CN101217429A - A determination method of the initiation relationship within TCP messages based on TCP timestamp options - Google Patents
A determination method of the initiation relationship within TCP messages based on TCP timestamp options Download PDFInfo
- Publication number
- CN101217429A CN101217429A CNA2008100563928A CN200810056392A CN101217429A CN 101217429 A CN101217429 A CN 101217429A CN A2008100563928 A CNA2008100563928 A CN A2008100563928A CN 200810056392 A CN200810056392 A CN 200810056392A CN 101217429 A CN101217429 A CN 101217429A
- Authority
- CN
- China
- Prior art keywords
- tcp
- message
- list item
- tvmap
- timestamp
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 23
- 230000000977 initiatory effect Effects 0.000 title claims description 18
- 238000013507 mapping Methods 0.000 claims description 28
- 230000008859 change Effects 0.000 claims description 10
- 238000005259 measurement Methods 0.000 claims description 8
- 238000012544 monitoring process Methods 0.000 claims description 7
- 238000012986 modification Methods 0.000 claims description 5
- 230000004048 modification Effects 0.000 claims description 5
- 230000004044 response Effects 0.000 claims description 2
- 230000001360 synchronised effect Effects 0.000 claims description 2
- 230000005540 biological transmission Effects 0.000 abstract description 13
- 208000025779 tropical pancreatitis Diseases 0.000 description 81
- 230000008569 process Effects 0.000 description 6
- 238000003745 diagnosis Methods 0.000 description 4
- 238000007689 inspection Methods 0.000 description 4
- 230000000052 comparative effect Effects 0.000 description 2
- 238000012217 deletion Methods 0.000 description 2
- 230000037430 deletion Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
A method deciding the indexical relations among TCP messages based on TCP timestamp option belongs to TCP performance analyzing field of transmission protocol; the invention is characterized in that the method comprise the following steps: capturing message on random part of the connecting paths of TCP; changing the original timestamp value on each TCP timestamp option of the message into a new timestamp value which strictly and progressively increases along the connecting direction; recording the original timestamp value of the message and the new timestamp value on a timestamp value reflecting table on the connecting direction; finding the timestamp value reflecting table corresponding to the message in the timestamp value reflecting table which is in a opposite direction with the message, and revising the showing and answering field on the timestamp of the message according to the content of list item; further deciding the indexical relations among messages according to the corresponding list item which is found out in the last step; adding a timestamp option for a SYN message without a timestamp option. The users and network engineering personnel can use the method to diagnose the limiting factors of TCP connecting and transmitting speed.
Description
Technical field
The present invention relates to the performance evaluation and the diagnosis of TCP host-host protocol in the Internet.
Background technology
TCP is the most widely used transport layer protocol among the Internet, and many important internet, applications are such as HTTP, and FTP, BitTorrent, NFS etc. use it to transmit data.The TCP transmission rate is high more, and the speed of download of file is just fast more.The TCP transmission rate has determined the performance of these application to a great extent.Article one, the transmission rate that actual TCP connects may be subjected to the restriction of following several factors: the 1) restriction of application program, such as the application program generation low volume data at an intermittence itself, 2) restriction of host configuration, such as too small transmitting terminal or receiving terminal buffer memory, 3) restriction of network is such as the restriction that is subjected to bottleneck bandwidth on Network Packet Loss or the path.
The researcher of Pittsburgh Supercomputing Center (PSC) has developed the system of a Web100 by name.Statistical parameter when this system is transmitted by the modification of tcp protocol stack in the operating system being write down some TCP, thus determine that TCP connects the limiting factor of transmission rate.Yet this method only is applicable to the fault that sends at the data sending terminal diagnostic data, can't be used for the failure diagnosis at network or data receiver place.Such as, when browsing page, unless server is installed this system, otherwise we can't diagnose the fault in the page download.
In TCP connected, flight byte number (inflight bytes) was meant that those sent but were not received the total amount of byte that end is confirmed a certain moment.The TCP transmitting terminal is adjusted its transmission rate by dynamically changing the flight byte number that connects.In most of the cases, the limiting factor of finding out the flight byte number just can be determined the limiting factor of TCP transmission rate.The flight byte number is subjected to the restriction of following 4 kinds of factors: when upper layer application (as telnet) intermittently transmission message just, the data that the flight byte number is subject to upper layer application produce speed.When upper layer application (as HTTP, when FTP etc.) needing continuous transferring large number of data, the flight byte number that TCP connects will be subjected to the restriction of following three kinds of factors, transmitting terminal buffer memory (sender buffer), receiving terminal advertised window (receiver advertised window) and congestion window (congestion window).When the flight byte number was subjected to different effects limit, its Changing Pattern was different.Therefore, the key of diagnosis TCP rate limit factor is to find out and connects any one flight byte number constantly, and determines its limiting factor according to the Changing Pattern of flight byte number.
The sliding window scheme of using Transmission Control Protocol realizes connecting the control of flight byte number.The left margin of sliding window is a sequence number unconfirmed, and right margin is the maximum sequence number that has sent.The left margin that moved to right after transmitting terminal is received a message, right margin also can correspondingly move to right.And then, whether it will allow to send new message according to new right margin inspection.If allow, it will send new message at once.Therefore, remove first message of connecting and because the message that overtime re-transmission causes, the transmission of all the other each messages all causes owing to transmit leg has received certain message.Here, the message that we define a message and cause it be one to reply, and the correspondence that will set up based on this initiation relationship is to being called the initiation relationship between the message.Be not difficult to find out that from top analysis in case can determine this initiation relationship, the flight byte number of connection can be determined easily.
