基于NDIS的网络流量高速检测和分析系统的研究与实现

【作者】 黄建；

【导师】 李毅超；

【作者基本信息】 电子科技大学 ， 软件工程， 2007， 硕士

【摘要】 Internet的飞速发展迫切需要提高它的性能，人们需要良好的服务质量(Quality of Service，QoS)和充分的安全保证。掌握IP网路的运行规律，对网络设备和协议的研究开发具有重要意义，从而也促使了网络测量的研究。本文的目标是给出一种能够较好的对网络进行检测和分析的软件系统。本文首先从网络测量的现状、网络测量的意义、测量方法分类、测量参数和关键技术等多个方面对网络测量进行了介绍。较为深入的讨论了被动模式测量及相关关键技术，包括：高性能包捕获技术、高速流分类技术和高速流跟踪技术，并给出了部分指标的被动模式测量方法和数掘统计方法。结合NDIS编程体系中协议驱动的开发，展示了被动模式测量系统RPPM(Real-time Passive Performance Measurement)的初步模型，详细说明了其结构，介绍了RPPM初步模型的具体实现。最后总结全文并提出有待改进的问题。更多还原

【Abstract】 With the fast evolution of Internet, improvement of performance is required. People also need high QoS (Quality of Service) and sufficient security guarantee. And it is important to master the behavior of IP network for reaserch and development of network device and protocols, thus, the research on network measurement is paid more attention. The final object of this paper is to give a better software system to inspect and analyse network.At first, it presents network measurement from several aspects, such as the actuality, the significance and key technologies of network measurement. Then the passive measurement and related key technologies are discussed in-depthly, including high performance packet capture technology, high speed flow classification technology and high speed flow track technology. The measurement and statistic ways of some parameters in passive mode are also gived by this thesis. With packet driver in NDIS programming, this paper reflects an original model of passive measurement system RPPM (Real-time Passive Performance Measurement), explains the structure in detail and describes the concrete implement. At last, it raises the problems which need to be improved in the future.更多还原