WO2017118416A1 - Method and apparatus for realizing message error detection - Google Patents

Abstract

Disclosed are a method and apparatus for realizing message error detection, the method comprising: caching, according to pre-set periods, an inbound message and an outbound message which are captured in real time and transmitted by a detected network; and matching parts, which shall not change, in the inbound message and the outbound message which are cached in a first pre-set period and a second pre-set period, and determining a message which is not matched successfully in the first pre-set period to be a message with an error, wherein the first pre-set period is adjacent to the second pre-set period, and the first pre-set period is earlier than the second pre-set period. The method of the present invention realizes the detection of a message with an error in real-time transmission messages by caching, according to pre-set periods, an inbound message and an outbound message which are captured in real time and matching parts which shall not change.

Description

Method and device for realizing message error detection Technical field

The present invention relates to the field of data communications, and more particularly to a method and apparatus for implementing packet error detection.

Background technique

Network devices of a wide variety and quantity in networks such as carrier networks, enterprise networks, and Internet networks, such as broadband remote access server (BRAS) devices, access/core router devices, and access/core switch devices , three-layer switch equipment and various optical network equipment. These network devices run IP network protocols and build a world based on IP network protocols by interconnecting them. When a packet is transmitted over a network device, part of the packet field should not be changed. In the case of packet transmission, a packet error may occur. Taking the enterprise network as an example, assume that there are area A, area B, and area A. The communication link with area C, the communication link between area A and area B, the packet field that should not change due to the IP link problem such as high packet loss rate of the router or switch, system problem, etc. in area A and area A change occurs during transmission between B, causing a message error and affecting normal communication. The above system problem may be caused by the failure of the system software or hardware, or the external environment affecting the system performance (such as electromagnetic interference) and other factors affecting the normal transmission of the message. If the message field that should not be changed is changed, for example, the IP address field is modified, the message will be delivered to the wrong destination address, and finally discarded as a bad packet, affecting the normal communication of the network.

When the network size is small, after an error packet is found, it can be judged by experienced technicians whether the network device may have problems. Restart the network device that may be faulty, reconnect the network, or replace the network device. And other methods to solve the problem of packet error. When the network size is increased to a certain extent, it is very difficult to determine whether the packet has an error. The accuracy of the judgment based on the error packet based on the experience of the network device is greatly reduced. One attempt, and each attempt may cause a complete network interruption, affecting the normal communication of the network. Especially for large-scale Internet networks, it is particularly difficult to determine the error of a message.

Summary of the invention

In order to solve the above technical problem, the present invention provides a method and apparatus for implementing packet error detection, which can determine whether an error occurs in a message when the network size is increased.

In order to achieve the object of the present invention, the present invention provides a method for implementing packet error detection, including:

The real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period buffer;

The inbound and outbound packets buffered in the first preset period and the second preset period are matched, and the unmatched packets in the first preset period are determined to be generated. Wrong message;

The first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset cycle.

Optionally, after the real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period, the method further includes:

The cached inbound and outbound packets are classified according to a preset policy.

Optionally, the type division according to the preset policy specifically includes:

The buffered inbound packet and the outgoing packet type are divided according to the source address, and/or the destination address, and/or the source port, and/or the destination port.

Optionally, classifying according to a preset policy specifically includes:

After adding the buffered inbound or outbound packet source address, and/or destination address, and/or source port, and/or destination port, the number of types is divided into divisors. And dividing the cached inbound message and the outgoing message into corresponding categories according to different modulo calculation results; or

The value of the source address, the destination address, the source port, and the destination port of the buffered inbound packet or the outgoing packet is calculated, and the number of types is divided into divisors to perform modulo calculation, according to different modulo calculation results. The inbound and outgoing packets of the cache are classified into corresponding categories.

Optionally, the transform value calculation includes: a hash calculation or a message digest algorithm fifth edition md5 calculation.

Optionally, matching the inbound and outbound packets in the inbound and outbound packets specifically includes:

Matching should not be made in the incoming message and the outgoing message in each of the classified categories.

Optionally, before determining that the unmatched packet in the first preset period is a packet with an error, the method further includes:

And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network.

Optionally, the method further includes:

Pre-establishing an analysis unit consisting of a server, and/or configured processes, and/or configured threads;

The matching of the changed parts should not occur in the inbound message and the outgoing message of one or more kinds of allocations assigned to each analysis unit.