So definite key that connects the rate limit factor is the initiation relationship between definite message.
Determine that the initiation relationship between message can and confirm that sequence number finish by sequence number in the matching message TCP packet header.But for the situation that data are downloaded, data receiver does not send any data, and it is all the same that it sends sequence number of message, thus data sending terminal to send the affirmation sequence number of message also all the same.At this moment, we can't and confirm certain message that sequence number determines that transmitting terminal sends is by which message that receiving terminal sends to be caused according to sequence number of message.
In this case, the timestamp option of use TCP can reach our purpose.TCP timestamp option proposes in RFC1323, is used for the two-way time (RTT) that transmitting terminal calculates message.
Fig. 1 is a TCP timestamp option, and wherein TSval is the timestamp value, and TSecr is that the timestamp echo is replied.As
Value shown in Figure 5, that host B is placed one 32 bit in the TSval field, host A is this numerical value of echo in acknowledgement field.Timestamp is a monotonically increasing value.Owing to the content that host A only needs echo to receive, therefore need not to understand the concrete implication of this value.This option need not carry out any type of clock synchronization between two main frames.RFC 1323 recommends main frame between 1 millisecond and 1 second the timestamp value to be added 1.In addition, in the three-way handshake process that connects, have only when two ends all express support for this option, this option just can be used after connection was set up.
According to the operation principle of TCP timestamp option, we can make the initiation relationship that comes with the following method to determine between the message.The TSval that supposes the message that host B sends is 100, and this message has caused some messages after arriving host A, and the TSecr of these messages should also should be 100 so.According to this relation of equality, we can find out the initiation relationship between the message.But in the realization of present operating system, the TSval that host B sends message is not that strict dullness rises, and may send 1 or a plurality of TSval such as it is 100 message.At this moment, a TSecr who sends for host A is 100 message, and we can't determine that this message is on earth is that 100 message causes by which TSval that host B sends.The present invention proposes to make the TSval that sends not repeat by the method for revising TSval, thereby avoids occurring ambiguity above-mentioned.
Summary of the invention
The present invention has provided the method that a kind of TCP of utilization timestamp option is determined corresponding relation between the message.This invention makes us can access the flight byte number that each connects constantly, and determines the rate limit factor of connection according to the dynamic rule of flight byte number.
The invention is characterized in: any one measurement point on TCP access path to be analyzed, placing one can monitor and revise hardware device or the software module that this TCP is connected message, utilize TCP timestamp option to determine initiation relationship between the message according to following steps successively, described TCP timestamp option comprises one 32 bit monotonically increasing timestamp field TSval and one 32 bit echo acknowledgement field TSecr;
Step (1) initialization is provided with in described software module:
A TCP connects monitoring form, is used to write down all and just connects at monitored TCP;
The TVmap mapping table of original time stamp value and new timestamp value: safeguard that on each direction that each monitored TCP is connected one belongs to the original time stamp value of this direction message and new timestamp value mapping table, when the P0 that waits to E-Packet stabs option if having time, use this mapping table to revise TSval and TSecr field in the P0 timestamp option; This mapping table is made of a series of TVmap list items, and each list item comprises that a gauge outfit and original time stamp are all messages of certain TSval; Wherein the TVmap gauge outfit comprises the original time stamp value that six critical field: tsval_orig are messages under this list item at least, tvmin and tvmax, be respectively the minimum and the maximum new timestamp value of message under this TVmap list item, sndmax is the maximum TCP sequence number of message under this list item, rcvmax is the maximum TCP sequence number (initial value is 0) that is caused message by message under this list item, and flag is the sign of this TVmap list item;
A timestamp value modified module is used at network not or the new timestamp value TSval that fills in P0 under the situation of out of order message arranged;
A TVmap list item removing module is used to delete expired TVmap list item;
Step (2) is handled the TCP message of intercepting and capturing set by step:
Step (2.1) is under the TCP check of message P0 and correct condition, if: P0 only has TCP SYN synchronous mark position, then it does not belong to existing TCP connection, but require to initiate a new connection, handle according to the following steps, otherwise, if also not belonging to certain just monitored TCP, P0 do not connect, then transmit P0;
Step (2.1.1) is set up new TCP linkage record;
Step (2.1.2) judges whether P0 stabs option if having time:
If have, then write down the timestamp value TSval of P0
If do not have, then for P0 adds the timestamp option, and the new timestamp value TSval of record P0;
Step (2.2) under the TCP check of message P0 and correct condition, if: P0 belongs to certain just monitored TCP and connects, and then handles according to the following steps:
Step (2.2.1) judges whether this connection has finished three-way handshake:
If: finished three-way handshake, and P0 stabs option if having time and then change step (2.2.2) over to, otherwise transmit P0;
