基于NDIS中间层驱动的高速网络设备监测技术  

High-speed network device monitoring based on NDIS IMD

作　　者：刘璐[1] 王谷尹[1] 王俊峰[1] 

机构地区：[1]四川大学计算机学院,成都610064

出　　处：《计算机应用研究》2008年第10期3122-3124,共3页Application Research of Computers

基　　金：国家"863"计划资助项目(2006AA12A104);国家自然科学基金资助项目(60772150)

摘　　要：传统的基于应用层的网卡监测方式已难以对高速网卡活动信息进行实时、准确监测。为此,分析基于NDIS(network driver interface specification)中间层驱动和Windows网络数据包过滤技术的特点,采用核心态NDIS中间层驱动程序实现了与底层网络接口设备具体细节无关的高速网络设备监测技术,设计并实现了Windows平台下基于NDIS的网卡监测器。它分为应用层和驱动层两个模块,能够在保证高性能的情况下在数据链路层同时对多个网卡进行精确监测,其主要特点是对所有数据包的分析处理都在核心态进行。Traditional application layer based network interface card（NIC） method became inefficient in real-time and accurate high-speed NIC monitoring. With the analysis of network driver interface specification（NDIS） and packet filtering under Windows platform, the paper proposed an NIC independent high-speed network and monitoring method based on NDIS. The NIC monitor was implemented with application layer module and the driver layer ones, The monitor is capable of monitor multipie NICS simultaneously and accurately. Its main characteristic is analyzing and processing all the packets in the kernel layer.

关 键 词：网络驱动程序接口规范 中间层驱动 网卡监测 数据包过滤 核心态 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]