA encryption algorithm, an ADS encryption algorithm, or an ISA encryption algorithm .