If: do not finish three-way handshake, judge then whether P0 stabs option if having time,, then change step (2.2.2) over to, otherwise delete this TCP linkage record, and transmit P0 if having;
Step (2.2.2) according to not having out of order on the arrival path and out of order two kinds of situations being arranged, is revised the original time stamp value TSval of P0 according to the following steps in timestamp value modified module, fill in the new TSval of P0, upgrade the sndmax of corresponding TVmap list item, tvmin, tvmax;
Step (2.2.2.1) does not have when out of order when the network path from the transmit leg of P0 to this measurement point, then according to maximum time stamp value MaxNewTSval on current this direction, the new timestamp value NewTSval of P0 is set to MaxNewTSval+m, upgrades MaxNewTSval simultaneously, wherein m 〉=1;
Step (2.2.2.2) according to following steps, uses the described TVmap mapping table of step (1) to determine the sending order of P0 when the network path from the transmit leg of P0 to this measurement point exists when out of order:
Step (2.2.2.2.1) is according to the original time stamp value TSval of P0, with the equidirectional mapping table of P0 in look for tsval_orig to equal that list item of the TSval of P0, if can not find, then set up a new TVmap list item for P0, P0 is linked to this list item, according to the tsval_orig of this list item P0 is inserted into relevant position in the TVmap table again, the sndmax of this list item is set to the maximum TCP sequence number of P0, forwards step (2.2.2.2.4) then to;
Step (2.2.2.2.2) is if find the TVmap list item of the original time stamp value TSval correspondence of P0 in step (2.2.2.2.1), then P0 is inserted in the corresponding TVmap list item, if the maximum TCP sequence number of P0 greater than the sndmax of this list item, then is updated to the sndmax of list item the maximum TCP sequence number of P0; When inserting, pointer at first points to last message in this list item, use from after forward the tram of sequential search P0, when one of pointed has E-Packeted P1, relatively TCP acknowledgment sequence number and the TCP sequence number of P0 and P1 are if the TCP acknowledgment sequence number of P0 big than P1 illustrates that P0 sends after P1, P0 is inserted into the back of P1, turns to step (2.2.2.2.4); If the affirmation sequence number of P0 is littler than P1, illustrate that P0 sent before P1, then message of pointer forward repeats top comparison; If both affirmation sequence number equates, their TCP sequence number relatively then if the sequence number of P0, then is inserted into the back of P1 more than or equal to P1, turns to step (2.2.2.2.4); Otherwise then the pointer message that moves forward again, the comparison above repeating;
Step (2.2.2.2.3) is in step (2.2.2.2.2), if last pointer is empty, then P0 is inserted into the head of this TVmap list item;
Step (2.2.2.2.4) in step (2.2.2.2.2), if P0 is before and after being inserted between adjacent two messages, the new timestamp value TSval of the P0 mean value that is these two new timestamp values of adjacent message then; If P0 is inserted in all and has transmitted the back, then the new timestamp value of P0 is NewMaxTSval+m, and m 〉=1 is upgraded NewMaxTSval simultaneously; Change step (2.2.2.2.5) over to;
Step (2.2.2.2.5), the new TSval of use P0 upgrades the tvmin and the tvmax of corresponding list item;
Step (2.2.3) is under TCP check and correct situation, the echo of revising in the P0 timestamp option is replied TSecr: seek a TVmap list item in this connection and the reciprocal TVmap mapping table of P0, make the current echo of P0 reply the tvmin of TSecr, smaller or equal to the tvmax of this list item more than or equal to this list item; After finding, the TSecr of P0 is rewritten as the tsval_orig of this list item, if the maximum TCP sequence number of P0 then makes rcvmax equal the maximum TCP sequence number of P0 greater than the rcvmax of this list item; If: search less than, then P0 is abandoned;
Step (2.2.4) is deleted expired TVmap list item according to the following steps under TCP check and correct situation:
Step (2.2.4.1) is to each list item in the equidirectional TVmap mapping table of P0, and whether the affirmation sequence number of checking P0 is greater than the sndmax of list item;
If: greater than sndmax, then the sign flag to this list item puts the ACK_RCVD flag bit; When this list item comprises two flag bits of ACK_RCVD and DATA-ACKD, delete this list item;
If: be not more than sndmax, then finish, change step (2.2.4.2) over to;
Step (2.2.4.2) is to P0 each list item in the TVmap mapping table in the other direction, and whether the affirmation sequence number of checking P0 is greater than the rcvmax of list item;
If: greater than rcvmax, then the sign flag to this list item puts the DATA_ACKD flag bit, when this list item comprises two flag bits of ACK_RCVD and DATA_ACKD, deletes this list item;
If: be not more than sndmax, then finish, change step (2.2.5) over to;
Step (2.2.5) E-Packets.
Whether the message of receiving in judgement belongs to existing TCP connection side, perhaps revises the timestamp value of this message, perhaps at the echo response value of revising this message, all will judge the TCP check of this message and whether correct earlier.
Before modification message echo is replied, there is one will carry out on-line analysis according to the application combination of selected hardware device according to the definite step that connects the message corresponding relation of current TCP heading, perhaps the TCP heading of message is preserved and got off to carry out off-line analysis.
The present invention can implement by any place's measurement point on TCP access path to be analyzed, has solved the problem of initiation relationship between definite message.This method can be used for diagnosing TCP to connect the limiting factor of transmission rate.User and network engineering technical staff can use this invention to carry out the diagnosis of TCP transmission fault.
