The Research And Implementation Of NetSensor, A Traffic Charactering Network System

Nowadays, as converged networks become more prevalent and IP networks have been our trend, the future IP networks will be dominant in National Information Infrastructure. IP networks will play vital role in integrating voice, video, data networks and applications, but this integration makes IP traffic flow more and more complex and diversiform. For an efficient, secure and reliable network environment, it is critical to characterize traffic on the network momently. Monitoring IP traffic flow instantly answers who, when, what, where and how of network traffic. It facilities more accurate network planning and networking resource alignment, that is, ensuring that resources are utilized appropriately in support of organizational goals. It also help IT manager determine where to apply quality of service (QOS) and quickly detect denial of service (Dos) attacks.NetSensor, a traffic charactering network system, described by this thesis, is built into routers and Lay 3 switches, each one acting as a sensor. How does it work? There is concept called Flow in NetSensor system. A Flow can be identified by seven key fields: source IP address, source port number, destination IP address, destination port number, protocol, type of service, input interface. When a packet is received from router interface, the NetSensor system will check seven key fields in the packet and then make a decision: if the packet belongs to the existed flow, the statistics information of the flow will be updated, otherwise the system will create a new flow in cache for future coming packets. As the new flows continuously are created, the expired IP Flow information will be transferred by means of UDP from the router to a collector application which analyzes the data.The thesis introduces an algorithm named the custom aggregation algorithm. It describes that before gigabyte magnitude of expired IP flows are transferred to traffic analyzer, they need to do the specific aggregating operation in order to further reduce granularity of traffic and the custom aggregation means users can obtain any information that they need by configuring the specific aggregation. It not onlyimproves efficiency and availability of networking data, but also makes software more maintainable and expandable and save much cost of updating software version.With the popularity of P2P applications, such as BT downloaded they consume lots of bandwidth and result in many other network services and businesses not working properly. So there is growing need to identify P2P traffic, especially BT traffic . In this thesis, based on NetSensor, it proposes a new method called application protocol analysis to distinguish different kinds of P2P application. In addition to BT traffic control, we could also implement anther strategy called traffic accounting and billing based on NetSensor.