局域网监听系统设计与实现
摘要：局域网的监听系统可以监视网络的状态,并利用这些信息分析网络性能等。本文介绍了局域网监听的基本原理和它的系统实现实现,系统设计包括用户界面部分、数据包的捕获与过滤部分、监听检测部分、数据解码部分。 关键词:网络安全; 局域网技术;网络监听 Abstract: LAN network monitoring system can monitor the status and use the information network performance analysis, and so on. In this paper, LAN monitor the basic principles and systems to achieve its realization, systems design, including part of the user interface, data capture and packet filtering of the eavesdropping detection of the decoding of the data.
对于目前很流行的以太网协议,其工作方式是:将要发送的数据包发往连接在一起的所有主机,包中包含着应该接收数据包主机的正确地址,只有与数据包中目标地址一致的那台主机才能接收。但是,当主机工作监听模式下,无论数据包中的目标地址是什么,主机都将接收(当然只能监听经过自己网络接口的那些包)。在因特网上有很多使用以太网协议的局域网,许多主机通过电缆、集线器连在一起。当同一网络中的两台主机通信的时候,源主机将写有目的的主机地址的数据包直接发向目的主机。但这种数据包不能在IP层直接发送,必须从TCP/IP协议的IP层交给网络接口,也就是数据链路层,而网络接口是不会识别IP地址的,因此在网络接口数据包又增加了一部分以太帧头的信息。在帧头中有两个域,分别为只有网络接口才能识别的源主机和目的主机的物理地址,这是一个与IP地址相对应的
LAN monitoring system design and implementation of
Abstract: The local area network monitoring system can monitor the network status, and use this information to analyze network performance. This article describes the basic principles of the LAN monitoring and its implementation of the system implementation, system design, including the user interface part of the packet capture and filtering part, listening test section, the data decoding part.
Key words: network security; LAN technology; Network Monitoring
Abstract: LAN network monitoring system can monitor the status and use the information network performance analysis, and so on. In this paper, LAN monitor the basic principles and systems to achieve its realization, systems design, including part of the user interface, data capture and packet filtering of the eavesdropping detection of the decoding of the data.
Key words: network security; LAN technology; eavesdropping
Directory
Chapter Foreword 2
Chapter II the principle of local area network monitoring and prevention of 3
2.1 Network Monitoring 4
2.2 In the local area network to achieve the basic principles of listening 4
2.3 Monitor the simple realization of 5
2.4 How to detect and prevent network monitoring 5
2.4.1 on the possible detection of network monitoring 5
2.4.2 Network Monitoring and preventive measures for six
Chapter 7 outlines monitoring and detection of
3.1 Monitor Overview 7
2.2 Detection of an overview of 8
Chapter III programs part of the implementation of nine
3.1 The overall design process 9
3.2 interface, part of the 10
3.3 Ethernet packet capture 11
3.4 packet filtering 11
3.5 packet decoding 12
3.6 Monitor detection 13
Chapter IV Local Area Network Monitoring System Design 15
4.2 module division and functional design 16
4.2.1 Console Subsystem 16
4.2.2 monitoring agent subsystem 16
4.2.3 Communication Module 17
4.3 LAN monitoring system detailed design of the 18
4.3.1 Network Monitoring Module 18
4.3.2 LAN monitoring module structure design 19
4.3.3 Information content analysis module design 23
Chapter V LAN monitoring system test 32
Conclusion 36
References 37
Chapter Preface
With the development of computer technology, the network has increasingly become an indispensable tool in life, but comes with the illegal invasion has also been threatening the security of computer network system. As the use of LAN broadcast, therefore, in a broadcast domain, you can listen to all packets. The hacker through packet analysis, you can access the LAN to transmit some of the important information. In fact, many regard the local area network hacking scanning and listening as their most basic steps and tools is because we wish to use this method to obtain the desired password and other information. On the other hand, we are hacking activities and other cyber crime investigation, evidence collection, you can also use network monitoring to obtain the necessary information. Therefore, the understanding of Ethernet technology, the principle of monitoring, implementation and preventive measures becomes particularly important.
Network monitoring network security has always been a sensitive topic. On the one hand, the network monitoring in assisting the network administrator to monitor network traffic, remove network failure, etc. has an irreplaceable role; the other hand, the Ethernet network monitoring also brought great security risks, many network intrusion are often accompanied by the Ethernet network monitoring within the behavior, resulting in stolen passwords and sensitive data from being intercepted by such incidents. In fact, in the network, when the information transmitted when the network interface can use the tool to set listening mode, it will be the network is spreading the information intercepted or captured, and thus attack.
Commonly used in Ethernet LAN broadcast transmission of data, so both the physical address of the packet goal of what is in the same local area network physical layer within the host can receive the sent packets. However, only the data packets in the same physical layer destination address of that host until the data packets sent to the upper procedure and process. However, when a host''s NIC work in promiscuous mode, then regardless of the physical layer packet destination address what is the host of the top programs can get to the data packet. This is the basic principle of network monitoring.
This paper describes the Ethernet local area network packet monitoring, as well as monitoring principle and methods of detection, and then monitoring and testing of the implementation principle of starting to design a monitoring and detection capabilities at the same time with the software system. In order to facilitate programming, using the current popular development tools, Visual C 10 languages, using object-oriented (OOP) design concepts to design each module to facilitate the future development of the entire software system and upgrading of male protection.
Chapter II the principle of local area network monitoring and prevention of
According to the description of IEEE, LAN technology is "scattered in a building or several buildings adjacent to the computers, terminals, mass storage peripherals, controllers, monitors, as well as connected to other networks using network connection , etc. have been linked to a high speed communication means. " LAN has device sharing, information sharing, can be high-speed data communications and multimedia information and communications, distributed processing, high compatibility and safety and other basic functions and features. LAN is currently mainly used in office automation and campus teaching and management, and can be shaped according to specific adaptation of the bus, ring, tree and star-shaped topology.
2.1 Network Monitoring
Network monitoring technology was originally provided to the network security management personnel management tool, can be used to monitor the status of the network, data flow and information transmitted over the network. When the information is in the form of clear text transmitted over the network, the use of eavesdropping technology is not a difficult attack, as long as the network interface to set the listening mode, it can be an endless stream of information transmitted over the Internet interception. Network monitoring can be implemented online in any one location, such as local area networks in a host, gateway or remote network, modem, etc. between.
2.2 In the local area network to achieve the basic principles of listening
For the present it is very popular Ethernet protocol, its methods of work are: to send the packet to be sent to all hosts connected together, the package should receive the packet contains the correct address of the host, only the destination address and data packets in the same of that host in order to receive. However, when the master work of listening mode, regardless of the packet in the destination address what the host will receive (of course, only through its own network interface monitor those packages). There are many on the Internet using the Ethernet protocol for local area network, many of the host through the cable, hubs together. When the same network when the two host communication, the source host will host address written on the purpose of the data packets directly sent to the destination host. However, this can not be IP-layer packets sent directly to be from the TCP / IP protocol of the IP layer to the network interface, which is the data link layer, while the network interface will not recognize IP addresses, so the network interface data packet added to part of the Ethernet frame header information. There are two fields in the header, namely, only the network interface in order to identify the source host and destination host''s physical address, which is an IP address corresponding to the
