一种高效的TCP会话数据流重组算法及应用.pdfVIP

27 7 Vol. 27 No. 7 2010 7 M ICROELECTRONICS COMPUTER July 2010 T CP 赵启升, 李存华 ( , 222005) : 在网络行为管理系统中, 当数据包以T CP 流方式在网络上传输时, 传统的基于数据包的 式匹配算法已 无法满足需要. 对此提出了 一种高效的T CP 会话数据流重组算法, 详细论述了多连接管理重复报文处理以及无 序报文处理等重组过程中出现问题的解决方法, 并利用此算法实现了FTP 协议数据包的截获与分析. 通过与Lib nids 库相比较, 试验结果表明, 该算法更具效率和稳定性. : 网络行为管理; T CP 协议; 报文重组; FTP : TP31 : A : 1000- 7180(2010) 07- 0129- 0 An Efficient Algorithm and Application for Restructuring TCP Session Data Streams ZHAO Qisheng, LI Cunhua ( School of Computer Egineering,Huaihai Institute of Technology, Lianyungang 222005, China) Abstract: The traditional algorithms for packetsbased pattern matching are unable to meet t he needs of the network be havior management system if data packets flow through the network in T CP streams. After present ing an efficient algo rithm for restructuring T CP session streams, t his paper discusses detailedly solution to the problems appeared in multiple connect ion management, repeatable message processing, outof order message processing and etc. Finally, we implement t he interception and analysis of data packets complying to the FTP protocol by means of the algorithm. Comparing w ith t he Libnids library , the experimental results demonstrates that our algorithm is more efficient and stable. Key words: network behavior management; T CP protocol; segments reorganization; FT P TCP , 1 . , [ 1] 2 . , , TCP ( T ransmission Control Protocol) , . TCP/ IP , , T CP, HTT PFTP . . , , , TCP