Design And Implementation Of Tight Coupling NetStream System For Network Traffic Collection

NetStream is a kind of flow based network traffic collecting technology proposed by H3C. It can be used to collect information of the packets flowing trough devices, and the traffic data is sent to NetStream servers for statistical analysis. The results can be used in network accounting, network planning, network anomaly monitoring, et al. At present, there are two main ways to implement NetStream system. The first one is to embed the NetStream as a service subsystem into the operating system of the switch. The disadvantage of this method is that the packet forwarding efficiency will be affected. The second way is to use loose coupling NetStream card, which sloves the defects in embedded mode. However, in loose coupling system, not only the configuration is complex, but also the traffic information is distorted.In order to solve the problems of the embedded mode and the loose coupling card, the tight coupling scheme of NetStream card is proposed. In this form, the traffic acquisition function of NetStream is separated from the switch operating system, but the switch still retains the configuration management function of NetStream, which is used to control and manage the tight coupling system. When arriving at the switch, the Packet will be copied, and the duplicate is delivered to the NetStream card for traffic acquisition through port mirroring. However, the forwarding process of the original packet will continue.The main work of this thesis includes the following aspects:1) On the basis of introducing the technology principle of NetStream, the requirements of the tight NetStream system are analyzed and the overall architechure design is completed. Requirements such as switching of traffic acquisition mode, integrated management and non-differential traffic acquisition are supported by the tight coupled NetStream system, and some new requirements like dynamic aggregation and export load balance are added to it. In overall design, the main functions of master control board, interface board and NetStream card are described respectively, and the whole system is decomposed into four modules.2) The design and implementation of the system configuration is completed. Some new configuration commands and corresponding processing functions are added, and the original processes of system configuration are improved. In the original NetStream system, configuration messages are initiated by the master control board and processed mainly on the interface boards. In the tight coupling NetStream system, configuration messages are still produced on the master control board, but the main processing work is transfered to the NetStream card, only some auxiliary work is handled on the interface boards.3) The event processing module has been extended and improved. Processing of VLAN event is added, and the processing of interface activate and deactivate are changed too, to which the creation and deletion of port mirroring are added.4) In view of the traffic acquisition function, a new entry function is adopted, which is called by the system driver to complete the packet information acquisition. In addition, functions of dynamic aggregation and export load balance are added to it.5) The information display module is redesigned. Since all the traffic information is stored in the tight coupling card, the process of information obtain also needs to be improved. In the tight coupling NetStream system, traffic information is only obtained from NetStream card instead of all interface boards.Finally, extensive experiments are conducted. The results indicate that the tight couping NetStream system achieves the expected requirements, and the use of integrated management and port mirroring can solve problems of complex configuration and distortion of traffic information in loose coupling system respectively.