Optionally, the matching of the inbound and outbound packets of the one or more types of the inbound and outbound packets that are allocated to each of the analyzing units is not specifically:

According to the load of each analysis unit, the matching of the incoming part of the corresponding number of types and the change of the outgoing part of the outgoing message is determined.

Optionally, matching the inbound packet with the non-change portion of the outgoing packet specifically includes:

Matching the content of the incoming message in the incoming message with the content of the outgoing message that should not change; or

Extracting, in the inbound message, a feature value of the content of the change portion and a feature value of the content of the outgoing message that should not change;

And extracting, in the extracted inbound message, the feature value of the content that should not be changed, and the extracted feature value of the content of the outgoing message that should not change.

On the other hand, the application further provides an apparatus for implementing packet error detection, comprising: a buffer unit and a matching unit; wherein

a cache unit, configured to cache an inbound message and an outgoing message transmitted by the detected network in real time according to a preset period;

The matching unit is configured to match the inbound packet buffered in the first preset period and the second preset period with the unchanged portion in the outgoing packet, and determine that the first preset period is not successfully matched. The message is an error message;

The first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period.

Optionally, the device further includes a category dividing unit, configured to cache the inbound packet and the outgoing packet according to the preset period, after the real-time capture of the inbound packet and the outgoing packet transmitted by the detected network. Set the strategy to classify.

Optionally, the matching unit is specifically used,

For each type of division, the inbound and outbound packets buffered in the first preset period and the second preset period are not matched, and the first preset period is not determined. A packet that matches successfully is a packet with an error.

Optionally, the device further includes a filtering unit, configured to filter the outgoing message actively sent by the detected network before the matching unit determines that the packet that is not successfully matched in the first preset period is an error packet. And an inbound message sent to the detected network.

Optionally, the apparatus further includes a building and allocating unit, configured to pre-establish an analysis unit composed of a server, and/or configured processes, and/or configured threads;

The matching of the changed parts should not occur in the inbound message and the outgoing message of one or more kinds of allocations assigned to each analysis unit.

Compared with the prior art, the technical solution of the present application includes: capturing, according to a preset period, a real-time capture of an inbound message and an outgoing message transmitted by the detected network; and the first preset period and the second preset period. The inbound and outbound packets of the cache are not matched, and the packets that are not matched in the first preset period are the packets that have failed. The first preset period and the second one. The preset periods are adjacent, and the first preset period is earlier than the second preset period. The method of the invention realizes the detection of the error message in the real-time transmission message by buffering the inbound message and the outgoing message in real time according to a preset period and matching the portion that should not be changed.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a method for implementing packet error detection according to the present invention;

FIG. 2 is a structural diagram of an apparatus for implementing packet error detection according to the present invention.

3 is a flow chart of a method according to a first embodiment of the present invention;

4 is a flow chart of a method in accordance with a second embodiment of the present invention.

detailed description

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

FIG. 1 is a flowchart of a method for implementing packet error detection according to the present invention. As shown in FIG. 1, the method includes:

Step 100: The real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period cache;

It should be noted that the preset period is set according to the speed of the packet transmitted by the detected network. Generally, the preset period is the length of time required for the detected network to transmit a packet, and can be obtained by transmitting a specific test packet. In addition, the first and second preset periods are only a relative concept. When the error message is determined in the first preset period, the first preset period buffers the incoming message. The error detection of the message with the outgoing message has ended. At this time, the original second preset period is updated to the new first preset period, and the next preset period of the original second preset period is updated to new. The second preset period.

After the real-time capture of the inbound and outbound packets transmitted by the detected network is performed according to the preset period, the method of the present invention further includes:

The cached inbound and outbound packets are classified according to a preset policy.

It should be noted that, since the incoming message and the outgoing message have no change part, when the type is divided, the matched incoming message and the outgoing message are necessarily in one category.

The classification according to the preset policy includes:

The division of the incoming inbound message and the outgoing message type according to the source address, and/or the destination address, and/or the source port, and/or the destination port.

Preferably, the classification according to the preset policy specifically includes:

After adding the buffered inbound or outbound packet source address, and/or destination address, and/or source port, and/or destination port, the number of types is divided into divisors. According to different modulo calculation results, the buffered inbound message and the outgoing message are classified into corresponding categories; or

The value of the source address, the destination address, the source port, and the destination port of the inbound packet or the outgoing packet is calculated. The number of the type is used as the divisor to perform the modulo calculation. The cache is calculated according to the result of the modulo calculation. The incoming message and the outgoing message are classified into corresponding categories.

