The Research And Realization Of Detection System In Switched Ethernet

With the development of network technology, Internet has become more and more popularall over the world. Numerous organizations and enterprises have built their network for working,as a result, they increase their work efficiency greatly and depend upon it more and more.On the one side, People are enjoying the good life which Internet brings us, on the otherside, The high development of Internet also bring us much new menace and bemusement, suchas short of unified management and we can't control users' efficiency, continuously increasedbroad band but we can't distinguish users' rationality, the internet content pass away the sham asthe genuine and so on. According to the statistics by calculating, our annual network offences to30% speed increase. in the face of the growing trend of computer-related crime and theproliferation of information networks, increasing garbage and pollution, the government hasformulated a plan on the use of the Internet laws and regulations, network security has facedmajor challenges.Considering the network secure and promoting work efficiency, network managers beginuser various network detection software one after another. For example, we can useSentry4,Web guilder and network viewer to detect the internet content of host computer. butwith the shared Ethernet replaced by the switched Ethernet, these software's deployingcondition becomes more rigor, and it's effect can't satisfy us.The biggest difference between Switches and hubs is communication packets are no longerreplicated to all other ports, but the precise target machine is sent to that port, so that othermachines can not monitor this purpose stronger communication, and of course could not beachieved by paying a packet. On above all, this thesis brings forward a method that we cansniffer user data with the technique of ARP Spoofing to attain the target of user management anddetection. The basic tenets of the system is through the use of Arp Spoofing, we can monitor themainframe's data which should be sent the gateway but to us. through the WinPcap, we cancapture all data packets in local networks, and finish decryption of data packets, and thus we canmonitor network in real time and automatically discover activities which violates Internetstrategy and give an alarm.This method makes the deploying of software comparatively easy. We only need to installthe software in any host computer linked by Switch for network detection, It Greatly facilitatenetwork managers to manage Internet users. This thesis has done some research related tonetwork detection, using popular language VC++ and object-oriented technology, recur to theoriginal virtual data package and multithreading. Consequently, this detection system canmonitor one or one group of machines.