基于winpcap的网络信息监听系统分析与实现-analysis and implementation of network information monitoring system based on winpcap.docxVIP

AbstractIn the information society, information is the important resource for maintaining social, economic and production activities, and it has become the base of political, economic, social and cultural fields. Exploration methods and techniques for network information sniffing contributes to the establishment of a reliable and efficient network information security system, it also helps for maintaining social and political stability, as well as economic development..Aiming at specific requirement, the design principles of a Network Information Sniffing System Based on Winpcap (NISSBW) are explained, the system structure, work processes and function modules of the system are described in this paper. The techniques for extracting E-mail and Web are also implemented.NISSBW is composed of at least one data acquisition subsystem and one data extraction center, every data acquisition subsystem is placed on a different gateway, they can sniff several local area networks at the same time. The data extraction center is placed on a computer which runs on background. The data extraction center can serve for several data acquisition subsystems simultaneously. In order to improve the communication performance between the data acquisition subsystem and the data extraction center, five Winsock I/O models are discussed, the application protocol which is using for communication between the data acquisition subsystems and the data extraction center is proposed on the base of completion port.For sake of improving performance of NISSBW, the buffer model which is used for data transmission between threads is by the way of the memory buffer pool. The unit of this model is a data block which can cache many packets, the allocated data blocks are used to cache packets repeatedly and circularly, the expense of memory allocation and free has decreased, the probability of preempting the critical section also has a sharp decline, as a result, the performance of capturing and analyzing packet