【作者】 李彬；

【导师】 吴志军；

【作者基本信息】 北京邮电大学 ， 信息安全， 2011， 硕士

【摘要】 早期的P2P应用对Internet发展起了一定的促进作用,但随着近几年P2P业务的迅猛发展,P2P业务占用的网络带宽日益增加,已经开始影响到了传统互联网业务(如WWW、E-MAIL、FTP等)的正常运作。如何应对P2P带来的冲击和挑战已经成为各运营商必须面对一个难题,P2P流量控制技术呼之欲出。传统的包过滤防火墙都是工作在OSI模型的第2、3或者4层,主要通过对MAC、IP或者TCP/UDP端口进行流量识别,近年来出现了DPI(深度包检测)技术、传输层特征识别等的多种识别技术,其中以DPI技术最为成熟,应用最广。针对目前P2P流量控制所面临的问题,本文在研究P2P流量识别技术和控制技术的基础上,提出了一个以特征值识别为主的,多种识别方式结合的复合型P2P流量控制模型。通过分析Netfilter在Linux2.4内核中的实现机制和编程接口技术,编程实现了该模型。本文主要工作内容包括：(1)介绍了P2P技术的基本概念、P2P网络的历史发展。(2)从P2P流量识别技术和流量控制技术两个角度,阐述了P2P流量控制技术的实现原理。(3)介绍了Netfilter在Linux内核中的实现机制,用户空间管理工具IPTables及其连接跟踪功能CONNTRACK的框架。从源代码出发分析了Netfilter内核模块的主要编程接口功能及用户空间与内核空间的交互机制。(4)设计并实现了一个Linux系统下的P2P流量控制系统。首先分析了该系统各模块的功能,再详细介绍各功能模块的设计原理及模块实现中的关键数据结构与接口。最后通过测试验证了系统的可行性。更多还原

【Abstract】 The P2P applications used to play a role in development of Internet, while with P2P application’s rapidly developing, it takes more and more network bandwidth, and P2P application begins to influence traditional Internet business like WWW, E-MAIL and FTP. How to meet the impact of P2P becomes a problem that ISP has to face. Traffic control is the point to solve the problm.The traditional packet filtering firewall is working in Layer 2,3 or 4 of OSI model, which uses MAC, IP and port of TCP/UDP. In recent years appears DPI, traffic feature identification and so on, in which DPI is adopted widest. As to the problems of P2P traffic control, this paper presents a P2P traffic control model of DPI and other methods, on the basis of research of P2P traffic identifying and traffic control. The paper programs and implements the system by analyzing the way Netfilter works in Linux2.4 kernel.The research work and contribution can be summarized in the following aspacts:(1) Introducing the basic concept and development of P2P.(2) Analysing the theory of P2P traffic control technology from the aspect of P2P traffic identifying technology and P2P traffic control technology.(3) Introducing how Netfilter works in Linux kernel and introducing IPTables, which can administer Netfilter in user space, and structure of connect trace. The paper analyses function of Netfilter kernel interfaces and theory of communication between user space and kernel space from the aspect of source code.(4) Designing and implementing a Linux-based P2P traffic control system. The paper first ayalyses function of each module of system, then descripes design principle, and lists the key function interfaces and data-struct of each module. In final, the system passes the test, which demonostrates the feasibility and practicability of the system.更多还原