Study on Tcpdump,a Network Analysis Software

Jiang Qingmin,Wu Ning,Yan Shenyou

DOI: https://doi.org/10.3969/j.issn.2095-2163.2007.02.012

2007-01-01

Abstract:The features、parameters and the used methods of Tcpdump are introduced in the paper.

What problem does this paper attempt to address?

Port Scanning Techniques and Analysis of Attack and Defense

Zhaohui Hu,Qi Chen,Ruizhao Yu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.10.020

2001-01-01

Abstract:This article introduces the implementation of TCP Protocol and the technique of Port Scanning based on the characteristic of TCP Protocol,at the same time,the several implementations of Port Scanning are also described. We also analyze the potential external attacks that can be made because of the weakness of operation system and the ways to avoid suck kinds of attack are also put up.
Performance improvement of wireless TCP for encrypted networks

ZHANG Guo-qiang,XU Yong-qing,YANG Xiao-hu

2006-01-01

Journal of Computer Applications

Abstract:TCP(Transmission Control Protocol) is a widely used reliable transmission protocol,and it is designed on such assumption that most packet losses are caused by congestion.But in wireless networks,packets are lost usually because of bit-errors,which causes dramatic performance declining.Many current methods to improve TCP performance over wireless networks are TCP-aware.This paper proposed an alternative "TCP-unaware" scheme that is suitable for encrypted TCP traffic.It makes TCP source be capable of differentiating a loss due to congestion in the wired network from a loss due to bit-errors in wireless networks.Simulation results show that the scheme can improve TCP performance significantly in both LAN(Local Area Network) and WAN(Wide Area Network).
A Study of Datagram Congestion Control Protocol(DCCP)

陈尚兵,何小燕,钱积新

DOI: https://doi.org/10.3969/j.issn.1002-137X.2003.05.041

2003-01-01

Computer Science

Abstract:Datagram Congestion Control Protocol (DCCP) implements a congestion-controlled, unreliable flow ofdatagrams suitable for use by applications such as streaming media. This paper specifies its background, main ideas,ongoing research and future implementation.
Network Monitor Technology in Windows

苍志刚,潘爱民

DOI: https://doi.org/10.3969/j.issn.1000-7024.2004.02.027

2004-01-01

Abstract:Sniffer has special significance to the Internet information security. This is a brief introduction to the principles of sniffer and its diversities on different platforms. There has been great difficulty in developing net monitor tools on windows platform before the appearance of winPcap, which makes it now much easier. The architecture of winPcap is depicted, and how it works. The new features and its functions, as well as key API functions are introduced. How to design network monitor tools using winPcap exemplified with a practical case of miniCap is also explained.
Data Packet Capture and Applications Based on WinPcap

ZHANG Wei,WANG Tao,PAN Yan-hui,HAO Zhen-hua

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.07.060

2008-01-01

Abstract:Network data packet capture is the precondition for network analysis,through the analysis of the models of network data packet capture in Windows,the structure and function of WinPcap based on NDIS is analyzed and introduced in detail,and how to program on the network adapter and how to capture and analyze the network data packets through WinPcap are realized under the envi-ronment of VC 6.0,and the applications of network data capture for network analysis is narrated in detail finally.
A NEW METHOD OF IMPROVING TTCP PERFORMANCE

Wang Qinping,Zhang Shiyong,Zhong Yiping,Fu Weiming,Dong Hai

DOI: https://doi.org/10.3969/j.issn.1000-386X.2007.07.049

2007-01-01

Abstract:In recent years,network performance has received more and more attention. Meanwhile,the throughput of the network is an important indication related with network performance.A tool named TTCP is introduced,which is often used to test the throughput of TCP.Idea on the improvements of TTCP and the practical implementation are disussed in detail.The throughput of network is tested by the improved tool and the results are analyzed in detail.
Study and Analysis on TCP Traversal through NAT

MA Yi-tao,XUE Zhi,WANG Yi-jun

DOI: https://doi.org/10.3969/j.issn.1009-8054.2008.04.024

2008-01-01

Abstract:The principles of both Network Address Translation(NAT) and NAT Traversal techniques based on TCP protocol are described in this paper. The paper focuses on a simple but robust NAT Traversal technique, which is known as "TCP Hole Punching". In addition, this paper analyzes some defects of the currently used "TCP Hole Punching", i.e. NATBalster[4], and provides some improved methods toward them. The success rate is increased by 5 percent.
The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies.

