passively monitoring networks at gigabit speeds using commodity hardware and open source so

《passively monitoring networks at gigabit speeds using commodity hardware and open source so》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、PassivelyMonitoringNetworksatGigabitSpeedsUsingCommodityHardwareandOpenSourceSoftwareLucaDeri,NETikosS.p.A.notonlyintermsofvolumebutalsointermsoftype,asAbstract—Passivenetworkmonitoringisacomplextheseapplicationsredefinedtheconceptofclientandserver.ac

2、tivitythatmainlyconsistsinpacketcapturingandUsuallyaserverisahostthatprovidesaservicetoseveralclassification.Unfortunatelythisarchitectureoftencannotclients.IntermsofIPtraffic:beappliedtogigabitnetworks,astheamountofdatato•Aclientestablishesoneormorec

3、onnectionswithacaptureistoolargeforthemonitoringapplications.server,usestheserver,andthenclosestheconnections.Thispaperdescribesthechallengesandlessonslearntbytheauthorwhilemonitoringnetworksatgigabitspeedsand•Serverscanexchangedatawithbothclientsanda

4、bove.Finally,itdescribesanarchitectureabletoservers,whereasclientstalkonlywithservers.successfullymonitornetworksathighspeedsusing•Clienttoserverconnectionsareoftenasymmetricalcommodityhardwareandopensourcesoftware.(e.g.inHTTPtheclientsendslittledataw

5、ithrespecttotheserver).IndexTerms—PassiveNetworkMonitoring,Packet•PacketssuchasICMPportunreachableorTCPpacketsCapture,NetFlow,sFlow.withtheRSTflagsetarerelativelyrare,andtheyareusedtoindicatethatthereisaproblemsomewhere.I.PASSIVENETWORKMONITORING:STAT

6、EOFTHEART•Serversandapplicationsusuallylistenonwell-knownports.earsago,manycomputerspecialistspredictedtheneedYtohavemorebandwidthavailablebecausepeoplewereWiththeadventofP2P,theabovestatementsneedtobesupposedtoneeditmostlyformultimediaapplications.re

7、visedas:Timehasprovedthatthisstatementwashalftrue.•ThereisnotatruedifferencebetweenaclientandaAlthoughtherearemanyattemptstoprovideTV/radioserverasaP2PapplicationisbothaclientandaaccessovertheInternet,todaymostbandwidthdemandingserver.applicationsdono

8、tbelongtothefamilyofinteractive•ThenumberofpermanentlyestablishedTCPmulticast-basedmultimediaapplicationsbutrathertopeer-connectionsisverylittle(usuallyonlythosewithto-peer(P2P)[3].Infactwhilemulticasttransmissionhasmasterservers).notreallytak