Description of drawings
Fig. 1 is a TCP timestamp option.
Fig. 5 is the basic functional principle of TCP timestamp.
Fig. 2 is the fundamental diagram of system.
Fig. 3 is the TCP message process chart of system.
Fig. 4 is the Data Structures of TVmap mapping table.U32 represents to define 32 unsigned int variablees among the figure.
Fig. 6 is the flow chart that timestamp value modified module under the situation of out of order message is arranged at network.
Fig. 7 is the flow chart of TVmap removing module.
Embodiment
In order to finish the function of this invention, need to intercept and capture TCP to be analyzed based on a system of the present invention and connect message on the both direction, revise the TCP packet header of message then, and finally forward.This system can implement by any place's measurement point on TCP access path to be analyzed, can be can intercept and capture on this connection two ends main frame and revise this software module that is connected message or hardware device specifically, also can be a certain network equipment on the network path.
As
Shown in Figure 2, after the TCP message that needs handle was received by this system, it at first was revised as the TSval in the message timestamp a new value NewTSval, and will (TSval, NewTSval) this to the mapping relation record in the TVmap mapping table.According to this moment the TCP heading the timestamp option we can be online the initiation message of determining this message, also the heading of message can be preserved and get off to be used for off-line analysis.Then, we revert to original value by the TVmap mapping table of inquiring about on another direction with the TSecr of this message.This be because, that the TSecr echo is NewTSval after the apparatus modifications in the message, we can not directly forward this message, that will cause the receiving terminal of this message to calculate incorrect RTT.At last, system forwards message.
Below we describe in detail with reference to top schematic diagram.
Fig. 3 is that one embodiment of the invention is received a handling process behind the TCP message, and details are as follows:
After receiving a TCP message, the TCP check of this message of step 301 inspection and whether correct.If incorrect, this message will be dropped, even also can be dropped because TCP check and incorrect message arrive receiving terminal.Prior reason is, if TCP check and incorrect, we can't determine whether its timestamp option is correct.
TCP of system maintenance connects monitoring form, is used to write down all and just connects at monitored TCP.Step 302 checks whether this message belongs to a connection in the TCP connection monitoring form.If do not belong to, then execution in step 313 checks that whether this message is being initiated a new TCP and connected, and judges promptly whether the TCP packet header of this message only contains the SYN flag bit.If do not contain the SYN flag bit or also have other flag bit except the SYN flag bit, then message is not done further processing, directly transmit.If instead be judged as very, then execution in step 314 is set up a new TCP linkage record in connecting monitoring form.Execution in step 315 checks whether message stabs option if having time then.If not then execution in step 316 is added a timestamp option for this message, and in step 317, recomputate TCP check and, in step 318, write down the TSval that sends message.In the inspection of step 315,, then directly jump to step 318 and carry out if message stabs option if having time.
The reason that step 316 is added timestamp is that our method can only connect the TCP that supports the timestamp option to be analyzed.In general, the SYN message that connects as TCP of initiation does not stab service time, and this connection just can not supported the timestamp option.Thereby the method that causes us can't be used to analyze these connections.Yet we find the main frame for Windows 2000/XP/Server series operating system, though the TCP SYN message that main frame sends does not contain TCP timestamp option, operating system itself is to support TCP timestamp option.Use the method for step 316, can make the connection of setting up support timestamp.When adding timestamp, its TSval must be certain nonzero integer, and TSecr preferably is set to 0.
If message belongs to certain connection in the TCP connection monitoring form, then execution in step 303 judges whether this connection has finished TCP three-way handshake.If finish, then execution in step 304 judges whether message stabs option if having time.If not free stab then message is not done further processing, jump to step 319 and E-Packet.In the inspection of step 303, when connecting also in the process at three-way handshake, then execution in step 311 checks whether messages stab option if having time.If not then illustrate that a certain end main frame that this TCP connects do not support the timestamp option really, then execution in step 312 should connect deletion from connect monitoring form, no longer this connection was monitored later on.
Find that behind execution of step 304 and 311 message stabs option if having time, then execution in step 305 is revised the TSval field in the message TCP timestamp option.As
Shown in Figure 2, every connects each direction and all safeguards a TVmap mapping table.Revolution is sent out a message on this direction, all needs this table is added or upgrades operation.As
Shown in Figure 4, being made up of a series of TVmap list items of this mapping table, it is all messages of certain TSval value that the corresponding original time of each TVmap list item stabs.This list item is made up of a TVmap gauge outfit and corresponding message.The TVmap gauge outfit mainly comprises the original TSval that 6 critical field: tsval_orig are corresponding all messages of this list item, tvmin and tvmax are respectively the minimum and maximum values of the new TSval of the corresponding message of this list item, sndmax is the maximum sequence number of these messages, rcvmax is by the maximum sequence number of the message of these messages initiations (upgrading in step 308), and flag is the sign (upgrading in step 310) of this list item.In step 305, revolution is sent out a message, and whether the maximum TCP sequence number that all needs this message relatively greater than the sndmax of list item, if greater than would make sndmax equal the maximum TCP sequence number of this message.
