Network security monitoring method based on bypass monitoring and software packet capturing technology

Abstract

The invention discloses a network security monitoring method based on bypass monitoring and software packet capturing technology. The method comprises the steps of (1) setting bypass monitor to an exchange at the same network section with a network security protection server; (2) configuring a source server IP of which the network packet is to be monitored and a data sending port; (3) setting the length of packet capturing time and packet capturing interval; (4) capturing and caching a network data packet, analyzing, and acquiring a source IP list in the data packet through a regular expression; (5) recording the source IP address to form a known IP address library; (6) finding out a new terminal accessed to the network through a network sniffing tool; (7) comparing the source IP list with all PC server lists in the LAN, and determining whether the corresponding security protection software is installed to a client PC terminal. With the adoption of the method, the rate and speed of finding the PC terminal without being provided with the security protection software are improved, and attack from the potential virus and Trojan caused by accessing the PC terminal without being equipped with the security protection software into the network can be reduced.

Description

technical field [0001] The invention belongs to the technical field of computer local area network security management, and in particular relates to a network security monitoring method based on bypass monitoring and software packet capture technology. Background technique [0002] Bypass listening monitoring is to copy the export data to the port connected to the monitoring host through the function of the shared HUB or mirror switch itself, so as to achieve the purpose of monitoring. Bypass monitoring has little impact on network speed, and the management effect is also excellent. Representatives who adopt this monitoring method include LaneCat. winpcap is a set of tools for network packet capture, applicable to 32 / 64-bit operating system platforms to analyze network packets, including core packet filtering, a dungeon dynamic link library and a high-level system function library, And an API that can be used to directly access packets. Libpcap is a network packet capture...

AI Technical Summary

Problems solved by technology

When the PC terminal finds the above alarm information, it will contact the server to send the alarm and violation information to the server, and the server will initiate commands such as network disconnection, but the detection rate of automatic alarm or network disconnection is low and the discovery speed is slow

Images