Abstract - Network Monitoring System

NETWORK MONITORING SYSTEM

Literature Survey

u A. Basic terminology

Network monitoring tool

Network monitoring tool is the networking tool that is used to examine usage of local area network and provide a statistical data of uploads and downloads in a network. Monitoring tool is usually used to monitor I/P traffic between the LAN and the internet. It is a network diagnostic system that is used to monitor local area network and provide a statistical display of the same. The data can be further used to improve the network efficiency. Other problems such as locating the down server, receiving incorrect work request etc can also be removed.

 

Ø Simple network management protocol

Simple network management protocol (SNMP) is based on agent/manager model. The model consists of an agent, a manager, a database containing information about the management and the network protocols. In SNMP the administrative computer which is more commonly called as manager has the task of monitoring and managing a group of systems in a network. The systems that are managed by the manager have a continuous program running known as agent, which reports the information to the manager via SNMP. Devices such as Routers, printers, servers etc use SNMP.  

WinPcap

u It is a freeware which is used for direct network access under windows.

WinPcap provides architecture for network analyses and packet capturing for win32 platform.

WinPcap can facilitate:

u Raw packet capturing

u Filtering the packets according to the set of rules defined by the user.

u To gather statistical data related to network traffic.

 

B. Why do we need it??

u Network Traffic Monitoring (NTM) is a network analytic tool that observes local area network usage and provides a statistical display of uploads and downloads in a network. The network display monitor displays following information:

u • Source address of the system that sends frame to the network.

u • The protocol that was used to send the frame.

u • Destination address of the system where the frame will be received.

u • Data of the message that is sent.

u Capturing is the process by which a network monitor collects the information.

All the information is stored by default in capture buffer. Also, one can apply restrictions on the information to be captured by the system and the data to be displayed on the monitor. 

u The network monitoring tool is essential to keep the track of the packets that are entering and leaving the system. NMT can provide an statistical data of the network traffic and thus improvements can be made on the system.  

C. Current research and progress

u Microsoft is currently empowering a project to build a network monitoring tool to achieve “State of art”. By introducing this system one can improve network efficiency and monitor the same more efficiently.

u Moreover researches are adopting various techniques, such as use of an

Active measurement system in which a probe traffic is injected into the network and then monitor the performance of the system from the performance of the injected packets.

 

PROBLEM DEFINITION

v PREVIOUS NETWORK MONITORING TOOLS ARE NOT USER FRIENDLY.

v THE SECURITY WAS NOT THE PRIMARY OBJECTIVE.

v RESTORAL CAPABILITIES WERE NOT A BIG ISSUE.

v TRAFFIC REROUTING WAS NOT A PROMINENT FEATURE IN THEIR  INVENTORY. 

 

SYSTEM DESIGN:

u What is it??

System design describes the requirements that are needed by our system. It also emphasis on the operating requirement and the system and its sub system’s architecture. The input/output layout, interphases, detailed design, and processing logic are also covered.

 

Our implementation

We have used UML diagrams to describe operations and functions or our system including its structural and behavioural view  

Use Case Diagram

1) Actors:

• Network: It represents a collection of machines connected to the host machine

and passes the packets from one machine to another.

• NPM Tool: it takes packets from the network, analyzes them and monitors the

network.

• System owner: System owner is the client accessing services from the server.

 

2) Use Cases:

• IP Packets: All the IP packets in the network come to NPM for analyses.

• Alert system: Alerts the system owner if a anomaly is detected.

• Log file: Keep track of the IP address and name of the machine which is stored in

the database.

• Anomaly detection: Detects if there is any deviation from the specified rules.

• Monitors network

• Calculates Bandwidth

• Provides GUI

TOOLS/PROTOCOLS Required

WinPcap

u WinPcap is a free, public system for direct network access under Windows.

WinPcap is an architecture for packet capture and network analysis for the

Win32 platforms.

u The purpose of WinPcap

v Capture raw packets

v Filter the packets according to user-specified rules before dispatching them to

the application

v Transmit raw packets to the network

v Gather statistical values on the network traffic

 

SNMP

u SNMP is based on the manager/agent model consisting of a manager, an agent, a database of management information, managed objects and the network protocol. The manager provides the interface between the human network manager and the management system. The agent provides the interface between the manager and the physical device(s) being managed

u The manager and agent use a Management Information Base (MIB) and a

relatively small set of commands to exchange information.

u SNMP uses five basic messages

v GET

v GET-NEXT

v GET-RESPONSE

v SET

v TRAP

TRAFFIC MONITORING

Main feature of our project is monitoring traffic in the network

• Network traffic analyzer

The port numbers are used to identify the application layer

protocols (HTTP,FTP,DNS etc.)

• Protocol analyzer

This monitors the protocol used by each system and thus enables to

calculate bandwidth usage.

• Bandwidth monitor

Bandwidth is calculated by monitoring the number of packets traverse.

Size of each packet *Number of packets=Value of bandwidth

 

TESTING

Unit Testing

u We did unit testing on our various sub units of the program.

u The function pcap_findalldevs() was tested for the various networks that can

be opened.

u The function Pcap_open_live() was tested to check the working which was to

open the live capture function.

u Pcap_setfilter() was tested to check the association of the filter to a capture.

Integration Testing

u The integration testing produced errors as Unit testing was not a success.

System Testing

u The system testing will be done once we get favorable outcomes from the

Integration testing.

Comparison Testing

u The comparison testing will be done and the output of the software will be

tested with the software which is available in the market.

 

Future Enhancement

Project can be further enhanced to

u Fault management

u Alerts and threshold

u Windows event log monitoring

u Traffic management

u Network Security

u Network scheduling