网络入侵检测系统中的包截获和报文解析  

Capture and decoding of packet in net intrusion and detection system

作　　者：高光勇[1] 谢志恒 

机构地区：[1]齐齐哈尔大学信息与电气工程学院,齐齐哈尔161006 [2]黑龙江通信公司齐齐哈尔市通信分公司,齐齐哈尔161000

出　　处：《齐齐哈尔大学学报（自然科学版）》2004年第3期47-50,共4页Journal of Qiqihar University(Natural Science Edition)

摘　　要：随着Internet网络安全问题的不断暴露和当前黑客攻击技术日益进步,人们逐渐认识到防火墙、数字签名和加密技术这些被动式、静态的防御技术越来越难于保证网络的安全。因此,主动式、动态地保护网络安全的入侵检测系统(IntrusionDetectionSystem,IDS)已成为网络安全发展的一个新方向。本文主要介绍IDS中的数据包截获及解析关键技术。With exposure of the net security problem and increasing progress of the attack technology by hackers, more and more people know these passive and static defending technology such as firewall,figure signature and encryption technology can hardly guarantee net security. So intrusion detection system(IDS) which protects net security actively and dynamicly has become a new developing trend of net security. The paper introduces mostly crucial technology about capture and decoding of packet in IDS.

关 键 词：LIBPCAP库 包截获 报文结构 数据报解码 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]