In step 305, to guarantee the monotonicity of NewTSval sequence when producing the basic principle that NewTSval value followed, it is bigger than the value of the TSval that sends before message to need promptly to guarantee that the back sends the TSval of message.Step 305 has two kinds of mode of operations, and handle arriving does not respectively have out of order on the path and out of order two kinds of situations are arranged:
When the network path of message from transmit leg to this equipment do not have when out of order, the order that message arrives equipment is identical with the order that message sends.In this case, the maximum (MaxNewTSval) of current NewTSval on this direction of system log (SYSLOG), for a message of newly receiving, its NewTSval is set to MaxNewTSval+m.Wherein m can be any one greater than 1 integer.In specific implementation, we are provided with m is 1, is set to greater than 1 because there is no need m.
When existing on the network path of message from transmit leg to this equipment when out of order, deal with more many than the previous case complexity.System uses
Mapping table shown in Figure 4 determines to arrive the sending order of message.As
Shown in Figure 4, on each TVmap gauge outfit the right, the message that all original TSval equal this list item tsval_orig constitutes a chained list according to their sending order from arriving first the back.When step 314 generated new a connection, this data structure was empty.As
Shown in Figure 6, receive a message P0 after, step 401 finds corresponding TVmap list item (tsval_orig of list item equals the TSval of P0) according to the TSval of P0.If can not find, then execution in step 409 is set up a new TVmap gauge outfit, in step 410 P0 is inserted under this gauge outfit, and the TSval according to this gauge outfit in step 411 inserts new list item in the mapping table.
If in step 401, find corresponding TVmap list item, then P0 be inserted in the corresponding list item.During insertion, pointer at first points to last message P (step 402) in the list item, use from after forward the tram of the new message of sequential search.During P of the every sensing of pointer, compare TCP acknowledgment sequence number (step 403) and the TCP sequence number (step 404) of P0 and P.Send after P if comparative result is P0, then in step 405, P0 is inserted into the back of P.Sending before if comparative result is P0, then execution in step 407 allows the pointer message that moves forward again.Circulation is search forward, if pointer is empty (step 406) to the end, then P0 is inserted into the head of this list item in step 408.
After wherein any one of execution of step 405,408 and 410, P0 will be inserted into according to the order of its transmission in the TVmap table.In step 411, if P0 is not out of order situation, it will be inserted at last, and its NewTSval is set to MaxNewTSval+m.If P0 is out of order bag, then it is inserted in the centre of two messages, and its NewTSval can be any one value between these two message NewTSval, and we generally get the mean value of these two values.Under the circumstances, above-mentioned m value need be greater than 1, with the difference between the NewTSval that guarantees adjacent message greater than 1.
If step 305 is successfully returned, in step 306, we recomputate message TCP check and.Calculate TCP check and in, we only need to use the method for incremental computations, need not recomputate whole message.
In step 307, we can determine the corresponding relation of two ends message according to current TCP packet header.This process can onlinely be carried out, and also message packet header can be preserved and get off to carry out off-line analysis.The sort of mode of concrete selection need be decided according to the concrete application scenario of equipment.
In step 308, we revert to original value TSecr with the NewTSecr of message P0.System with the reciprocal TVmap mapping table of P0 in the corresponding TVmap list item of NewTSecr of inquiry P0, the NewTSecr that requires P0 is more than or equal to the tvmin of list item and smaller or equal to the tvmax of list item.After finding the echo field of P0 is rewritten as the tsval_orig of this list item.If the maximum TCP sequence number of P0 is greater than the rcvmax of this list item then upgrade the rcvmax of list item.If in mapping table, can not find corresponding list item, then will abandon P0.
In step 309, the TCP check of message and will being recomputated.
In step 310, as
Shown in Figure 7, we delete expired TVmap list item.In the process of transfer of data, the quantity of TVmap list item can increase along with the growth of the number that E-Packets.If the TVmap list item that untimely deletion is expired, they can take a large amount of memory spaces or search the time.In step 310, for equidirectional each the TVmap list item of message P0, whether the affirmation sequence number that step 501 is checked P0 greater than the sndmax of list item, if greater than the flag variable of this list item would be put ACD_RCVD flag bit (step 502).In step 503, when this list item indicates ACD_RCVD and two kinds of flag bits of DATA_ACKD simultaneously, then delete this list item.For with reciprocal each the TVmap list item of P0, whether the affirmation sequence number that step 507 is checked P0 greater than the rcvmax of this list item, if greater than the flag variable of this list item would be put DATA_ACKD flag bit (step 508).In step 509, when this list item indicates ACD_RCVD and two kinds of flag bits of DATA_ACKD simultaneously, then delete this list item.
Message is forwarded away in step 319.
What please be careful above introduction is preferred embodiment of the present invention, not in order to restriction the present invention.In addition, above also comprising, protection scope of the present invention introduces the various combinations of each module and their submodule, and the modification of these modules and distortion.
