passively monitoring networks at gigabit speeds using commodity hardware and open source sonew

《passively monitoring networks at gigabit speeds using commodity hardware and open source sonew》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、PassivelyMonitoringNetworksatGigabitSpeedsUsingCommodityHardwareandOpenSourceSoftwareLucaDeri,NETikosS.p.A.notonlyintermsofvolumebutalsointermsoftype,asAbstract—Passivenetworkmonitoringisacomplextheseapplicationsredefinedtheconceptofclientandserver.activitythatmainlyconsist

2、sinpacketcapturingandUsuallyaserverisahostthatprovidesaservicetoseveralclassification.Unfortunatelythisarchitectureoftencannotclients.IntermsofIPtraffic:beappliedtogigabitnetworks,astheamountofdatato•Aclientestablishesoneormoreconnectionswithacaptureistoolargeforthemonitori

3、ngapplications.server,usestheserver,andthenclosestheconnections.Thispaperdescribesthechallengesandlessonslearntbytheauthorwhilemonitoringnetworksatgigabitspeedsand•Serverscanexchangedatawithbothclientsandabove.Finally,itdescribesanarchitectureabletoservers,whereasclientstal

4、konlywithservers.successfullymonitornetworksathighspeedsusing•Clienttoserverconnectionsareoftenasymmetricalcommodityhardwareandopensourcesoftware.(e.g.inHTTPtheclientsendslittledatawithrespecttotheserver).IndexTerms—PassiveNetworkMonitoring,Packet•PacketssuchasICMPportunrea

5、chableorTCPpacketsCapture,NetFlow,sFlow.withtheRSTflagsetarerelativelyrare,andtheyareusedtoindicatethatthereisaproblemsomewhere.I.PASSIVENETWORKMONITORING:STATEOFTHEART•Serversandapplicationsusuallylistenonwell-knownports.earsago,manycomputerspecialistspredictedtheneedYtoha

6、vemorebandwidthavailablebecausepeoplewereWiththeadventofP2P,theabovestatementsneedtobesupposedtoneeditmostlyformultimediaapplications.revisedas:Timehasprovedthatthisstatementwashalftrue.•ThereisnotatruedifferencebetweenaclientandaAlthoughtherearemanyattemptstoprovideTV/radi

7、oserverasaP2PapplicationisbothaclientandaaccessovertheInternet,todaymostbandwidthdemandingserver.applicationsdonotbelongtothefamilyofinteractive•ThenumberofpermanentlyestablishedTCPmulticast-basedmultimediaapplicationsbutrathertopeer-connectionsisverylittle(usuallyonlythose

8、withto-peer(P2P)[3].Infactwhilemulticasttransmissionhasmasterservers).notreallytak