网络运行监测手段.pdfVIP

网络运行监测手段 浅谈 宫一鸣 宫一鸣 Jan 2005 yiming@S 5 areas • ISO network management的5 areas -- – Fault Management -- monitor • Network problem – Configuration Management -- monitor • configuration information – Performance Management -- monitor • throughput, line/cpu utilization – Accounting Management -- monitor – Security Management -- monitor 不断变化的Network • 关注建设-- 关注应用 • 带宽安全推到了前台 – 网络而非系统 基于Network的异常 – 终端的智能之和 网络 -quoted liu YC • 网络是如何运行的？ • 用户在用我的带宽做什么？带宽如何构成？ • TOPn user/app/port/zone ？ • 流量中的正常/异常比率 • 网络有问题么？ • 如何应对网络中的DDoS, Worm? • Total Solution? 网络运行监测手段 • 分类方法 – Active – PASV – Inline～outline – 我们需要？ 网络运行监测手段 • Active – LED – Ping, traceroute, Nmap – telnet/ssh -- – Show/Debug – Expect + shell – 构造数据包 • V Scanner • Iperf, OWAMP，skitter，Beluga, hping 网络运行监测手段 • Iperf – measure maximum TCP bandwidth, allowing the tuning of various parameters and UDP characteristics. • Iperf reports bandwidth, delay jitter, datagram loss. yiming# iperf -c -p 80 -i 2 Client connecting to , TCP port 80 TCP window size: 16.0 KByte (default) [ 3] local port 3593 connected with port 80 [ 3] 0.0- 2.0 sec 5.26 MBytes 22.1 Mbits/sec [ 3] 2.0- 4.0 sec 2.35 MBytes 9.86 Mbits/sec [ 3] 4.0- 6.0 sec 12.1 MBytes 50.7 Mbits/sec