Claims (3)
1. determine the method for initiation relationship between the TCP message based on TCP timestamp option, it is characterized in that, any one measurement point on TCP access path to be analyzed, placing one can monitor and revise hardware device or the software module that this TCP is connected message, utilize TCP timestamp option to determine initiation relationship between the message according to following steps successively, described TCP timestamp option comprises one 32 bit monotonically increasing timestamp field TSval and one 32 bit echo acknowledgement field TSecr;
Step (1) initialization is provided with in described software module:
A TCP connects monitoring form, is used to write down all and just connects at monitored TCP;
The TVmap mapping table of original time stamp value and new timestamp value: safeguard that on each direction that each monitored TCP is connected one belongs to the original time stamp value of this direction message and new timestamp value mapping table, when the P0 that waits to E-Packet stabs option if having time, use this mapping table to revise TSval and TSecr field in the P0 timestamp option; This mapping table is made of a series of TVmap list items, and each list item comprises that a gauge outfit and original time stamp are all messages of certain TSval; Wherein the TVmap gauge outfit comprises the original time stamp value that six critical field: tsval_orig are messages under this list item at least, tvmin and tvmax, be respectively the minimum and the maximum new timestamp value of message under this TVmap list item, sndmax is the maximum TCP sequence number of message under this list item, rcvmax is the maximum TCP sequence number (initial value is 0) that is caused message by message under this list item, and flag is the sign of this TVmap list item;
A timestamp value modified module is used at network not or the new timestamp value TSval that fills in P0 under the situation of out of order message arranged;
A TVmap list item removing module is used to delete expired TVmap list item;
Step (2) is handled the TCP message of intercepting and capturing set by step:
Step (2.1) is under the TCP check of message P0 and correct condition, if: P0 only has TCP SYN synchronous mark position, then it does not belong to existing TCP connection, but require to initiate a new connection, handle according to the following steps, otherwise, if also not belonging to certain just monitored TCP, P0 do not connect, then transmit P0;
Step (2.1.1) is set up new TCP linkage record;
Step (2.1.2) judges whether P0 stabs option if having time:
If have, then write down the timestamp value TSval of P0
If do not have, then for P0 adds the timestamp option, and the new timestamp value TSval of record P0;
Step (2.2) under the TCP check of message P0 and correct condition, if: P0 belongs to certain just monitored TCP and connects, and then handles according to the following steps:
Step (2.2.1) judges whether this connection has finished three-way handshake:
If: finished three-way handshake, and P0 stabs option if having time and then change step (2.2.2) over to, otherwise transmit P0;
If: do not finish three-way handshake, judge then whether P0 stabs option if having time,, then change step (2.2.2) over to, otherwise delete this TCP linkage record, and transmit P0 if having;
Step (2.2.2) according to not having out of order on the arrival path and out of order two kinds of situations being arranged, is revised the original time stamp value TSval of P0 according to the following steps in timestamp value modified module, fill in the new TSval of P0, upgrade the sndmax of corresponding TVmap list item, tvmin, tvmax;
Step (2.2.2.1) does not have when out of order when the network path from the transmit leg of P0 to this measurement point, then according to maximum time stamp value MaxNewTSval on current this direction, the new timestamp value NewTSval of P0 is set to MaxNewTSval+m, upgrades MaxNewTSval simultaneously, wherein m 〉=1;
Step (2.2.2.2) according to following steps, uses the described TVmap mapping table of step (1) to determine the sending order of P0 when the network path from the transmit leg of P0 to this measurement point exists when out of order:
Step (2.2.2.2.1) is according to the original time stamp value TSval of P0, with the equidirectional mapping table of P0 in look for tsval_orig to equal that list item of the TSval of P0, if can not find, then set up a new TVmap list item for P0, P0 is linked to this list item, according to the tsval_orig of this list item P0 is inserted into relevant position in the TVmap table again, the sndmax of this list item is set to the maximum TCP sequence number of P0, forwards step (2.2.2.2.4) then to;
Step (2.2.2.2.2) is if find the TVmap list item of the original time stamp value TSval correspondence of P0 in step (2.2.2.2.1), then P0 is inserted in the corresponding TVmap list item, if the maximum TCP sequence number of P0 greater than the sndmax of this list item, then is updated to the sndmax of list item the maximum TCP sequence number of P0; When inserting, pointer at first points to last message in this list item, use from after forward the tram of sequential search P0, when one of pointed has E-Packeted P1, relatively TCP acknowledgment sequence number and the TCP sequence number of P0 and P1 are if the TCP acknowledgment sequence number of P0 big than P1 illustrates that P0 sends after P1, P0 is inserted into the back of P1, turns to step (2.2.2.2.4); If the affirmation sequence number of P0 is littler than P1, illustrate that P0 sent before P1, then message of pointer forward repeats top comparison; If both affirmation sequence number equates, their TCP sequence number relatively then if the sequence number of P0, then is inserted into the back of P1 more than or equal to P1, turns to step (2.2.2.2.4); Otherwise then the pointer message that moves forward again, the comparison above repeating;
