Method and device for extracting generated data of regression test or pressure test

Abstract

Provided are a method and device for extracting generated data of a regression test or a pressure test in the technical field of information security. The method comprises the following steps of acquiring plurality of packet files by capturing packets of data to be extracted; analyzing each packet file to obtain analyzed data and parameters on a plurality of zone bits; and finally, extracting application layer data corresponding to each session from the analyzed data in combination with the plurality of flag bits. Compared with extraction of a single packet file, memory overflow caused by one-time loading of a large file by Wirespark is avoided, meanwhile, the start point and the end point of each session can be anchored through the zone bit, the integrity of application layer data of eachsession can be guaranteed, complete application layer data can be extracted, and the problem that a TCP layer is fragmented to cause incompleteness is avoided.

Description

technical field [0001] The invention relates to the technical field of data extraction, in particular to a method and device for extracting generated data of a regression test or a stress test. Background technique [0002] This section is intended to provide a background or context to embodiments of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] One of the current regression test / stress test data generation methods is to use Tcpdump to capture network packets in the production environment and save them as packet files (single), parse the packet files through Wireshark scripts (tshark, pyshark, etc.), and extract from a single TCP packet Application layer data, transformed and used as test data. [0004] There are 3 problems with the above method: [0005] First, when the application layer data exceeds the TCP MSS (MaximumSegmentSize maximum segment length, generally 1460 bytes)...

AI Technical Summary

Problems solved by technology

[0006] Second, for scenarios with large transaction volume and long capture time, the captured single-packet file may reach several gigabytes

The Wireshark script reads the entire packet file into the memory and then parses it, so the data extraction of large files is limited by the machine memory; when the file exceeds the memory limit, Wireshark will automatically exit

This problem has been recorded on the Wireshark official website (https: / / wiki.wireshark.org / KnownBugs / OutOfMemory). The solution given by Wireshark is to increase physical memory and virtual memory, but these methods are limited by the hardware and software of the device.

[0007] Third, for the second problem, the size of a single packet file captured by Tcpdump can be limited, but there is a problem similar to the first point: if there are TCP fragments, different fragments of the same TCP session may exist in different package file, the extracted application layer data is still not necessarily complete data

Images