HTTP bypass blocking method based on dpdk

Abstract

The present invention relates to a DPDK-based HTTP bypass blocking method, which also includes the following steps: S1: deploying a DPDK system operating environment on a switch; S2: establishing a filter rule library; S3: configuring a blocking port on the switch; S4: calling the DPDK system The api interface reads the data message of the network port; S5: intercept the field of the data message obtained in the step S4, and calculate the hash value according to the intercepted field, and search the filter rule base according to the hash value index and perform the field value Contrast, if the comparison is the same, then the blocking port sends the blocking message, if the comparison is different, then discard the data message and continue to read the next data message. The present invention can solve the problem of using DPI packet processing technology in the prior art. If the time is too long, the blocking message is replied before the server responds, and the blocking success rate is as high as 99.99%.

Description

technical field [0001] The invention relates to the technical field of communication networks, in particular to a DPDK-based HTTP bypass blocking method. Background technique [0002] Most of the existing hardware is deployed in series. On the main link of the network, by directly auditing the passing traffic, analyzing the DNS of the request or matching the ACL policy, and discarding the hit request packet directly, so as to block effect. In the prior art, bypass hardware is also used for blocking. By identifying the first request packet of the three-way handshake of the mirrored data TCP, when the blocking rule is hit, a forged Reset packet is sent to the server and the client. The link is disconnected. At present, the bypass hardware is used for deployment. The bypass hardware device needs to perform DPI (deep packet inspection) on the mirrored data packets, extract the quintuple requested by the data packets, and pass the extracted destination IP To forge the Reset pac...

AI Technical Summary

Problems solved by technology

In the prior art, bypass hardware is also used for blocking. By identifying the first request packet of the three-way handshake of the mirrored data TCP, when the blocking rule is hit, a forged Reset packet is sent to the server and the client. The link is disconnected. At present, the bypass hardware is used for deployment. The bypass hardware device needs to perform DPI (deep packet inspection) on the mirrored data packets, extract the quintuple requested by the data packets, and pass the extracted destination IP To forge the Reset packet, but it takes too long to use DPI in this way. When the forged Reset packet is returned to the server and the client, the client has already received the response from the server and established a connection, resulting in a high failure rate of blocking , especially the existing DPI technology package processing performance is limited, when faced with the large flow of data processing in the IDC computer room, it is easy to cause failure

Images