Research And Implementation Of Distributed Network Traffic Analysis System

Because of the rapid development of network, network users can easily and quickly obtain the needed information, resources, and they can get the services that they need. More and more network applications are rising, providing diffident kinds of services for users. Moreover, enterprises are increasingly depending on the network. From the communication in an enterprise to that between different enterprises, the way of communication is changing to the Internet connection. Although the development of the network meets the needs of users, it brings more and more challenges to network operators and users too. The large number of new rising applications, the limitations of network bandwidth and the potential danger of network security have made network analysis becoming an essential technology to maintain the normal state of network. In order to make sure that the network bandwidth is used effectively and that the normal service of network applications, more attention has been paid to network traffic analysis. An efficient technology of network traffic analysis is the premise of network effective use.Network traffic analysis technologies develop with the development of the Internet. According to the structure of the thesis, there are two types of important network traffic analysis techniques: network traffic analysis technology isn’t based on flows and that based on flows. There are three kinds of techniques that aren’t based on flows.The first one is network traffic analysis technique based on SNMP, which uses polling or interrupt to get information stored in equipment and then analyze these information to analyze the network traffic. This method has the advantages of simple structure and simple design. However, the need of polling and interrupt increases the burden of the network bandwidth. The second one is the technique based on probe. This method uses the network traffic collected by probes specifically designed for network traffic collection. The accuracy of this method is high, but it has high requirements on the equipment and it costs high prices, what’s more, the deployment is quite complex. The third one is based on traffic capture. By using techniques of traffic capture, this method accomplishes the analysis. It’s efficient for network with small amounts of traffic, but for network that has large amount of traffic flows this method becomes less effective. The technique that based on flows is now a very popular one. This method is widely applied, by using the definition of network flows and analyzing these flows. The accuracy of it is relatively high and it can adapt to networks with large amounts of flows.This paper will give an effective network traffic analysis system based on the existing analysis techniques, which is called distributed network traffic analysis system. It can solve the difficulties of analysis for network with large traffics and are able to represent visual results of the analysis. It provides accesses for network managers to observe the network directly, such as the current state of the network. What’s more, it can monitor abnormal traffic automatically such as P2P application. The system adopts distributed architecture to depart analysis parts to different servers, and then results of analysis are sent to the master server to present to users. This design can improve analysis efficiency and meet the demand for high-performance.