基于TCPIP的协议分析器设计.docVIP

基于TCP/IP的协议分析器设计 【摘要】网络分析技术作为一种积极的安全监测技术，能实时监测网络中发生的一些事件，也更加有效地保障被监测网络的安全性。基于TCP/IP的分析技术也是具有入侵监测能力网络系统的核心技术之一。所以，研究以捕获数据包为基础的网络分析方法在当今是非常必要的。 本课题针对10Mbps以太网，设计一个具有实时性的网络数据包捕获和统计分析系统。本系统使用具有数据包捕获功能的winpcap开源包，对流经本机的网络数据包进行嗅探和统计分析。在循环捕获网络上的数据包的同时，对数据包进行分析与归类。本系统以TCP/IP体系结构为根本，对数据包实现由下至上的层层解析，最终实现对HTTP协议报文的读取，FTP文件传输协议的命令读取，也可以实现以UDP协议或TCP协议为基础的QQ数据包的判断。 本论文首先介绍了捕获网络数据包的工具,其次是重点介绍了winpcap开源库的相关知识、捕获数据包的理论过程以及数据包的分析过程等。 【关键词】winpcap开源包，TCP/IP协议，数据包捕获，协议分析analyzer based on TCP/IP protocol Abstract Network analysis technology as a positive safety monitoring technology, it can occur in the real-time monitoring of network events and more effective protection of the security of the network to be monitored. The network analysis technology is also one of the core technologies for network intrusion detection systems. Therefore, the study to capture the packet-based network monitoring is necessary in todays. The topic designs a real-time network packet capture and statistical analysis system for 10Mbps Ethernet. The system uses winpcap comes with network packet capture mechanism for monitoring and statistical analysis of data packets flowing through the local computer. In the loop capturing data packets at the same time, synchronization is achieved on the analysis of data packets classified. It is mainly done to the TCP/IP protocol stack-based network packet capture. The system is based on the TCP/IP architecture and analysis packets from the bottom layers. Ultimately, the system can read the HTTP protocol packets, the FTP file transfer protocol command and it can also implement the judgments of the QQ data packets based on UDP or TCP protocol. This paper introduces a network packet capture tool firstly. And the paper focuses on the winpcap knowledge, the principle of packet capture and analysis of data packets mechanism secondly. Key word: winpcap open-source packet, TCP/IP protocol, packet capture, protocol analysis目录 第一章 绪论 1 1.1. 课题背景 1 1.2. 研究现状 1 1.3. 本文研究内容 2 1.4.