Jiaqian Li,Chengrong Wu,Jiawei Ye,Jiong Ding,Qinwei Fu,Jiatao Huang

DOI: https://doi.org/10.1109/dasc/picom/cbdcom/cyberscitech.2019.00177

2019-01-01

Abstract:Packet capture technology is the basis for network data analysis and processing. The rapid development of network applications, the speed of network transmission, and the speedy increase in the number of network users put forward higher requirements for packet capture technology. Some high-performance network packet capture technologies come into being.This paper first analyzes the inherent defects of the traditional Linux data capture method, and then introduces and analyzes the advantages and disadvantages of the current high-performance packet capture technologies and framework from the technical principle, application flow, packet capture rate and resource occupancy.
Research of Security Analysis and Audit Technique Based on Network Content

万国根,秦志光,刘锦德

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.01.037

2004-01-01

Abstract:In this paper, the research of Security Analysis and Audit Technique Based on Network Content is demonstrated. A new way for capturing packet in high traffic network by deploying high traffic to low-performance computer is provided,followed by the technique which is used in analysis of many of the commonly used Internet protocols.
Study on TCP simulation of satellite link based on NS-3

Teng YU,Zhimin LIU

DOI: https://doi.org/10.3778/j.issn.1002-8331.1409-0184

2015-01-01

Abstract:The bandwidth resource of satellite link is scarce. How to make maximum use of bandwidth resource is an impor-tant content of satellite network technology in the current study. The researchers have done a lot of research work on en-hancing TCP performance, however, little research has been done on the subject of how to do TCP simulation and how to build simulation platform. The purpose of this paper is to provide a general and flexible method on simulation of TCP con-nection of satellite link, NS-3 is a new freely simulate software of discrete events for the networks research. This paper simulates TCP connection on satellite link via building simulation scene of satellite link on NS-3, and analyzes 11 kinds of TCP congestion control algorithm in Linux kernel via combining NS-3 with Linux kernel. This paper provides a method of TCP simulation based on NS-3. Readers can simulate TCP connection of satellite link according to this method, of course, can also simulate TCP connection of other scenes. Finally, the simulation results indicate that the proposed methods are correct and resultful.
Design of network traffic capturers based on WinPcap

Hui-ran WANG,Rui-fang MA

DOI: https://doi.org/10.3969/j.issn.1674-649X.2005.01.017

2005-01-01

Abstract:The first step in understanding of traffic is capturing packets from the network. This paper introduces two approaches to develop the traffic capturer/monitor, one of which is based on NDIS (Network Driver Interface Specification), the other is based on WinPcap. The later is discussed in details. This paper outlines the WinPcap architecture. The functions exported by WinPcap are classified in three types. On this classification, we can accurately configure the developing environment, e.g. define the preprocessors, set working directories. Three basic functions, i.e. pcapfindalldevsex(), pcapopen(), and pcapnextex(), are interpreted thoroughly. In the end, a step-by-step example is given with its outcomes.
Network Traffic Analysis System Based on IPFIX

Yun-long MA,Qian-li ZHANG,Ji-long WANG

2013-01-01

Abstract:To deal with the large-scale traffic capture and management in high speed network,the performance of IPFIX system was studied.An optimized architecture was proposed and implemented based on improved binary information integration to collect data and improved multi-layer hash algorithm to storage data.This system was deployed in Tsinghua university campus network and can scale to the 10 GB network traffic collection and accurate pricing.
Security analysis of data transporting in database application system with sniffer

陈夕华,李生红

2005-01-01

Journal of Computer Applications

Abstract:This paper first showed respective characteristics of typical database application systems and introduced the theory of sniffer technology.It put forward a new method of analyzing data transfer security numerically with sniffer technology.Then it told how to make an experiment with this method and showed results of the experiment by using this method. At last,the paper emphasized the advantage of using this method to analyze data transfer security of database application system.
Network Stack Analyzing and Protocol Add Technology in Linux

唐续,刘心松,杨峰

DOI: https://doi.org/10.3969/j.issn.1002-137X.2003.02.035

2003-01-01

Computer Science

Abstract:In order to improve the performance of Linux network,new protocols should be implemented and added in original protocol stack. For this demand,this paper has analyzed Linux network stack architecture and implement technology,then presented a method that appended new protocols in the network stack of Linux. The processes of protocol register ,protocol operation,protocol header implement,packets receiving, user interface are involved in this method.
Electrical and Electronic Network Laboratory Based on the Communication Protocol of TCP/IP

LU Jing-jing,ZHU Shan-an,YE Xu-dong

DOI: https://doi.org/10.3969/j.issn.1001-4551.2007.04.025

2007-01-01

Abstract:A presentation of the double C/S structure of electrical and electronic network laboratory was given,and its TCP/IP based lower level communication technology as well as self-defining communication protocol which raises the efficiency of the communication was analyzed.The network laboratory simplifies communication process,raise a communication efficiency cousumedly,and it has vast expansion an application foreground.
Integrated TCP/IP protocol software testing for vulnerability detection

