| Nowadays network communication is developing toward the broadband, which causes the increase of network data throughput. This increase brings much more valuable information and requires stronger protection of network security. Now many of the domestic or foreign network security products are faced to low-speed user network, which can only deal with the data speed below 100Mbps and can not cope with the networks with higher and higher speed.Based on the research of reverting and analyzing TCP message technology, a system is designed and realized in this paper to revert and analyze TCP message in real time. A series of works are accomplished in the system, including incepting data, analyzing IP package in real time, reverting TCP message in real time, analyzing main protocols on application layer and data filter. Because the broadband data has high speed so that it needs strong capability of data disposal. In this paper three key points are emphasized to optimize design in order that the system can work above the speed of 300Mbps.1) The suitable design of high speed package catching interface. In this paper the ZERO-COPY-SNIFF is realized in 600Mbps and WinPcap in 300Mbps.Through capability testing, the quantitative analysis of the package catching speed and the CPU occupancy for the two way of package catching are also achieved.2) The suitable algorithm to manage complex links and to search links quickly. There are three different ways of HASH algorithm compared in this paper to prove that CRC32 is the fittest one for the throughput speed above 300Mbps.3) Memory management. Optimized design of memory management is adopted to insure high-speed data cache. The relations between memory assignment and various kinds of IP packages are discussed using Queue theory. It is also proved in this paper that the heightening of the TCP data disposal rate would decrease the length of queue and the speed of TCP data disposal is the main factor to influence... |
PDF Full Text Request