网络流量监控及分析工具的设计与实现
摘 要
互联网迅速发展的同时，网络安全问题日益成为人们关注的焦点，病毒、恶意攻击、非法访问等都容易影响网络的正常运行，多种网络防御技术被综合应用到网络安全管理体系中，流量监控系统便是其中一种分析网络状况的有效方法，它从数据包流量分析角度，通过实时地收集和监视网络数据包信息，来检查是否有违反安全策略的行为和网络工作异常的迹象。
在研究网络数据包捕获、 TCP/IP原理的基础上，采用面向对象的方法进行了需求分析与功能设计。该系统在VisualC++6.0环境下进行开发，综合采用了Socket-Raw、注册表编程和IP助手API等VC编程技术，在系统需求分析的基础上，对主要功能的实现方案和技术细节进行了详细分析与设计，并通过测试，最终实现了数据包捕获、流量监视与统计主要功能，达到了预定要求，为网络管理员了解网络运行状态提供了参考。
关键词：网络管理；数据采集；流量统计；Winsock2
The Design and Implementation of Monitoring and Analyzing Tool for Network Traffic
Abstract
With the rapid development of Internet, network safety has become people’s concern, virus, vigorous attack, illegal visit and so on can easily affect the normal network performance. Various kinds of network defending technology have been comprehensively applied into the management system of network safety. Network traffic system is one of the effective measures to analysis network condition. From the angle of analyzing packet traffic, it can examine the safety violation and the abnormal performance of network by timely collecting and monitoring packets information.
By using the way of object-oriented, this design makes a needs analysis and ability designing based on the study of network packet collecting and TCP/IP theory. Under the environment of Visual C++6.0, this system adopts VC program technologies of Socket-Raw, Windows register and IpHelper API. On the basis of system analysis, it makes a deliberate analysis and test of plans and details to implement packets collecting, traffic monitoring and statistics. So this meets our needs and makes a reference for managers to get to know the network conditions.
Key words: network management; data collection; traffic analysis; Winsock2
目 录
论文总页数：22页
1 引言 1
1.1 课题背景 1
1.2 网络安全管理的现状与需求 1
1.3 网络流量监控的引入 1
1.4 本文的目的与任务 2
1.5 论文结构安排 2
2 相关的概念与技术 2
2.1 OSI参考模型与TCP/IP体系结构 2
2.1.1 OSI参考模型 2
2.1.2 TCP/IP体系结构 3
2.1.3 OSI模型与TCP/IP体系结构的区别 4
2.2 传输层的编程接口—Windows套接字编程技术 4
2.2.1 Windows套接字的概念 4
2.2.2 套接字类型 5
2.2.3 涉及的几个基本概念 5
2.3 原始套接字 5
3 网络数据的采集技术分析 6
3.1 Windows下原始数据包捕获的实现 6
3.2 原始数据包捕获的关键函数 7
4 网络流量监控系统各模块的设计与实现 9
4.1 开发背景介绍 9
4.2 总体结构设计 9
4.3 流程图设计 10
4.4 各模块功能概述与实现 11
4.4.1 数据包采集中各类的关系 11
4.4.2 数据包捕获与分析模块 11
4.4.3 流量获取模块 13
4.4.4 数据统计模块 17
4.4.5 常见攻击分析功能 18
5 系统测试 19
5.1 测试环境 19
5.1.1 硬件环境 19
5.1.2 操作系统及软件运行环境 19
5.2 测试步骤 19
5.3 测试结果评价 19
结 论 19
参考文献 20
致 谢 21
声 明 22
Network traffic monitoring and analysis tools for the design and implementation of
Abstract
The rapid development of Internet, network security is increasingly become the focus of attention, viruses, malicious attacks, unauthorized access to the network and so easily affect the normal operation of a variety of network defense technology has been applied to a comprehensive network security management system, traffic monitoring system One analysis of network conditions is an effective method, which from the data packet traffic analysis point of view, to collect and monitor real-time network packet information, to check whether there are violations of security policy behavior and networking unusual signs.
Research network packet capture, TCP / IP theory, based on object-oriented methods of requirements analysis and functional design. The system developed under VisualC 6.0 environment, a combination of Socket-Raw, registry programming and IP helper API programming techniques such as VC in the system requirement analysis, based on the realization of the main functions of the program and conducted a detailed analysis of the technical details of and design, and passing a test, and ultimately the data packet capture, traffic monitoring and statistical main functions, reaching pre-determined requirements for the network administrator to understand the operation of the network state as a reference.
Keywords: network management; data collection; traffic statistics; Winsock2
The Design and Implementation of Monitoring and Analyzing Tool for Network Traffic
Abstract
With the rapid development of Internet, network safety has become people''s concern, virus, vigorous attack, illegal visit and so on can easily affect the normal network performance. Various kinds of network defending technology have been comprehensively applied into the management system of network safety. Network traffic system is one of the effective measures to analysis network condition. From the angle of analyzing packet traffic, it can examine the safety violation and the abnormal performance of network by timely collecting and monitoring packets information.
By using the way of object-oriented, this design makes a needs analysis and ability designing based on the study of network packet collecting and TCP / IP theory. Under the environment of Visual C 6.0, this system adopts VC program technologies of Socket-Raw , Windows register and IpHelper API. On the basis of system analysis, it makes a deliberate analysis and test of plans and details to implement packets collecting, traffic monitoring and statistics. So this meets our needs and makes a reference for managers to get to know the network conditions.
Key words: network management; data collection; traffic analysis; Winsock2
Directory
Paper Total Pages: 22
1 INTRODUCTION 1
1.1 Background 1 topic
1.2 Network Security Management of the status quo and demand a
1.3 The introduction of a network traffic monitor
1.4 The purpose of this article and Task 2
1.5 Papers structural arrangement 2
Two related concepts and techniques 2
2.1 OSI Reference Model and TCP / IP architecture, 2
2.1.1 OSI Reference Model 2
2.1.2 TCP / IP architecture 3
2.1.3 OSI model and TCP / IP architecture, the difference between 4
2.2 Transport layer programming interface-Windows Sockets Programming 4
2.2.1 Windows Sockets concept of four
2.2.2 Socket Type 5
2.2.3 Some basic concepts involved in 5
2.3 Raw Socket 5
3 Analysis of network data collection 6
3.1 Windows, under the realization of the original data packet capture 6
3.2 The raw data packet capture of the key function of 7
4 Network Traffic Monitoring System Design and Implementation of each module 9
4.1 Development Background 9
4.2 The overall structure of the design of 9
4.3 Design flow chart 10
4.4 Overview and implementation of various modules feature 11
4.4.1 Acquisition of various types of data packets between 11
4.4.2 Data packet capture and analysis module 11
4.4.3 Traffic acquisition module 13
4.4.4 Statistics Module 17
4.4.5 Common Attack analysis function 18
5 System Test 19
5.1 Test Environment 19
5.1.1 Hardware Environment 19
5.1.2 operating system and software operating environment 19
5.2 Test Steps 19
5.3 Evaluation of test results 19
Conclusion 19
References 20
Thanks 21
Statement 22
