监控系统开发文档

《监控系统开发文档》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、ArchitectureofaNetworkMonitorAndrewMoore,JamesHall,ChristianKreibich,EuanHarris,andIanPrattUniversityofCambridgeComputerLaboratoryJJThomsonAvenue,CambridgeCB30FD,UnitedKingdomfrstname.lastnameg@cl.cam.ac.ukAbstract—Thispaperdescribesasystemforsimultane-beenspawnedbythegrowthinnetwo

2、rkspeeds.Ex-ouslymonitoringmultipleprotocols.Itperformsfullline-amplesofmonitoringincludethosebaseduponkernel-ratecaptureandimplementson-lineanalysisandcompres-implementationsofpacketcapture,suchaspacketl-siontorecordinterestingdatawithoutlossofinformation.ter[3]andtcpdump/libpcap[

3、4].SpecialisthardwarehasWeacceptthatthebalancemustbemaintainedinsuchaseenimportantapplicationinworksuchasOC3MON[5]systembetweendisk-bandwidth,CPU-capacityanddata-aswellasmorerecentlywithDAG[6]–withdemon-reductioninordertoperformmonitoringatfullline-rate.stratedpart-packetcapturerate

4、sofupto10Gbps.Wepresentthearchitectureindetailandmeasuretheperformanceofoursampleimplementation,Nprobe.Additionally,newprojectsinthisareaaregettingun-derway:theEuropeanSCAMPI[7],anarchitecturalIndexTerms—Passivenetworkmonitoring,fullline-ratedesignfordatacapture;andMAGNeT[8].MAGNeTc

5、apture,multi-protocolanalysisisamonitoringmechanismforexportingkerneleventstouserspace.ThatprojectusesinstrumentationoftheI.INTRODUCTIONkernel/transportstacktoprovideaninsightintonetworkURRENTtechnologiesforthepassivemonitor-characteristicsandapplicationbehavior.However,weCingofnetw

6、orksmakelimiteduseofthestate-expectthatsystemssuchasMAGNeTwillbelimitedininformationpresentaspartofeachTCP/IPow.WhiledeploymentthroughtheneedtoinstrumentanoperatingIntrusionDetectionSystems(IDSs)oftenperformpat-system.ternmatchingfromreconstructeddata-ows,thepro-Asidefromourapproa

7、ch,othermonitorsystemsthatcessing(andmodeling)ofstateinreal-timehasbeenallowmulti-protocolanalysisareWindmill[9]andrare.ByusingthestateinformationofTCP/IPandBLT[10].Windmillisaprobearchitecturedesignedtohigher-levelapplicationsitbecomespossibletoinferreconstructapplicationlevelproto

8、colsandrelatethemto