DPDK-based HTTP bypass blocking method

Abstract

The invention relates to a DPDK-based HTTP bypass blocking method. The method comprises following steps of S1: deploying DPDK system operation environment on a switch; S2: establishing a filtering rule library; S3: configuring a blocking opening in the switch; S4: calling an api port of the DPDK system and reading a data report of an internet accesses and S5: intercepting fields from the data report acquired in the S4, according to the intercepted fields, calculating Hash values, according to Hash value indexes, searching a filtering rule library, carrying out field value comparison, if the fields values are the same, sending blocking report through the blocking port, if the fields values are different, abandoning the data report and continuously reading the next data repot. According to the invention, a problem that the consumed time is too long by use of the DPI pack processing technology in the prior art can be solved; the blocking report is replied before the service end gives responses; and the blocking success rate reaches 99.99%.

Description

technical field [0001] The invention relates to the technical field of communication networks, in particular to a DPDK-based HTTP bypass blocking method. Background technique [0002] Most of the existing hardware is deployed in series. On the main link of the network, by directly auditing the passing traffic, analyzing the DNS of the request or matching the ACL policy, and discarding the hit request packet directly, so as to block effect. In the prior art, bypass hardware is also used for blocking. By identifying the first request packet of the three-way handshake of the mirrored data TCP, when the blocking rule is hit, a forged Reset packet is sent to the server and the client. The link is disconnected. At present, the bypass hardware is used for deployment. The bypass hardware device needs to perform DPI (deep packet inspection) on the mirrored data packets, extract the quintuple requested by the data packets, and pass the extracted destination IP To forge the Reset pac...

AI Technical Summary

Problems solved by technology

In the prior art, bypass hardware is also used for blocking. By identifying the first request packet of the three-way handshake of the mirrored data TCP, when the blocking rule is hit, a forged Reset packet is sent to the server and the client. The link is disconnected. At present, the bypass hardware is used for deployment. The bypass hardware device needs to perform DPI (deep packet inspection) on the mirrored data packets, extract the quintuple requested by the data packets, and pass the extracted destination IP To forge the Reset packet, but it takes too long to use DPI in this way. When the forged Reset packet is returned to the server and the client, the client has already received the response from the server and established a connection, resulting in a high failure rate of blocking , especially the existing DPI technology package processing performance is limited, when faced with the large flow of data processing in the IDC computer room, it is easy to cause failure

Images