The Design And Implementation Of Traffic Monitoring And Analysis System For China's TT&C Network

With the unified design and construction of information system for China's TT&C,the space flight information is transmitted through a private IP network,which causes requirements for monitoring and analysing network traffic at the same time.In particular,the real-time data exchange plays a pivotal role in the process of the space flight mission,but the essential data encapsulated by custom-built PDXP(Packet Data eXchange Protocol)network protocols is not able to be identified and monitored by network management system and commercial software.In order to solve this problem,it is necessary to design and develop a private traffic monitoring and analysis system for TT&C network according to the network structure and application features.A feasible solution is offered based on the in-depth study of the related technologies for traffic monitoring and analysis,which just collects data from network by the packet capture software and identifies the real-time data in application layer by means of DPI(Deep Packet Inspection)and port matching.The system is composed of hardware and software and its functions are fully shared between them both.The application software has hierarchical and modular logical architecture,consisting of 4 independent processes: Wireshark Comprehensive Analysis,Real-time Traffic Capture and Statistics,Web Server Real-time Push and Post Private Traffic Analysis.To accelerate the software development,Wireshark,WinPcap and other open source codes are used and common modules are reused in appropriate ways.The system can achieve multi-port traffic acquisition and multi-machine parallel monitoring and analysis through the traffic replication and distribution provided by TAP(Test Access Point)device.The main research results of this dissertation are as follows:1,Having the support of the hardware and software,optimizing the design of the program,the system running on a common computer can monitor and analyze high-speed traffic.It is quite suitable to be popularized in TT&C system for its high performance of traffic collection,good expansibility of application protocol and low cost.2,A DPI method for identifying real-time data traffic based on regular expression matching is proposed,which can accurately describe the application protocol features,and has high recognition speed and accuracy.It fills up a gap of the function of the network management system and the network tool software used by XXX unit.3,The Web server real-time push distributes traffic information subscribed by the page on a browser accurately and efficiently in manner of multicast.This technology overcomes the shortcoming of aimless push in C/S application.Its performance is similar to that of the C/S mode push.It gives better access to information,which makes it easier to monitor anytime and anywhere.The application has good prospects.4,The baseline of traffic is established from analyzing the packages acquired by the system for various types of the space flight mission,which serves as a credible reference in rapid diagnosing fault in the network and accurate evaluating performance of the network.The testing and applying results show that the system can meet the great needs for routine monitoring and precise analysing real-time data on the space flight mission,and has played an important role in data communication.