Shu Xiao,Lijun Deng,Sheng Li,Xiangrong Wang

DOI: https://doi.org/10.1109/ICCNMC.2003.1243061

2003-01-01

Abstract:Many security holes stem from the defects in network protocol implementations. This paper presents an industry best practice of integrated TCP/IP network protocol testing that targets software robustness vulnerabilities. The deployed test system consists of a versatile test engine, a protocol data unit generator and a few auxiliary tools. The specially designed kernel test engine supporting IP/TCP/UDP as carrier protocols drives predefined fault-injected PDU (protocol data unit) to the network unit under test. Its novel callback mechanism and virtual network device connection capability cost-effectively enhance user controlled testing intelligence for verifying protocols with complicated state transitions. The PDU generator aims to provide a systematic solution for rapid test case creation, which is based on new strengthened BNF (Backus-Naur form) language for protocol specification mutation and fault injection. Established on this system, we propose an integrated industry test environment for network protocol code assessment. Initial experiments and case studies with multicast protocols unveiled several robustness violations, which have significant security impacts.
STUDY AND REALIZATION OF TCP-BASED NAT TRAVERSAL TECHNOLOGY IN P2P

Jia Xuefeng,Wang Xueping,Gao Haifeng

DOI: https://doi.org/10.3969/j.issn.1000-386X.2008.06.074

2008-01-01

Abstract:With the mass deployment of NAT equipments,one of the urgent problems for P2P is that how can each client node behind NAT to find others and to establish the direct connection.This paper discusses a TCP-based NAT traversal model after the existing traversal methods being analyzed and presents the details for its realization.
P2P traffic measurement system based on Netfilter

YUE Yan-hui,LI Zhi-tang,LIU Bin

DOI: https://doi.org/10.3969/j.issn.1001-3695.2008.04.081

2008-01-01

Abstract:The paper analysed the characteristics of P2P traffic and discussed the current research concerning P2P traffic identification and measurement.Based on the analysis of IPP2P module which could identify P2P traffic through searching the application layer data by suitable patterns,a P2P traffic measurement system based on Netfilter was proposed.This measurement system matched P2P protocol signature in kernel to identify P2P data,then did the statistics of the data by connection tracking technology with high performance to achieve the real-time measurement of P2P traffic.
Design and Implementation of TCP with Network Coding

Xudong Fan,Hui Li

DOI: https://doi.org/10.1109/icsai.2014.7009351

2014-01-01

Abstract:This paper proposes a new method of TCP with network coding (NC) and implements the new version of TCP (TCP-NC) on Linux kernel. In TCP-NC design, it introduces a network coding layer, and constructs encoding, header format, the encoding queue, ACK-NC, redundancy coefficient and timer. In TCP-NC kernel implementation, it does some simplification: setting the length of encoding queue (equals two packets), making ACK-NC instead of ACK-TCP and so on. Then, this paper makes some changes to the core functions and data structures, including modifying transmission control block, changing sk_buff, designing MSS and increasing tcp_nc.c document. Finally, it tests the performance of TCP-NC by replacing the kernel, building test topology and simulating under wireless network environment, and gets the results as follows: 1. TCP-NC's fairness is good; 2. TCP-NC performs well when the channel loss rate is less than 10%.

Study on Tcpdump,a Network Analysis Software

Port Scanning Techniques and Analysis of Attack and Defense

Performance improvement of wireless TCP for encrypted networks

A Study of Datagram Congestion Control Protocol(DCCP)

Network Monitor Technology in Windows

Data Packet Capture and Applications Based on WinPcap

A NEW METHOD OF IMPROVING TTCP PERFORMANCE

Study and Analysis on TCP Traversal through NAT

The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies.

Research of Security Analysis and Audit Technique Based on Network Content

Study on TCP simulation of satellite link based on NS-3

Design of network traffic capturers based on WinPcap

Network Traffic Analysis System Based on IPFIX

Security analysis of data transporting in database application system with sniffer

Network Stack Analyzing and Protocol Add Technology in Linux

Electrical and Electronic Network Laboratory Based on the Communication Protocol of TCP/IP

Integrated TCP/IP protocol software testing for vulnerability detection

STUDY AND REALIZATION OF TCP-BASED NAT TRAVERSAL TECHNOLOGY IN P2P

P2P traffic measurement system based on Netfilter

Design and Implementation of TCP with Network Coding