The Design And Implementation Of High-Speed Network Traffic Record And Playback System

In With the explosive development of the Internet, People are more and more depending on the Internet, which has become a popular way of life. At the same time, the network and information security problems have become the major issues concerning the country’s political, economic, social, cultural, and national security. Comprehensive system testing is an important means to ensure network security, but the development of network testing technology is significantly lagging behind the Internet. The common testing technology is not enough to support the development of Internet.This thesis proposes a test method based on real network traffic playback, and designs a2.5G/10G high-speed network traffic record playback system. The main content of this thesis as follows:1. By analyzing the shortcoming of the current test means, this thesis proposes a test method that simulates real network scene by replaying real network traffic and then tests the device under this background.2. By analyzing the requirements of traffic replay test, this thesis designed a2.5G/10G network traffic capture playback system.3. In order to achieve wire speed(2.5G/10G) network traffic capture and storage in0packet loss rate, this thesis proposes an asynchronously parallel method to capture and store packet based on circular queue buffer, and designs file-matrix architecture to store packet data, which greatly improved the performance of capture and storage.4. For mass traffic retrieval, this thesis combines hash location, Bloom Filter and digest index to create one three-level search method to fast query and locate network traffic.5. For traffic playback, this thesis proposes three playback modes:wire-speed, controlled flow rate and the rate when the traffic was captured, and also designs a variety of methods to playback the traffic clip.The network traffic record and playback system makes the real network traffic into a test traffic that can be controlled, marked and replayed. It remedies the defects of the current test means and makes test results more valuable. The system can also be used to analyze network security events.