METHOD FOR RECORDING, RECOVERING, AND REPLAYING REAL TRAFFIC

• US 20120005754A1
• Filed: 09/17/2010
• Published: 01/05/2012
• Est. Priority Date: 07/02/2010
• Status: Active Grant

• Current Assignee: National Chiao Tung University (Government of The Republic of China)
• Original Assignee: National Chiao Tung University (Government of The Republic of China)
• Inventors: LIN, YING DAR, CHENG, TSUNG HUAN, LAI, YUAN CHENG, CHEN, I WEI
• Granted Patent: US 8,505,098 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A recording, recovering, and replaying method for real traffic is used for processing a plurality of network packets of a plurality of network connections. A recording procedure of the method includes the following steps. A recording parameter (N, M, P) is received. A header and a payload of each network packet of the network connections are completely recorded, and a payload accumulation value of each network connection is accumulated. When one of the payload accumulation values exceeds N, the header of each network packet and first M bytes of the payload are recorded for P consecutive network packets corresponding to the payload accumulation value. When one of the payload accumulation values exceeds N and after the P consecutive network packets of the network connection corresponding to the payload accumulation value are recorded, the header of each network packet is recorded for the network connection corresponding to the payload accumulation value.

Claims

1. A method for recording real traffic, used for processing a plurality of network packets of a plurality of network connections, comprising:

executing a recording procedure, comprising;

receiving a recording parameter (N, M, P), wherein N, M, and P are integers greater than or equal to zero;

completely recording a header and a payload of each network packet of the network connections, and accumulating a payload accumulation value of each network connection;

recording the header and first M bytes of the payload of P consecutive network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N; and

recording the header of the network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N and after recording the P consecutive network packets of the network connection corresponding to the payload accumulation value.

2. The method for recording the real traffic according to claim 1, wherein the recording parameter for an attack event is (2000, 200, 1300).

3. The method for recording the real traffic according to claim 1, wherein the recording parameter for a virus event is (6000, 0, 0).

4. The method for recording the real traffic according to claim 1, wherein the network connections satisfy the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

5. A method for recording and recovering real traffic, used for processing a plurality of network packets of a plurality of network connections, comprising:

executing a recording procedure, comprising;

receiving a recording parameter (N, M, P), wherein N, M, and P are integers greater than or equal to zero;

completely recording a header and a payload of each network packet of the network connections, and accumulating a payload accumulation value of each network connection;

recording the header of each network packet and first M bytes of the payload of P consecutive network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N; and

recording the header of the network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N and after recording the P consecutive network packets of the network connection corresponding to the payload accumulation value; and

executing a recovery procedure, comprising;

checking whether the headers and the payloads of the network packets are complete or not one by one;

determining whether the incomplete network packet has the complete header or not when obtaining at least one incomplete network packet; and

executing following steps when the incomplete network packet has the complete header;

obtaining a payload length of the incomplete network packet according to the header of the incomplete network packet; and

writing a dummy value as the payload of the incomplete network packet according to the payload length.

6. The method for recording and recovering the real traffic according to claim 5, wherein the recording parameter for an attack event is (2000, 200, 1300).

7. The method for recording and recovering the real traffic according to claim 5, wherein the recording parameter for a virus event is (6000, 0, 0).

8. The method for recording and recovering the real traffic according to claim 5, wherein the network connections satisfy the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

9. The method for recording and recovering the real traffic according to claim 5, wherein the recovery procedure further comprises:

executing the following steps when the incomplete network packet has the incomplete header;

recovering the header of the incomplete network packet according to other network packets of the network connection corresponding to the incomplete network packet;

obtaining the payload length of the incomplete network packet according to the recovered header of the incomplete network packet; and

writing the dummy value as the payload of the incomplete network packet according to the payload length.

10. The method for recording and recovering the real traffic according to claim 5, wherein the recovery procedure further comprises:

finding at least one loss packet being record-lost according to a sequence number and an acknowledgement number of the headers of the network connections;

recovering the header of the loss packet according to other network packets of the network connection corresponding to the loss packet;

obtaining the payload length of the loss packet according to the recovered header of the loss packet; and

writing the dummy value as the payload of the loss packet according to the payload length.

11. The method for recording and recovering the real traffic according to claim 5, wherein the dummy value is a random number.

12. A method for recording, recovering, and replaying real traffic, used for processing a plurality of network packets of a plurality of network connections, comprising:

executing a recording procedure, comprising;

receiving a recording parameter (N, M, P), wherein N, M, and P are integers greater than or equal to zero;

completely recording a header and a payload of each network packet of the network connections, and accumulating a payload accumulation value of each network connection;

recording the header of each network packet and first M bytes of the payload of P consecutive network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N; and

recording the header of the network packets of the network connection corresponding to the payload accumulation value when one of the payload accumulation values exceeds N and after recording the P consecutive network packets of the network connection corresponding to the payload accumulation value;

executing a recovery procedure, comprising;

checking whether the headers and the payloads of the network packets are complete or not one by one;

determining whether the incomplete network packet has the complete header or not when obtaining at least one incomplete network packet; and

executing following steps when the incomplete network packet has the complete header;

obtaining a payload length of the incomplete network packet according to the header of the incomplete network packet; and

writing a dummy value as the payload of the incomplete network packet according to the payload length; and

executing a replay procedure, comprising;

receiving an event time and a network connection information, wherein the network connection information comprises at least one network connection address; and

replaying the network packets of the at least one network connection corresponding to the network connection address.

13. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the recording parameter for an attack event is (2000, 200, 1300).

14. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the recording parameter for a virus event is (6000, 0, 0).

15. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the network connections satisfy the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP).

16. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the recovery procedure further comprises:

executing following steps when the incomplete network packet has the incomplete header;

recovering the header of the incomplete network packet according to other network packets of the network connection corresponding to the incomplete network packet;

obtaining the payload length of the incomplete network packet according to the recovered header of the incomplete network packet; and

writing the dummy value as the payload of the incomplete network packet according to the payload length.

17. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the recovery procedure further comprises:

finding at least one loss packet being record-lost according to a sequence number and an acknowledgement number of the headers of the network connections;

recovering the header of the loss packet according to other network packets of the network connection corresponding to the loss packet;

obtaining the payload length of the loss packet according to the recovered header of the loss packet; and

writing the dummy value as the payload of the loss packet according to the payload length.

18. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the dummy value is a random number.

19. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the replay procedure further comprises:

obtaining a specific connection in the network connections according to the network connection address of the network connection information, a network connection protocol, and a network connection port; and

replaying the network packets of the specific connection.

20. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the replay procedure further comprises:

replaying the network packets of the at least one network connection being transmitted at the event time.

21. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the replay procedure further comprises:

replaying the network packets of the at least one network connection ending transmission before the event time.

22. The method for recording, recovering, and replaying the real traffic according to claim 12, wherein the network connection address is the Internet Protocol (IP) address.