Further, the transformation value calculation includes: a hash calculation or a message digest algorithm fifth edition (md5) calculation.

Step 101: Matching the inbound packets and the outgoing packets in the first preset period and the second preset period are not changed, and determining that the first preset period has not been successfully matched. The text is wrong The message; here, the first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period.

Matching the changes that should not occur in the incoming message and the outgoing message specifically includes:

Matching should not be made in the incoming message and the outgoing message in each of the divided categories.

Matching the inbound message with the non-change part of the outgoing message specifically includes:

Matching the content of the inbound message that should not change with the content of the outgoing message that should not change; or,

Extracting feature values of content that should not change in the incoming message and feature values of content that should not change in the outgoing message;

The feature value of the content of the extracted inbound message that should not be changed is matched with the feature value of the content of the extracted outgoing message that should not change.

Before determining that the unmatched packet in the first preset period is a packet with an error, the method of the present invention further includes:

Filtering outgoing packets sent by the detected network and incoming packets sent to the detected network.

The method of the invention further comprises:

Pre-establishing an analysis unit consisting of a server, and/or configured processes, and/or configured threads;

The matching of the changed parts should not occur in one or more kinds of inbound messages and outgoing messages assigned to each analysis unit.

Preferably, the matching of the one or more types of inbound packets and the outgoing packets that are allocated to each analysis unit to be changed does not include:

According to the load of each analysis unit, it is determined that the matching units allocated to the respective analysis units for the corresponding number of types and the matching portions of the outgoing messages should not be changed.

The method of the invention realizes the detection of the error message in the real-time transmission message by buffering the inbound message and the outgoing message in real time according to a preset period and matching the portion that should not be changed. Further, the detection of the error packet improves the accuracy of the network device failure handling of the packet error caused by the large-scale network.

2 is a structural diagram of an apparatus for implementing packet error detection according to the present invention. As shown in FIG. 2, the method includes: a buffer unit and a matching unit;

a cache unit, configured to cache an inbound message and an outgoing message transmitted by the detected network in real time according to a preset period;

The matching unit is configured to match the inbound packet buffered in the first preset period and the second preset period with the unchanged portion in the outgoing packet, and determine that the first preset period is not successfully matched. The message is an error message;

The first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period.

The matching unit is specifically used,

The incoming packets and outgoing packets buffered in the first preset period and the second preset period should not change.

Matching the content of the inbound message that should not change with the content of the outgoing message that should not change; or,

Extracting feature values of content that should not change in the incoming message and feature values of content that should not change in the outgoing message;

Matching the feature value of the content of the extracted inbound message that should not be changed to the feature value of the content of the extracted outgoing message that should not change part;

The packet that is not matched successfully in the first preset period is determined to be the packet with the error.

The device of the present invention further includes a category dividing unit, configured to cache the inbound packet and the outgoing packet transmitted by the detected network according to the preset period, and then cache the inbound packet and the outgoing packet according to a preset policy. Type division.

The categorization unit is configured to cache the inbound packet and the outgoing packet according to the source address and/or the destination address after the real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period. And/or source port, and/or destination port are classified.

Preferably, the category dividing unit is specifically configured to:

The source address, and/or the destination address, and/or the source port of the inbound packet or the outgoing packet, which are buffered, after the inbound packet and the outgoing packet transmitted by the detected network are captured in real time according to the preset period. And performing the modulo calculation by using the number of types as the divisor, and dividing the buffered inbound message and the outgoing message into corresponding categories according to different modulo calculation results; or

The value of the source address, the destination address, the source port, and the destination port of the inbound packet or the outgoing packet is calculated. The number of the type is used as the divisor to perform the modulo calculation. The cache is calculated according to the result of the modulo calculation. The incoming message and the outgoing message are classified into corresponding categories.

The matching unit is specifically used,

For each type of division, the inbound and outbound packets buffered in the first preset period and the second preset period are not matched, and the first preset period is not determined. The packet matching the packet is the one with the error.

The device of the present invention further includes a filtering unit, configured to: before the matching unit determines that the unmatched packet in the first preset period is a packet with an error, filtering the outgoing packet actively sent by the detected network and sending the detected packet to the detected packet. Inbound message of the network.

