【作者】 王剑飚；

【导师】 郑万波；

【作者基本信息】 吉林大学 ， 软件工程， 2008， 硕士

【摘要】 这篇论文的题目是“Windows下网络监控系统[1]——截获封包”。其中的内容对系统的整体结构以及具体划分的模块功能给予了充分细致的描述,其中的重点叙述部分当然还是关于截获封包的功能实现。整个系统的初步划分可以分为网络封包截获过滤模块和用户界面接口模块两个部分。其中网络封包截获过滤模块是基于Winsock2 SPI技术实现的,是以DLL[2]文件的形式存在,并为监控规则提供良好的支持。用户界面提供为用户设定规则的良好接口和EXE文件与DLL文件交互通信的良好接口。另外,由于DLL文件不能自己运行,必须通过系统加载才能运行,这个就要求有一个加载DLL的模块,实现系统对DLL的加载。虽然DLL文件实现了封包截获,属于系统的核心部件,不过仍然有大量的工作集中在界面工程的实现上本文一方面对整个Windows网络状态监控系统做了总体介绍,另一方面,也特别突出的详细介绍了截获封包部分模块的功能与设计。更多还原

【Abstract】 As the popularization of computer, communication by network becomes more and more frequent. Network makes us more convenience and freedom, but the security exists at the same time.Hacker problem and information leak are more danger than virus. Virus is eyeable and cleanable; on the contrary, the result is fearful because hackers always hide their whereabouts.As a network security production, Fire wall is accepted by more people. Network Monitor System using in PC becomes the popular way to protecting the security. Network Monitor System based on method of heading off data packet in Windows platform, but the realization are different. There are two mainly realization level, user level and kernel level. Kernel level technique is TDI filtrate driver, NDIS intermediate driver and NDIS filtrate hook driver, and so on. They all realize by network driver. User level technique includes SPI interface, packet filtrate interface of Windows 2000, etc.The program mainly uses winsock2 SPI to head off packet. Winsock2 is the version 2.0 of windows socket and the latest version is winsock1.1. Version 2.0 has the advantage of SPI interface and can used to realize Qos, URL filtrate and other security monitor function. It is strong and useful.Winsock is the network interface for up level application. It is no need to know the detail of Winsock. SPI interface exists as DLL and works in application layer. The system in this paper used user level packet filtrate technique by SPI interface. SPI has many advantages, such as auto load, ignore detail, etc.We divide the modules by two principles as following:Independency. Try our best to make the relationship of modules be less.Interface concision. Try our best to make the interface between modules concision by avoiding using static variable or function.The system encapsulates the module of packet analysis to one class, and plans to save some information to log, including the domain name, file name, email, user name and password. Because information is included in sending or receiving packet, we can separate them using this class.The system views are encapsulation packet view, log query view, rule setting view and system setting view. The view framework and sub page are realized by CpropertySheet and CpropertyPage.Now, we introduce one stronger network technique. It is the availability technique for winsock2 SPI. This technique is the main content which we can improve the system instead of SPI.The way of improving system is heading off packet in kernel level and one good choice is using NDIS-HOOK technique. The advantages of NDIS-HOOK are as following:The convenience of programming, concision of interface and stability of performance.More agile than winsock2. We can use the useful code and avoid bring excrescent code.Stronger than wonsock2. As a network filtrate driver program, it works in transfer layer, network layer, etc.More security than winsock2. The action of heading off packet works the bottom layers.The simpleness of installation.The principle of NDIS-HOOK is replacing the address of function in NDIS, so the request of NDIS will be operated by our own function and then be transferred the request to system function. It is simple.更多还原