网络流量监控及分析工具的设计与实现

网络流量监控及分析工具的设计与实现摘要互联网迅速发展的同时，网络安全问题日益成为人们关注的焦点，病毒、恶意攻击、非法访问等都容易影响网络的正常运行，多种网络防御技术被综合应用到网络安全管理体系中，流量监控系统便是其中一种分析网络状况的有效方法，它从数据包流量分析角度，通过实时地收集和监视网络数据包信息，来检查是否有违反安全策略的行为和网络工作异常的迹象。在研究网络数据包捕获、TCP/IP原理的基础上，采用面向对象的方法进行了需求分析与功能设计。该系统在VisualC++6.0环境下进行开发，综合采用了Socket-Raw、注册表编程和IP助手API等VC编程技术，在系统需求分析的基础上，对主要功能的实现方案和技术细节进行了详细分析与设计，并通过测试，最终实现了数据包捕获、流量监视与统计主要功能，达到了预定要求，为网络管理员了解网络运行状态提供了参考。关键词：网络管理；数据采集；流量统计；Winsock2TheDesignandImplementationofMonitoringandAnalyzingToolforNetworkTrafficAbstractWiththerapiddevelopmentofInternet,networksafetyhasbecomepeople’sconcern,virus,vigorousattack,illegalvisitandsooncaneasilyaffectthenormalnetworkperformance.Variouskindsofnetworkdefendingtechnologyhavebeencomprehensivelyappliedintothemanagementsystemofnetworksafety.Networktrafficsystemisoneoftheeffectivemeasurestoanalysisnetworkcondition.Fromtheangleofanalyzingpackettraffic,itcanexaminethesafetyviolationandtheabnormalperformanceofnetworkbytimelycollectingandmonitoringpacketsinformation.Byusingthewayofobject-oriented,thisdesignmakesaneedsanalysisandabilitydesigningbasedonthestudyofnetworkpacketcollectingandTCP/IPtheory.UndertheenvironmentofVisualC++6.0,thissystemadoptsVCprogramtechnologiesofSocket-Raw,WindowsregisterandIpHelperAPI.Onthebasisofsystemanalysis,itmakesadeliberateanalysisandtestofplansanddetailstoimplementpacketscollecting,trafficmonitoringandstatistics.Sothismeetsourneedsandmakesareferenceformanagerstogettoknowthenetworkconditions.Keywords:networkmanagement;datacollection;trafficanalysis;Winsock2目录论文总页数：22页1引言...........................................................................................................................................11.1课题背景...........................................................................................................................11.2网络安全管理的现状与需求...........................................................................................11.3网络流量监控的引入.......................................................................................................11.4本文的目的与任务...........................................................................................................21.5论文结构安排...................................................................................................................22相关的概念与技术...................................................................................................................22.1OSI参考模型与TCP/IP体系结构.................................................................................22.1.1OSI参考模型...........................................................................................................22.1.2TCP/IP体系结构......................................................................................................32.1.3OSI模型与TCP/IP体系结构的区别......................................................................42.2传输层的编程接口—Windows套接字编程技术...........................................................42.2.1Windows套接字的概念...........................................................................................42.2.2套接字类型...............................................................................................................52.2.3涉及的几个基本概念...............................................................................................52.3原始套接字.......................................................................................................................53网络数据的采集技术分析.......................................................................................................63.1Windows下原始数据包捕获的实现...............................................................................63.2原始数据包捕获的关键函数...........................................................................................74网络流量监控系统各模块的设计与实现...............................................................................94.1开发背景介绍...................................................................................................................94.2总体结构设计...................................................................................................................94.3流程图设计.....................................................................................................................104.4各模块功能概述与实现.................................................................................................114.4.1数据包采集中各类的关系.....................................................................................114.4.2数据包捕获与分析模块.........................................................................................114.4.3流量获取模块.........................................................................................................134.4.4数据统计模块.........................................................................................................174.4.5常见攻击分析功能.................................................................................................185系统测试.................................................................................................................................195.1测试环境.............