Monitoring And Analysis Of Network Information

Computer network technology is widely applied in many fields today, the function of which is more powerful day after day meanwhile the complexity of which is raised. All of this benefits people much whereas takes a great deal of difficulty to people when they design, maintain and secure the products about network. As a result the tools for analyzing , diagnosing and testing the performance and security of the network is increasing needed. These tools have to attain data in the line when the network is in use and inspect the network data in real time. Inspecting information of the network is one of the important aspects of the network security, which do great important to the diagnosis and management of the network devices.The work of this paper is based on the deep research to the principle of the network functions about catching data package, filtering data package ,analyzing data package and statistic . As a result a set of software system about network inspecting ------NetMAS is designed and implemented. The work mainly include:1. We do some deep research on the toolkit WinPcap for network inspecting under Windows environment, then several feasible methods for raising the rate of attaining data package are proposed. (1) configure kernel cache of appropriate size (2) configure cache of appropriate size for users (3)configure the most strict filter condition . We also describe how to use the toolkit as the bottom interface of our software------NetMAS.2. The characteristics of NetMAS lie in taking the protocols in the network as a series of classes of heritable relations each. At the same time appropriate data members(for example the structure variation for describing heads of protocols of each layer) and methods(for example the methods for valuing those structures and attain the values of the structures).If a kind of protocol has to added , we only need to find corresponding father class in class heritable system and derives a subclass, then implement corresponding methods. As a result the application fields of the network inspecting procedure is enlarged.3. An implement policy of a kind of data package filtering module is proposed.