網(wǎng)絡(luò)嗅探器的設(shè)計(jì)與實(shí)現(xiàn)

論文字?jǐn)?shù):9726,頁數(shù):26

摘  要
隨著網(wǎng)絡(luò)技術(shù)的發(fā)展和網(wǎng)絡(luò)應(yīng)用的普及，越來越多的信息資源放在了互聯(lián)網(wǎng)上，網(wǎng)絡(luò)的安全性和可靠性顯得越發(fā)重要。因此，對(duì)于能夠分析、診斷網(wǎng)絡(luò)，測試網(wǎng)絡(luò)性能與安全性的工具軟件的需求也越來越迫切。網(wǎng)絡(luò)嗅探器具有兩面性，攻擊者可以用它來監(jiān)聽網(wǎng)絡(luò)中數(shù)據(jù)，達(dá)到非法獲得信息的目的，網(wǎng)絡(luò)管理者可以通過使用嗅探器捕獲網(wǎng)絡(luò)中傳輸?shù)臄?shù)據(jù)包并對(duì)其進(jìn)行分析，分析結(jié)果可供網(wǎng)絡(luò)安全分析之用。
本文對(duì)網(wǎng)絡(luò)嗅探技術(shù)進(jìn)行了簡要分析，研究了網(wǎng)絡(luò)數(shù)據(jù)包的捕獲機(jī)制，如winpcap、原始套接字。文中首先分析了嗅探的原理和危害,并介紹了幾種常見的嗅探器，然后研究了入侵檢測系統(tǒng)中使用的包捕獲技術(shù)。本文利用原始套接字在windows平臺(tái)下實(shí)現(xiàn)了一個(gè)網(wǎng)絡(luò)嗅探器程序，完成了對(duì)數(shù)據(jù)包進(jìn)行解包、分析數(shù)據(jù)包的功能。

關(guān)鍵詞：網(wǎng)絡(luò)嗅探器；數(shù)據(jù)包捕獲；數(shù)據(jù)包分析；原始套接字
Design and Realization of Network Sniffer
Abstract
Along with the development of network technologies and the popularization of network applications, more and more information resources are put on internet. The network security and reliability become important increasingly. Therefore, the demand of the software tools which could analyze, diagnosis and test network performance or security are more and more pressing. Network sniffer has two sides. An attacker can use it to monitor network data, to achieve the purpose for obtaining information illegally, while network managers can use it to capture and analyze the data which transmitted on network. The result of analysis can be used to analyze the network security.
This thesis briefly analyzed the technology of network sniffer, and researched the capture mechanism of network data packets such as winpcap and raw socket. This paper first analyzed the theory and the harm of sniffer, introduced several common sniffers, and then researched the capture technology which used in the intrusion detection system. The thesis uses raw sockets on windows platform to realize one sniffer which can complete unpack and analyze data packet.

Key words: network sniffer; capture data packet; analyze data capture; raw sockets

目    錄

1 引言 1
1.1 網(wǎng)絡(luò)安全的現(xiàn)狀 1
1.1.1 計(jì)算機(jī)網(wǎng)絡(luò)安全的問題 1
1.1.2 網(wǎng)絡(luò)安全機(jī)制及技術(shù)措施 1
1.2本課題的研究意義 2
1.3本文研究的內(nèi)容 3
2 網(wǎng)絡(luò)嗅探器的基本原理 3
2.1網(wǎng)絡(luò)嗅探器概述 3
2.2 嗅探器實(shí)現(xiàn)基礎(chǔ) 3
2.3 常見的sniffer 4
2.4 數(shù)據(jù)包捕獲機(jī)制的研究 4
2.4.1 WinPcap包捕獲機(jī)制 5
2.4.2 套接字包捕獲機(jī)制 6
2.5 嗅探器的兩面性 8
2.5.1 sinffer的危害 8
2.5.2 通過網(wǎng)絡(luò)嗅探進(jìn)行網(wǎng)絡(luò)管理 9
3 入侵檢測系統(tǒng)與嗅探器 9
3.1 入侵檢測概念 9
3.2 入侵檢測的實(shí)現(xiàn)與嗅探器 10
3.2.1 入侵檢測的實(shí)現(xiàn)與嗅探器的關(guān)系 11
3.2.2 數(shù)據(jù)包嗅探技術(shù)在入侵檢測系統(tǒng)中的應(yīng)用 11
4 嗅探器的實(shí)現(xiàn)與測試 12
4.1利用套接字開發(fā)網(wǎng)絡(luò)嗅探程序的步驟 12
4.2 嗅探器的具體實(shí)現(xiàn)原理 13
4.3 數(shù)據(jù)包捕獲程序設(shè)計(jì) 15
4.4 數(shù)據(jù)包的解析 15
4.5 數(shù)據(jù)的顯示 19
4.6 嗅探器的測試 22
結(jié)    論 23
參考文獻(xiàn) 23
致    謝 24
聲    明 25