The apparatus of the present invention further includes a construction and distribution unit for pre-establishing an analysis unit consisting of a server, and/or configured processes, and/or configured threads;

The matching of the changed parts should not occur in one or more kinds of inbound messages and outgoing messages assigned to each analysis unit.

The construction and distribution unit is specifically used,

Pre-establishing an analysis unit consisting of a server, and/or configured processes, and/or configured threads;

According to the load of each analysis unit, it is determined that the matching units allocated to the respective analysis units for the corresponding number of types and the matching portions of the outgoing messages should not be changed.

The method of the present invention will be described in detail below by way of specific examples, which are merely intended to illustrate the invention and are not intended to limit the scope of the invention.

Example 1

In this embodiment, when the packet is detected, the detected network may be a network composed of one or more network devices, and the network device may be a router or a switch. In this embodiment, the inbound packet and the outgoing packet transmitted by the detected network are used. The capture and cache are performed in real time, and the information about the time attribute and the flow of the packet is also recorded when the incoming message and the outgoing message are buffered. FIG. 3 is a flowchart of a method according to a first embodiment of the present invention. As shown in FIG. 3, the method includes:

As shown in FIG. 3, this embodiment specifically includes the following steps.

In step 300, the inbound packet and the outgoing packet transmitted by the detected network are captured in real time;

Step 301: Cache the inbound packet and the outgoing packet of the detected network that is captured in real time according to a preset period.

Step 302: Perform the type division of the buffered inbound message and the outgoing message according to a preset policy.

It should be noted that, for a packet that has not been erroneously detected by the detected network, it is assumed that the packet P is P1 when it enters the detected network, and is captured when the incoming packet is captured; When the type is P2, the type of the incoming packet and the outgoing packet of the packet P are in the same category.

The type division in this embodiment can be implemented in the following manner:

After adding the buffered inbound or outbound packet source address, and/or destination address, and/or source port, and/or destination port, the number of types is divided into divisors. According to different modulo calculation results, the buffered inbound message and the outgoing message are classified into corresponding categories; or

The value of the source address, the destination address, the source port, and the destination port of the inbound packet or the outgoing packet is calculated. The number of the type is used as the divisor to perform the modulo calculation. The cache is calculated according to the result of the modulo calculation. The incoming message and the outgoing message are classified into corresponding categories. Here, the transform value calculation includes: a hash calculation or a message digest algorithm fifth edition (md5) calculation.

Step 303: Matching, in each of the divided categories, the inbound packets and the outgoing packets in the first preset period and the second preset period are not changed, and determining the first preset period. A packet that has not been successfully matched is a packet with an error. Here, the first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period.

It should be noted that the inbound packet and the outgoing packet can be distinguished in the caching process. In addition, the length of time required for the message to flow from the inbound to the outbound network is a preset period, so the outgoing message matching the incoming message in the first preset period must be in the first preset period or second. During the preset period, if there is no outgoing message matching the incoming message in the first preset period in the first and second preset periods, the message is checked. An error occurred while measuring network transmission.

In this embodiment, the matching between the incoming packet and the outgoing packet that should not be changed may be implemented by the following preferred manner:

The embodiment pre-establishes an analysis unit composed of a server, and/or a configured process, and/or a configured thread;

The matching of the changed parts should not occur in one or more kinds of incoming and outgoing messages divided by each analysis unit.

Specifically, according to the load of each analysis unit, it is determined that each of the analysis units performs matching of the corresponding number of types of inbound messages and outgoing messages in which no change occurs. For example, the embodiment includes an analysis unit 1, an analysis unit 2, and an analysis unit 3; wherein the analysis unit 1 is composed of a separate physical server, and the analysis unit 2 and the analysis unit 3 are configured by two threads configured on another physical server, and analyzed. The performance and memory of unit 2 and analysis unit 3 can be configured according to the number of division types and the number of various types of packets in accordance with the experience of those skilled in the art. In this embodiment, if it is divided into four categories, the analysis unit 1 should theoretically perform matching of two types of inbound messages and outgoing messages in which no change occurs; the analyzing unit 2 and the analyzing unit 3 respectively perform one The matching of the changed part should not occur in the incoming message and the outgoing message of the type; if there are many types of division, after assigning the type of division to each analysis unit, the type of the new division can be based on the load of the analysis unit. Load balancing is performed. Of course, a person skilled in the art can also establish a new analysis unit for matching the incoming part of the newly classified type and the unchanged part of the outgoing message. The load status can be feedbacked in real time or periodically by the analysis unit, or by setting an alarm threshold, and actively feedback when the alarm threshold is exceeded.

