基于旁路方式网络监控的TCP/IP协议分析与阻断

Analysis and Block of TCP/IP Protocol Based on the By-pass Network Monitor

在分析了传统网络监控的协议阻断基础上,提出了一种新的协议阻断方法。针对TCP/IP协议的特性,将阻断方式分为TCP流阻断和UDP单包阻断。对TCP流协议采用RST或FIN包来阻断,对UDP单包协议采用ICMP端口不可达包来阻断。

Based on the protocol analysis of traditional network monitor, a kind of generic method is used to solve it . According to the trait of TCP/IP protocol, It classify block as TCP stream block and UDP single packet block. As TCP stream protocol, It adopt RST packet to block and the port unreachable is used to UDP single packet block.