Large-scale Network Traffic Monitoring And Network Behavior Analysis

Today's information society depends on computer network so much that the reliability of computer network has become a more crucial issue. Network traffic measurement is an effective means to gain the firsthand index of network behavior. It is an important step for knowing current network performance,avoiding off-the-line, finding out problem to carry out analysis and regulating network traffic at the regular intervals.The thesis introduces several common methods of traffic collections at first, and compares their in terms of general availability, realizability and efficiency, NetFlow protocol is emphasized. This thesis is concerned with summarizing traffic measurement, and comparison of the advantages and disadvantages among these methods is also presented. A realtime network traffic monitoring system is designed and implemented depending on HeNan education and research network, data collection module,data receiving module,data filtering module,user interface is introduced in detail. In the light of problem that arbitrary port contributes to eighty percent of network traffic. The thesis study the traffic characteristics of current traffic main body--P2P. Spatial and temporal characteristics of P2P traffic are presented through three most popular P2P softwares:BitTorrent, eMule, PPLive.P2P traffic is very uneven among peers, which don't fit well with power law distribution and P2P traffic are self-similar. Finally, Aiming at identifying arbitrary port traffic, a new process measurement, based on network behavior, was proposed, and applied to passive FTP, it has been implemented and tested in the real network environment. It is shown that this measurement is efficient and accurate.