Research In Techniques Of Network Traffic Monitor And Packet Sampling Methodologies

Along with the network technology rapid development, the network transmission service type has involed from the simple low bandwidth request document transmission, email and so on to the data, the voice, the video and so on.And the requirement for reliability, real time, security is more and more high. Under this background, It is necessary to inspect and evaluate the network condition, the network performance to guarantee network and the network service normal operation, and these are exactly the scope of traffic engineering and the network behavior researchThe goal of traffic engineering and network behavior research lies in the accurate measurement and evaluation of the network condition and network performance. And it is easy to make the network end-user to see and to understand the result, to respond effectively to unexpected event ,to investgate and improve the network protocols and network working pattern mechanism,to promote the network service reliability.Through traffic engineering,onecan grasp basic characteristic of the network behavior,more important, can model and simulate according to the network behavior characteristic. Through measurement, modelling , analysis and emulation,one can have a direct recognition to network performance. It is helpful to the future network design and the plan.According to the different content and direction, The traffic engineering and the network behavior has different research method.Network measurement is mainly basic on characteristic of measurement parameter ,incorporating with basic type of network transmission,deisgn and realize measuring method. From the standpoint of measurement parameter,measurement method can be divided into one-time measurement method, sampling measurement method,for the latter,It is neccesery to select appropriate sampling method incorporate with characteristic of measurement parameter. From the standpoint of measurement mechanism ,it can be divided into active measurement and passive measurement. Active measuremen is the method to inject flow to network in order to check two specified points.is the method to collect and measure flow information pass by the network.In comparison with Active measurement, Passive measurement has no additional flow.IP network measurement have three aspect: performance check-up and analysis,network topology finding and network flow measurement.network flow measurement is important content of network measurement,it has very particular sense for various application including network condition analysis, Trouble removal, the network jam adjust,network management, invade check and flow counting.It is also the basement of network behaviour modelling,network protocols analysis,many research organizatione and company have carry out deeply research on network flow measurement,and work out many actual applied technique.The normal method to realize networt flow measurment is use software or hardware on network equipment to collect flow information,it belong to Passive measurement.Analysis and record of packet in the network is the basis of network flow measurement,along with popularity of network and more and more application appear,flow in network increase intensity,In this environment,measurement equipment cann't satiety for this demand,Sampling method is thought as a good Solution.Only if Sampling method is reasonal,this method can Accomplish perfectly. Now existing method such as NETFLOW and SFLOW all introduce Sampling method to view proportion of Packet flow.Due to characteristic of persistance and high arrival frequency of packet flow,It require sampling logic can make determination immediately,self-adaptation sampling method is relative complication,also it is not easy to achieve; Furthermore, in some flow measurement such as those in order to obtain statistics feature and information,often need more treatment to sampling data.But self-adaptation sampling method have no regular sampling parameter and sampling ratio.So self-adaptation sampling method is not suitable for flow measurment in purpose with flow statistics feature and information.. Trajectory sampling method is design in some specialized application,it is not suitable for flow measurment in purpose with flow statistics feature and information too.Traditional sampling method have simple logic, simple sampling parameter and sampling ratio is regular,it is suitable for these purpose.Traditional sampling method is most suitable for flow measurment in purpose with flow statistics feature and information.Among traditional sampling method ,the most common used method is layered system sampling,layered random sampling and Poisson Poisson distribution.these three sampling method have no obvious difference in data packet length distribution,protocol distribution,income and out flow amount in unit time,IP packet amount. data packet length distribution,protocol distribution require less Precision. Sampling data have good performance,but is not so good at protocol distribution.Basis on reseach in techniques of network traffic monitor and packet sampling method,The author design and realize a packet sampling system using flow direct capture method. In terms of Ethernet principle, capture data packet in Ethernet, support variou Traditional sampling method. at the same time, Inquire about statistical informationat at regular time to get more auxiliary information in the network port.