CN1866951B - Method and system for detecting shared access hosts in network - Google Patents

Abstract

The invention discloses a method for detecting a shared access host in a network to solve the problems in the prior art that the detection of a shared access host affects users and cannot accurately detect the shared access host due to user operations; the method is as follows: Obtain the network data of the access network from the network; extract the transmission control protocol (TCP) data packet from the network data, and extract the source IP address and the corresponding IP packet identification from the TCP data packet; and according to a certain time The change feature of the IP packet identification of the TCP data packet with the same source IP address determines that the host corresponding to the IP address is a shared access host. The invention also discloses an access monitoring system, which includes: a data forwarding device, a streaming filter server and a statistical analysis server.

Description

Method and system for detecting shared access hosts in network

technical field

The invention relates to a network sharing technology in a communication network, in particular to a method and system for detecting a shared access host in the network.

Background technique

The broadband service in the data service is an important part of the telecommunication service. At present, there are some technologies for implementing network sharing access by using network address translation (NAT), proxy (Proxy) and the like. This kind of access is mainly through NAT mode or Proxy proxy mode, so that multiple users or multiple hosts use the same IP address or account to access the Internet to realize network sharing. This access method has already been applied on a considerable scale and is developing rapidly.

In order to quickly and accurately detect shared Internet hosts on the network, the prior art mainly contains the following two technical solutions:

One solution is to install specific software on the client computer, and use the software to analyze the user host system information, IP address and other host characteristics to obtain shared Internet user information, and regularly send monitoring data to the monitoring server, and the monitoring server will make statistics to determine the shared Internet host .

Another solution is to reserve a backdoor program on the asymmetric user data loop modem (ADSL modem), scan the host operating system in the internal LAN by reserving a simple network management protocol (SNMP) port, and determine the number of statistics Shared Internet hosting.

The above two solutions have the following disadvantages respectively:

Installing the client software on the client computer will not only cause disgust of the user, but also increase the maintenance workload of the operator, that is, when the client software does not work normally, the operator needs to maintain the software frequently. What's more serious is that the client software can be technically bypassed through operations on the client, so that accurate information cannot be monitored.

The method of searching for the number of hosts by scanning SNMP ports will also cause user disgust, and users can disable SNMP services and other methods to make them invalid, and accurate information cannot be monitored.

In short, the above two methods will not only affect the user, but also cannot accurately detect the shared Internet host due to the operation of the user.

Contents of the invention

The invention provides a method and system for detecting a shared access host in a network to solve the problems in the prior art that the detection of a shared access host affects users and cannot accurately detect the shared access host due to user operations.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for detecting a shared access host in a network, comprising the steps of:

A, obtain the network data of access network from network; B, extract Transmission Control Protocol (TCP) data packet from described network data, and extract source IP address and corresponding IP packet identification from this TCP data packet; C, according to the change characteristics of the IP packet identification of the TCP data packet of the same source IP address, determine whether the corresponding host of the source IP address is a shared access host, wherein, according to the IP packet identification of the TCP data packet of the same source IP address The process of determining whether it is a shared access host specifically includes: calculating the difference between the IP packet identifiers of two consecutive TCP packets with the same source IP address; comparing the difference with the corresponding set value Compare, and when the difference is greater than the corresponding set value, determine that the host corresponding to the source IP address is a shared access host; or, when the set detection period expires, calculate the IP address of the same source IP address in this period. The difference between the largest IP packet identifier and the smallest IP packet identifier in the packet identifier; comparing the difference with the corresponding set value, and determining the IP address corresponding to the source IP address when the difference is greater than the corresponding set value The host is a shared access host.

In step B, the source port number is also extracted from the TCP data packet.

Also comprise step before step C: C1, according to the source port number change feature of the TCP data packet of same source IP address, determine whether the host computer corresponding to this source IP address is a shared access host, and if it cannot be determined that the host is a shared access host When entering the host, go to step C.

Step C1 includes the steps of: calculating the difference between the source port numbers of two consecutive TCP packets with the same source IP address; comparing the difference with the corresponding setting value, if the difference is greater than the corresponding setting value, it is determined that the host corresponding to the source IP address is a shared access host, otherwise, go to step C.

Or step C1 includes the steps: when the set detection cycle arrives, calculate the difference between the maximum source port number and the minimum source port number among the source port numbers with the same source IP address in this cycle; If the difference is greater than the corresponding set value, then it is determined that the host corresponding to the source IP address is a shared access host, otherwise, go to step C.

A method for detecting a shared access host in a network, comprising the steps of:

(1) Obtain the network data of the access network from the network; (2) extract the transmission control protocol (TCP) data packet from the network data, and extract the source IP address and the corresponding source port from the TCP data packet (3) According to the change characteristics of the source port number of the TCP data packet of the same source IP address, determine whether the host corresponding to the source IP address is a shared access host, wherein, according to the TCP data packet of the same source IP address The change characteristics of the source port number, the process of determining whether it is a shared access host specifically includes: calculating the difference between the source port numbers of two consecutive TCP packets with the same source IP address, and comparing the difference with the corresponding set When the difference is greater than the corresponding set value, it is determined that the host corresponding to the source IP address is a shared access host; or when the set detection period is up, it is calculated that the source IP address in this period is the same The difference between the largest source port number and the smallest source port number in the source port number, compare the difference with the corresponding set value, and determine the source IP when the difference is greater than the corresponding set value The host corresponding to the address is a shared access host.