Step (2.2.2.2.3) is in step (2.2.2.2.2), if last pointer is empty, then P0 is inserted into the head of this TVmap list item;
Step (2.2.2.2.4) in step (2.2.2.2.2), if P0 is before and after being inserted between adjacent two messages, the new timestamp value TSval of the P0 mean value that is these two new timestamp values of adjacent message then; If P0 is inserted in all and has transmitted the back, then the new timestamp value of P0 is NewMaxTSval+m, and m 〉=1 is upgraded NewMaxTSval simultaneously; Change step (2.2.2.2.5) over to;
Step (2.2.2.2.5), the new TSval of use P0 upgrades the tvmin and the tvmax of corresponding list item;
Step (2.2.3) is under TCP check and correct situation, the echo of revising in the P0 timestamp option is replied TSecr: seek a TVmap list item in this connection and the reciprocal TVmap mapping table of P0, make the current echo of P0 reply the tvmin of TSecr, smaller or equal to the tvmax of this list item more than or equal to this list item; After finding, the TSecr of P0 is rewritten as the tsval_orig of this list item, if the maximum TCP sequence number of P0 then makes rcvmax equal the maximum TCP sequence number of P0 greater than the rcvmax of this list item; If search less than, then P0 is abandoned;
Step (2.2.4) is deleted expired TVmap list item according to the following steps under TCP check and correct situation:
Step (2.2.4.1) is to each list item in the equidirectional TVmap mapping table of P0, and whether the affirmation sequence number of checking P0 is greater than the sndmax of list item;
If: greater than sndmax, then the sign flag to this list item puts the ACK_RCVD flag bit; When this list item comprises two flag bits of ACK_RCVD and DATA_ACKD, delete this list item;
If: be not more than sndmax, then finish, change step (2.2.4.2) over to;
Step (2.2.4.2) is to P0 each list item in the TVmap mapping table in the other direction, and whether the affirmation sequence number of checking P0 is greater than the rcvmax of list item;
If: greater than rcvmax, then the sign flag to this list item puts the DATA_ACKD flag bit, when this list item comprises two flag bits of ACK_RCVD and DATA_ACKD, deletes this list item;
If: be not more than sndmax, then finish, change step (2.2.5) over to;
Step (2.2.5) E-Packets.
2. the method for determining initiation relationship between the TCP message based on TCP timestamp option according to claim 1, it is characterized in that: whether the message of receiving in judgement belongs to existing TCP connection side, perhaps revise the timestamp value of this message, perhaps revise the echo response value of this message, all will judge the TCP check of this message and whether correct earlier.
3. the method for determining initiation relationship between the TCP message based on the timestamp option of TCP according to claim 2, it is characterized in that: before modification message echo is replied, a step of determining to connect the message corresponding relation according to current TCP heading is arranged, to carry out on-line analysis according to the application combination of selected hardware device, perhaps the TCP heading of message be preserved and got off to carry out off-line analysis.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100563928A CN101217429B (en) | 2008-01-18 | 2008-01-18 | A determination method of the initiation relationship within TCP messages based on TCP timestamp options |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100563928A CN101217429B (en) | 2008-01-18 | 2008-01-18 | A determination method of the initiation relationship within TCP messages based on TCP timestamp options |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101217429A true CN101217429A (en) | 2008-07-09 |
| CN101217429B CN101217429B (en) | 2010-09-29 |
Family
ID=39623793
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008100563928A Expired - Fee Related CN101217429B (en) | 2008-01-18 | 2008-01-18 | A determination method of the initiation relationship within TCP messages based on TCP timestamp options |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101217429B (en) |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101854309A (en) * | 2010-06-18 | 2010-10-06 | 中兴通讯股份有限公司 | Method and apparatus for managing message output |
| CN102045251B (en) * | 2009-10-20 | 2012-08-22 | 国基电子（上海）有限公司 | Router and TCP (Transmission Control Protocol) port defense method |
| CN103138904A (en) * | 2011-11-30 | 2013-06-05 | 鼎桥通信技术有限公司 | Message processing method, message processing device and message processing system |
| CN103152134A (en) * | 2013-02-26 | 2013-06-12 | 汉柏科技有限公司 | Real time protocol (RTP)-based method and system for rearranging voice packets at receiving end |
| CN103475530A (en) * | 2012-06-06 | 2013-12-25 | 深圳市腾讯计算机***有限公司 | Internet velocity measurement method and device |
| CN105429802A (en) * | 2015-12-11 | 2016-03-23 | 小米科技有限责任公司 | Method and device for determining quality data and server |
| WO2017067224A1 (en) * | 2015-10-23 | 2017-04-27 | 中兴通讯股份有限公司 | Packet processing method and apparatus |
| CN109729047A (en) * | 2017-10-30 | 2019-05-07 | 阿里巴巴集团控股有限公司 | A kind of message processing method and device |
| CN109756498A (en) * | 2019-01-04 | 2019-05-14 | 烽火通信科技股份有限公司 | The NAT ALG conversion method and system of Transmission Control Protocol on communication equipment |
