无线局域网监听系统的研究与实现

【作者】 张雯；

【导师】 蔡皖东；

【作者基本信息】 西北工业大学 ， 计算机科学与技术， 2007， 硕士

【摘要】 无线局域网(WLAN)因其接入速率高，安装便捷、组网灵活等得天独厚的优势得到了广泛应用，已经成为当今网络发展的一个主要趋势。但由于无线电波传播的开放性，使得针对WLAN的监听非常容易，WLAN的安全性受到了巨大挑战。 WLAN监听是对WLAN进行监控和对利用WLAN实施网络犯罪活动进行侦察和取证的基础。但现有的无线监听技术大都局限于共享式的WLAN，而且对数据的分析也停留在传输层，不便于查看分析。而信息内容分析还原技术能够在应用层对信息内容进行分析，按照应用层协议将数据包重组、拼接以还原出文件的原来面目，便于使用者查看、发现可疑的破坏行为。 本文把信息内容还原技术和WLAN监听技术结合起来，实现了一个针对WLAN通信内容的获取和重现的监听系统。系统有两个用途：一是网络管理者可以用来进行网络信息访问统计、流量分析等；二是可以用来对利用WLAN实施网络犯罪活动进行侦察和取证。另外，WLAN监听系统还可以与监控代理平台结合在一起，利用监控代理的传播机制，远程监听内部WLAN的通信内容。 本系统采用了中间人攻击的思想，利用多线程、多缓冲技术实现了对交换式WLAN的监听和高效的数据包分析和信息还原。主要研究内容有： 1．WLAN监听技术：研究了交换式局域网下的监听方式以及无线局域网环境中“中间人攻击”实现技术。 2．信息内容的分析还原技术：探讨了信息内容安全的内涵和发展现状，对信息内容获取和信息内容还原做了深入研究。本文主要研究了基于FTP、HTTP等协议的信息内容的分析还原方法，并以FTP被动模式下的文件传输为例说明了信息还原重现的过程。 3．系统实现技术：本系统可以自成系统独立工作，也可以通过适当的接口集成在已有的系统上。本文重点论述了基于监控代理的系统实现技术。 4．总结现有的工作，展望系统研究的前景。更多还原

【Abstract】 WLAN has been widely used because of its advantages of high meeting speed, convenience of setup and facility of constructing, and it is the trend in network developing. The opening of wireless wave makes the sniffing arm at WLAN much easier, and the security of WLAN faces the terrible challenge.WLAN sniffer is the basement of WLAN monitor and control and it can produce evidence of network crime. The traditional WLAN sniffer is mainly based on share mode, and data analyse limits to transport layer, the result are difficult to analyse. Information reverting can analyse packets on application layer, recombine packets and revert the file according to application protocols, in order to produce convenience to information censor.This paper combines the WLAN sniffer and the information reverting techniques and implements a system which can sniffe and rever WLAN communications. The system has two purposes: One is that the network administrators can use it to control network information and watch network flow; the other is that it can produce evidence of network crime. In addition, WLAN sniffer system can also integrate with the monitor agent platform to remote sniff the WLAN communication.The system adopts man-in-the-middle attack idea and improves the switch WLAN sniffer and the efficiency of packet capture and analyse using multithreading and multi-buffer techniques. The researches including:1. WLAN sniffer. Sniffer method under switch local area network and man-in-the-middle accack technique in WLAN are studied in this paper.2. Information analyzing and reverting. The meaning and the development of information security are discussed in the paper and the information capture and reverting are also deeply studied. The researches emphasizes on the information analyzing and reverting techniques which based on FTP and HTTP protocols and it also illustrates the process of imformation revert by an example of file transmission in passive mode of FTP.3. System implements. This system can either be used independent or be integrated to the existing system through appropriate interface. The monitor agent based system implement is the emphasis of the paper.更多还原