The Research And Realization Of The Network Analysis And Detection System Based On Linux System

As an active security defense technology, network analysis and detection system makes up for the weaknesses of traditional security technologies.The network data packet analysis and detection system that we design according to the demand, work under Linux environment, can capture "header" of data packet totally that convey in the TCP/IP network, so as to analyse the whole packet though the "header". It is the foundation of Network performance analysis and Intrusion Detection. The system is implemented by C language and function library — libpcap that used to capture network data.The functions of this system realizes are as follows. First it can capture the data packet that flow through this host and the network in real time. Second it can change network data into readable form (utilizing C language to realize screen show). Third it can count the speed of network flow and the flow that local machine or the inward network uses in real time. Forth it can display statistical analysis data in the window by the curved line (utilizing TCL/TK). Fifth it can discover the question in the network. Sixth it can find the bottleneck and perform network Intrusion Detection. Seventh it can write down the daily record of network flow. Eighth it can analyse the application (such as WWW , Telnet , POP3 , SMTP etc.) operated. And finally it can perform protocols analysis.As far as the data packet capture is concerned, there are mature technology and products both at home and abroad.This system is mainly to serve as a kind of utility under the environment of simulation and LAN. And it also lays a foundation for Online security monitoring.