| 摘要 |
Method and apparatus for processing computer network data. An embodiment of the invention comprises a first device for receiving a stream of data, said stream comprising at least a first data frame, said first data frame having been sent from a second device 101 to a third device 201, the first data frame containing a payload section and at least one header section, the first device comprising: a TCP data reassembly apparatus 10 communicatively coupled to a monitoring application 16 and a memory 14. The TCP data reassembly apparatus 10 is adapted to receive the stream of data and classify the first data frame as containing one of a TCP/IP segment, a UDP/IP datagram, a non-TCP/UDP IP packet, and a non-IP packet; supply the monitoring application 16 with a copy of the first data frame and send the first data frame to the third device 201 from the first device 101 when the first data frame is classified as containing one of a non-TCP/UDP IP packet and a non-IP packet. The TCP data reassembly apparatus 10 is also adapted to check an associated UDP header checksum for validity when the first data frame is classified as containing a UDP/IP datagram and supply the monitoring application 16 with a copy of the first data frame and send the first data frame to the third device from the first device 101 when the UDP header checksum is valid. The TCP data reassembly apparatus 10 is further adapted to check an associated TCP header checksum for validity when the first data frame is classified as containing a TCP/IP segment, and send the first data frame to the third device 201 from the first device 101 and compare an actual TCP header sequence number with an expected TCP header sequence number when the associated TCP header checksum is valid; and supply the monitoring application 16 with a copy of the TCP/IP segment when no gap exists between the sequence number and the expected sequence number, and, store the first data frame in the memory 14 when a sequence gap exists between the actual TCP header sequence number and the expected TCP header sequence number.
|
