基于Libnids库的Internet网络协议还原系统研究  

The Study of Internet Network Protocol Reassembling System Based on Libnids Library

作　　者：石金龙[1] 孙翼[1] 

机构地区：[1]中国科学院大学计算机与控制学院

出　　处：《电子技术（上海）》2014年第3期13-19,共7页Electronic Technology

摘　　要：近年来,互联网的规模呈现爆炸性增长,骨干网通信带宽达到了千兆甚至万兆,因此保护互联网的安全变得越来越重要。网络安全领域的各种产品如防火墙、入侵检测系统都是基于对网络数据的分析和预测而开发的,而截获和还原数据的协议还原技术成为设计这些网络安全产品的基石。文章研究并实现了基于Libnids库的Internet网络协议还原系统,该系统利用旁路数据链路帧的方式捕获数据包,借鉴Linux内核的实现方法进行IP分片组装和TCP流重组,有效实现了网络信息内容监控。该系统可以根据需要加入扩展模块,可根据需要还原多种应用层数据。In recent years, the Internet has got the explosive growth, with the bandwidth of the backbone network achieving gigabit or even 10 gigabit, so the security of the Internet is becoming more and more important. The network security products such as firewall, intrusion detection system, etc., are developed based on the analysis and prediction of the data on network, and the technologies of Protocol reassembling on network is the foundation of designing these network security products. In this paper, an Internet network protocol reassembling system based on Libnids library is studied and implemented, which captures data packets in the way of bypass data link frame, executes IP fragmentation assembling and TCP flow reorganizing referring to the realization way of the Linux kernel, thereby effectively realizing the monitoring of the network content. It is easy and convenient to add in extension modules according to the need of a variety of application layer data.

关 键 词：协议还原 内核协议栈 TCP IP 网络安全 TCP流重组 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]