It should be noted that, when a packet is transmitted through a network device, the change does not change from the incoming network device to the outgoing network device, and the content does not change, that is, if the link does not occur on the network, the incoming packet is sent. The message field that should not change in the middle part of the message field and the message field that should not change in the outgoing message part are the same. When the matching content is consistent, the message is determined to have no error; for example, the network is assumed. If the message transmitted by the device should not change, the content of the message is [0x10, 0x20, 0x30]. If the device that detects the error of the packet obtains an incoming message, the content of the change should not be [0x10, 0x20, 0x30]; the device for error detection of the packet determines that the packet does not have an error according to the matching of the incoming message and the outgoing message; in this embodiment, if the message should not change, the part occurs during the transmission. If the change is made, for example, the obtained outgoing message becomes [0x10, 0x20, 0x31]. At this time, the device that detects the error of the message cannot match the same outgoing direction as the incoming message should not change. Wen, determine packet error has occurred. The packet field of the packet that does not change when the network device is transmitted may be different, and may be determined according to common knowledge of those skilled in the art. The changed message field refers to the change without changing. The content of the packet field part, such as the TTL field of the IP packet, is legally modified by the network device during transmission (for example, a router for the network device at this time).

The matching between the incoming message and the outgoing message should not be changed. The content of the incoming message should not be changed, and the content of the outgoing message should not be changed.

The matching between the incoming message and the outgoing message should not be changed. The feature value can be extracted separately after the change should not be made in the incoming message and the change should not be made in the outgoing message. The feature value extracted in the packet should not match the feature value extracted in the outgoing packet, and the feature value extracted from the outgoing packet can be improved.

It should be noted that, in the process of class division and subsequent matching, the message captured in this embodiment may be directly performed by using the extracted feature value (a value obtained by hash calculation or a value obtained by md5 calculation), and the extracted feature value includes Message length, and/or source address, and/or destination address, and/or source port, and/or destination port, and/or message distinguishing field, and the like.

Before determining that the unmatched packet in the first preset period is the packet with the error, the embodiment further includes: filtering the outgoing packet actively sent by the detected network and the inbound packet sent to the detected network.

Example 2

In this embodiment, an analysis unit composed of a server, and/or a configured process, and/or a configured thread is established in advance; it is assumed that the previously classified types of packets have been allocated according to the performance and load of each analysis unit. This embodiment assumes that a new type is generated according to the method of class division. FIG. 4 is a flowchart of a method according to a second embodiment of the present invention. As shown in FIG. 4, the method includes:

Step 400: The buffered inbound packet and the outgoing packet are classified according to a preset policy to generate a new category.

Step 401: Acquire a load state of each analysis unit, and assign the newly generated category to an analysis unit according to the load device.

The load status of the analysis unit may include: CPU usage, memory usage, and may also include the number of cached unmatched messages.

In this embodiment, the corresponding load threshold of each analysis unit can be set. When the analysis unit load reaches the load threshold, it is not necessary to acquire the load status of the analysis unit.

Step 402: If the analysis unit receives the inbound packet and the outgoing packet of the newly generated type, the load is too large, and then rejects the received incoming packet and the outgoing packet of the newly generated type;

In step 403, the newly generated category is newly assigned to a newly confirmed analysis unit.

It should be noted that the load of the analysis unit may be periodically or triggered by feedback, or may be obtained by query. The analysis unit can also actively feedback when the load is reduced (for example, some types of messages have been matched, or the number of message buffers of the type is reduced) and the load exceeds a certain range. The load information of the analysis unit can be obtained in time.

The modules or units in the message error detecting apparatus provided by the embodiments of the present application may pass through one or more digital signal processors (DSPs), application specific integrated circuits (ASICs), processors, microprocessors, controllers, and micro-controls. Implemented by a field, programmable array (FPGA), programmable logic device, or other electronic unit, or any combination thereof. Some of the functions or processes described in this application embodiment may also be implemented by software executing on a processor.

Industrial applicability

The invention relates to the field of data communication, which realizes the error message in the real-time transmission message by buffering the inbound message and the outgoing message in real time according to a preset period and matching the portion that should not be changed. Detection.

