Network Monitoring Technology And Its Countermeasures

Recently, network sniffing has been a sensitive topic of computer network security. It can bring not only convenience but also harm. Encryption is the most effective measure of dealing with network sniffing. But encrypting packet with software not only occupies the resource of CPU, but also degrades the performance of network. It can realize precaution of network sniffing by the approach of fixing encrypted network cark, which integrated arithmetic, to realize the data's security. This thesis studies emphatically network sniffing technology and the application of encrypted network card in network sniffing.The thesis at first gives the basic concept and principle of related to network sniffing, and then summarizes the protocol structure of TCP/IP, the system structure of Ethernet and the basic knowledge of IP Security protocol. In particular, it studies on the IPSec in detail and analyzes the working mechanism of IPSec, the importance of the security association. On the basis of these, the data encapsulation formats of the Authentication Header (AH) and the Encapsulation Security Payload (ESP) and the realization of security policy database (SPD) are discussed.On these basic theories, the thesis lucubrates the technology of network sniffing. It discusses the principle, component, use and significance, and then introduces some tools about realizing network sniffing. Following, it discusses the detecting measure and precautionary measures. If it is set to promiscuous mode, network interface controller (NIC) can incept all data packet to monitor. There are many means such as PING, ARP for the detecting of network sniffing. There are many means for the precaution of network sniffing too, such as encrypting information, using secure topology and plotting VLAN by utilizing switch. In all of the means, encrypting information is the most effective, so the tradition encryption algorithm and the public key algorithm that are the most fashionable are studied, at the same time, algorithms DES and RS A which are representative used widely are analyzed.To combine the encrypted algorithm with Ethernet network card, on the basic knowledge of IPSEC, the thesis studies the composition of network card and its function, at one time, it analyses the processing of the sending and incepting data viaNIC. According to the above contents, the thesis implements the scheme of security network card, which includes implementing the encryption function on the hardware of the network card, and implementing the IPSec transacted function. Further, the implementation of IPSec is discussed, the principle chart of data transacting safely is given, and discusses the processing of the inbound and outbound data packets via encrypted NIC. At last, it expatiates the application of encrypted network card that is used in network sniffing, that is to say, each computer is fixed encrypted network so that it can defend network monitored.