Internet Users Behavior Analysis System Research And Implementation In Campus Network

New network protocols emerging and network traffic exponential growth make Internet traffic monitoring very difficult. Some applications use a range of port numbers or dynamically allocated ones for their sub-transactions. And some several Internet applications use the same port number. This means that the traditional traffic monitoring method based on the well-known ports is not sufficiently reliable and accurate. This paper describes a signature-based matching method to identify peer-to-peer and multimedia applications. First, we use Libpcap to capture all data packets passing the monitor mainframe. Then we use callback function pcap_loop() to analyze TCP and UDP and get the well-known port numbers of applications. Finally, we use signature-matching method to parse the payload of data packet. The results of parsing provide the basis for merging data flows. The monitor mainframe is connected to a hub which is connected with an eight-port switch. The statistics results are presented to the network administrator with Web browser.