网络行为监测与还原系统及关键技术研究

讨论了高速网络环境下一种网络行为监测与还原系统的设计与实现.阐述了基于LIBPCAP的包捕获机制及产生瓶颈的原因.为了改善数据捕获性能,采用改进的高速网络数据包采集的零拷贝技术.用Hash表实现TCP会话高效重组,分析了http协议对应用层http协议还原和Web内容的重构,重现用户浏览Web页的内容,实现了对网络用户行为的监测和还原.

Study on network behavior monitor-restore system and its key technique

The design and realization of a network behavior monitor-restore system in high speed network is discussed. The mechanism of packet capturing based on LIBPCAP and the cause of the poor performance of packet capturing is expatiated. This system improves the performance of data capturing by using the data packet capturing technology of improved zero copy technique in high speed network.The TCP session is restructured effectively by using Hash list, the http protocol is reassigned in application level, the web pages is recombined by analyzing http protocol, and the contents of web is realized.