基于Linux的内核数据捕获技术研究  

Research on kernel packet capture based on Linux

作　　者：傅杨[1] 王嘉祯[1] 文家福[1] 

机构地区：[1]中国人民解放军军械工程学院计算机工程系,河北石家庄050003

出　　处：《软件导刊》2009年第2期154-156,共3页Software Guide

摘　　要：以Linux作为数据捕获的平台,以捕获系统的所有活动特别是入侵者的加密会话为目标,提出了一种利用Rootkit技术,通过替换系统调用sys_read,sys_write,sys_open,sys_socketcall等来从内核捕获数据的技术。Regarded the Linux as the platform of packet capture and the all activities of capture system as the target, especially the invader＇s encryption session, a kind of packet capture technology which made use of Rootkit was proposed, it could implement the kernel packet capture through the replace of system call, such as sys_ read, sys _ write, sys _ open and sys _socketcall etc.

关 键 词：LINUX ROOTKIT 内核 加密 数据捕获 

分 类 号：TP311.132[自动化与计算机技术—计算机软件与理论]