| CN110034973A (en) * | 2018-12-19 | 2019-07-19 | 锐捷网络股份有限公司 | Forwarding mapping listing maintenance and device based on the network equipment |
| CN110191174A (en) * | 2019-05-28 | 2019-08-30 | 西门子（上海）电气传动设备有限公司 | Data monitoring system, method and computer-readable medium based on http protocol |
| CN111200586A (en) * | 2018-11-20 | 2020-05-26 | 西门子股份公司 | Connection identification method with function safety |
| WO2021088438A1 (en) * | 2019-11-05 | 2021-05-14 | 华为技术有限公司 | Access device type determination method, device and system |
| CN113726867A (en) * | 2021-08-26 | 2021-11-30 | 杭州迪普科技股份有限公司 | Message processing method, device and system |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103259768B (en) * | 2012-02-17 | 2018-06-19 | 中兴通讯股份有限公司 | A kind of message authentication method, system and device |
-
2008
- 2008-01-18 CN CN2008100563928A patent/CN101217429B/en not_active Expired - Fee Related
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102045251B (en) * | 2009-10-20 | 2012-08-22 | 国基电子（上海）有限公司 | Router and TCP (Transmission Control Protocol) port defense method |
| CN101854309A (en) * | 2010-06-18 | 2010-10-06 | 中兴通讯股份有限公司 | Method and apparatus for managing message output |
| CN103138904A (en) * | 2011-11-30 | 2013-06-05 | 鼎桥通信技术有限公司 | Message processing method, message processing device and message processing system |
| CN103475530A (en) * | 2012-06-06 | 2013-12-25 | 深圳市腾讯计算机***有限公司 | Internet velocity measurement method and device |
| CN103152134A (en) * | 2013-02-26 | 2013-06-12 | 汉柏科技有限公司 | Real time protocol (RTP)-based method and system for rearranging voice packets at receiving end |
| CN103152134B (en) * | 2013-02-26 | 2015-12-02 | 汉柏科技有限公司 | Receiving terminal based on Real-time Transport Protocol resets the method and system of voice packet |
| WO2017067224A1 (en) * | 2015-10-23 | 2017-04-27 | 中兴通讯股份有限公司 | Packet processing method and apparatus |
| CN105429802B (en) * | 2015-12-11 | 2018-09-04 | 小米科技有限责任公司 | The determination method, apparatus and server of qualitative data |
| CN105429802A (en) * | 2015-12-11 | 2016-03-23 | 小米科技有限责任公司 | Method and device for determining quality data and server |
| CN109729047A (en) * | 2017-10-30 | 2019-05-07 | 阿里巴巴集团控股有限公司 | A kind of message processing method and device |
| CN111200586A (en) * | 2018-11-20 | 2020-05-26 | 西门子股份公司 | Connection identification method with function safety |
| CN110034973A (en) * | 2018-12-19 | 2019-07-19 | 锐捷网络股份有限公司 | Forwarding mapping listing maintenance and device based on the network equipment |
| CN109756498A (en) * | 2019-01-04 | 2019-05-14 | 烽火通信科技股份有限公司 | The NAT ALG conversion method and system of Transmission Control Protocol on communication equipment |
| CN109756498B (en) * | 2019-01-04 | 2021-05-28 | 烽火通信科技股份有限公司 | NAT ALG conversion method and system of TCP protocol on communication equipment |
| CN110191174A (en) * | 2019-05-28 | 2019-08-30 | 西门子（上海）电气传动设备有限公司 | Data monitoring system, method and computer-readable medium based on http protocol |
| WO2021088438A1 (en) * | 2019-11-05 | 2021-05-14 | 华为技术有限公司 | Access device type determination method, device and system |
| CN113726867A (en) * | 2021-08-26 | 2021-11-30 | 杭州迪普科技股份有限公司 | Message processing method, device and system |
| CN113726867B (en) * | 2021-08-26 | 2024-04-30 | 杭州迪普科技股份有限公司 | Message processing method, device and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101217429B (en) | 2010-09-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101217429B (en) | A determination method of the initiation relationship within TCP messages based on TCP timestamp options | |
| CN101409706B (en) | Method, system and relevant equipment for distributing data of edge network | |
| CN100384180C (en) | Method and apparatus for monitoring traffic in network | |
| CN101184003B (en) | NMP based front and background alarm management system and management method thereof | |
| Mogul | Observing TCP dynamics in real networks | |
| JP5270901B2 (en) | Network test apparatus and method | |
| US20040264434A1 (en) | Determining round-trip time delay | |
| CN102857354B (en) | Alarm information reporting method, apparatus and system | |
| CN102150395A (en) | Method for non-cooperative measurement of network data-path quality | |
| CN111083161A (en) | Data transmission processing method and device and Internet of things equipment | |
| CN104025550B (en) | The method and device of information is obtained from data item | |
| KR102046792B1 (en) | Method of transporting data from sending node to destination node | |
| CN107360177B (en) | A kind of message transmitting method and device based on UDP | |
| EP2498443A1 (en) | Metadata capture for testing TCP connections | |
| CN106506124A (en) | Retransmit message and determine method and device | |
| CN111478865A (en) | TCP stream reconfiguration technology based on interval management algorithm | |
| US20170064489A1 (en) | Network system, method for determining communication quality, and analysis apparatus | |
| CN110838949A (en) | Network flow log recording method and device | |
| CN102238206A (en) | Image file packet retransmission method | |
| KR20220001606A (en) | Real-time packet data storing method and apparatus for mass network monitoring | |
| Kulkarni et al. | Analysis of tcp performance in data center networks | |
| CN113645008A (en) | Message protocol overtime retransmission method and system based on linked list | |
| KR20220001605A (en) | Real-time packet data collection method and apparatus for mass network monitoring | |
| CN114189565B (en) | Head area restoration system, method and related equipment | |
| CN109842465A (en) | Data transmission method, data end equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20100929 Termination date: 20220118 |