While the embodiments of the present invention have been described above, the described embodiments are merely for the purpose of understanding the invention and are not intended to limit the invention. Any modification and variation in the form and details of the embodiments may be made by those skilled in the art without departing from the spirit and scope of the invention. The scope defined by the appended claims shall prevail.

Claims (15)

A method for implementing packet error detection, including: The real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period buffer; The inbound and outbound packets buffered in the first preset period and the second preset period are matched, and the unmatched packets in the first preset period are determined to be generated. Wrong message; The first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period. The method of claim 1, wherein the method further comprises: after the real-time capture of the inbound packet and the outgoing packet transmitted by the detected network according to the preset period, the method further comprises: The cached inbound and outbound packets are classified according to a preset policy. The method according to claim 2, wherein the classifying according to the preset policy comprises: The buffered inbound packet and the outgoing packet type are divided according to the source address, and/or the destination address, and/or the source port, and/or the destination port. The method according to claim 2 or 3, wherein the classifying according to the preset policy comprises: After adding the buffered inbound or outbound packet source address, and/or destination address, and/or source port, and/or destination port, the number of types is divided into divisors. And dividing the cached inbound message and the outgoing message into corresponding categories according to different modulo calculation results; or The value of the source address, the destination address, the source port, and the destination port of the buffered inbound packet or the outgoing packet is calculated, and the number of types is divided into divisors to perform modulo calculation, according to different modulo calculation results. The inbound and outgoing packets of the cache are classified into corresponding categories. The method of claim 4, wherein the transform value calculation comprises: a hash calculation or a message digest algorithm fifth edition md5 calculation. The method according to any one of claims 2 to 5, wherein the matching between the incoming message and the outgoing message in which the change does not occur includes: Matching should not be made in the incoming message and the outgoing message in each of the classified categories. The method according to any one of claims 1 to 5, wherein before the determining that the unmatched packet in the first preset period is a packet with an error, the method further includes: And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network. The method according to any one of claims 1 to 5, wherein the method further comprises: Pre-establishing an analysis unit consisting of a server, and/or configured processes, and/or configured threads; The matching of the changed parts should not occur in the inbound message and the outgoing message of one or more kinds of allocations assigned to each analysis unit. The method according to claim 8, wherein the matching of the one-to-one message and the outgoing message of the one or more kinds of the divided units that are allocated to each analysis unit should not change: According to the load of each analysis unit, the matching of the incoming part of the corresponding number of types and the change of the outgoing part of the outgoing message is determined. The method according to any one of claims 1 to 5, wherein matching the incoming message with the non-changeable part of the outgoing message comprises: Matching the content of the incoming message in the incoming message with the content of the outgoing message that should not change; or Extracting, in the inbound message, a feature value of the content of the change portion and a feature value of the content of the outgoing message that should not change; And extracting, in the extracted inbound message, the feature value of the content that should not be changed, and the extracted feature value of the content of the outgoing message that should not change. An apparatus for implementing packet error detection, comprising: a buffer unit and a matching unit; wherein The cache unit is configured to cache the inbound packet and the outgoing packet transmitted by the detected network in real time according to the preset period; The matching unit is configured to match the inbound and outbound packets buffered in the first preset period and the second preset period, and not to change, to determine that the first preset period is not successfully matched. The message is an error message; The first preset period is adjacent to the second preset period, and the first preset period is earlier than the second preset period. The device according to claim 11, wherein the device further comprises a category dividing unit, configured to cache the inbound message and the outgoing message transmitted by the detected network according to the preset period, and then cache the incoming report. The text and outgoing packets are classified according to the preset policy. The apparatus according to claim 12, wherein said matching unit is configured to For each type of division, the inbound and outbound packets buffered in the first preset period and the second preset period are not matched, and the first preset period is not determined. A packet that matches successfully is a packet with an error. The device according to any one of claims 11 to 13, wherein the device further comprises a filtering unit, configured to: before the matching unit determines that the unmatched message in the first preset period is a packet with an error, And filtering an outgoing packet sent by the detected network and an incoming packet sent to the detected network. Apparatus according to any one of claims 11 to 13, wherein the apparatus further comprises a construction and distribution unit arranged to pre-establish an analysis unit consisting of a server, and/or configured processes, and/or configured threads; The matching of the changed parts should not occur in the inbound message and the outgoing message of one or more kinds of allocations assigned to each analysis unit.

Images