An access monitoring system, characterized in that it comprises:

The data forwarding device is arranged at the exit of the monitored host group or the exit of the network, and is used to forward the network data connected to the network through the exit;

A streaming and filtering server, connected to the data forwarding device, for obtaining network data from the data forwarding device, extracting data packets of a specified type from the network data and analyzing required information, wherein the required information includes : source IP address and corresponding IP packet identifier, or, source port number, source IP address and corresponding IP packet identifier, or, source IP address and corresponding source port number;

The statistical analysis server is connected to the splitting and filtering server, and determines the shared access host according to the parsed information and configured analysis rules, wherein, when the parsed information is the source IP address and the corresponding IP packet identifier, the analysis The rule is to analyze the change characteristics of the IP packet identification of TCP data packets with the same source IP address. When the parsed information is the source port number, source IP address and corresponding IP packet identification, the analysis rule is to analyze the same source IP address According to the change characteristics of the source port number of the TCP data packet, determine whether the host corresponding to the source IP address is a shared access host, and when it cannot be determined that the host is a shared access host, analyze the IP address of the TCP data packet with the same source IP address. The change characteristics of the packet identification are determined. When the parsed information is the source IP address and the corresponding source port number, the analysis rule is to analyze the change characteristics of the source port number of the TCP data packet with the same source IP address; The change feature of the source port number of the TCP data packet of the IP address includes: calculating the difference between the source port numbers of two TCP data packets that are continuous and have the same source IP address, and comparing the difference with a corresponding set value , and when the difference is greater than the corresponding set value, it is determined that the host corresponding to the source IP address is a shared access host, or, when the set detection period is up, calculate the source port with the same source IP address in this period The difference between the largest source port number and the smallest source port number in the number, compare the difference with the corresponding set value, and determine the IP address corresponding to the source IP address when the difference is greater than the corresponding set value The host is a shared access host;

The change feature of the IP packet identification of the TCP data packets of the same source IP address includes: calculating the difference between the IP packet identifications of two TCP data packets that are continuous and with the same source IP address, and comparing the difference with the corresponding The set value is compared, and when the difference is greater than the corresponding set value, it is determined that the host corresponding to the source IP address is a shared access host, or, when the set detection period expires, the source IP address in the period is calculated The difference between the largest IP packet identifier and the smallest IP packet identifier in the IP packet identifiers with the same address, compare the difference with the corresponding set value, and determine the source IP when the difference is greater than the corresponding set value The host corresponding to the address is a shared access host.

The data forwarding device is an optical splitter, or a mirroring module in a switch for mirroring data, or a switch for forwarding the network data.

The present invention has the following beneficial effects:

The present invention extracts TCP packets from the obtained network data, and quickly and accurately detects the application in the Internet that uses NAT mode to share the Internet according to the jump of the IP packet identification and the change of the IP port. This working method adopts passive monitoring , the accuracy of the detection result is not affected by the operation on the user side, nor will it have any impact on the user's normal Internet access, and it also reduces the operator's maintenance workload.

Description of drawings

Fig. 1 is a schematic structural diagram of an access monitoring system in the present invention;

Fig. 2 is the flow chart of detecting shared access host according to the change characteristic of IP packet identification among the present invention;

Fig. 3 is the flow chart that the present invention combines IP packet port and IP packet identification change feature to detect shared access host;

Fig. 4 is a flow chart of the present invention to detect shared access hosts according to the change characteristics of IP packet ports.

Detailed ways

The present invention mainly judges from the TCP/IP level whether there are multiple users or multiple hosts accessing the network through the same IP or account and using Internet network resources.

In the network, when a host occupies an IP address to access different resources on the Internet, as the number of Transmission Control Protocol/Internet Protocol (TCP/IP) connections increases, the IP port of the host increases by +1; at the same time The IP packet identification (Identification) used to identify the IP packet also gradually increases by +1 and +2 as the connection interacts. When accessing the Internet through Network Address Translation (NAT), the port of the private network IP address is changed randomly after NAT conversion, but the IP packet identification (Identification) after the change is still retained as the original private network IP packet Identifcation. In the private network, the IP packet identification distribution of different private network hosts is random, and its range is 0-65535 (the Identification is determined by the operating system kernel, and different operating system IDs are different.). In this way, when multiple private network hosts access network resources through NAT at the same time, the IP packet port and Identification after NAT conversion have undergone great changes, and the port has a certain jump, and the Identification will also have a big jump. For example: when the host on the public network continuously accesses several different Internet resources, its IP ports are 3024, 3025, and 3026, which gradually increase. 54236 is also incremented by +1 and +2; and when two hosts access Internet resources through NAT at the same time, the IP ports after NAT conversion are 2315, 7238, and 5320 respectively, and the changes are irregular, and the Identification of the IPs are respectively 76482, 1684, 31217, 348, etc., their changes are also very irregular.

According to the change characteristics of the IP packet identification and IP packet source port number of multiple private network hosts accessing network resources through NAT at the same time in the above analysis, the detection and analysis of IP packet Identification and IP packet port number can be quickly and accurately detected. An application that uses NAT to share the Internet. In the present invention, an access monitoring system on the network side is used to obtain network data and detect applications using NAT mode to share Internet access in the Internet according to the network data.

Referring to FIG. 1 , the access monitoring system includes a data forwarding device, a streaming filtering server connected to the data forwarding device, and a statistical analysis server connected to the streaming filtering server. in:

The data forwarding device is used to introduce all network data connected to the network from the exit of the monitored host group or the exit of the network, collect the network data through access to an independent broadband and transmit it to the splitting and filtering server. In Figure 1, the data forwarding device adopts an optical splitter, which is installed at the interface of the metropolitan area network and the backbone network. The optical splitter is an existing network device that can lead data on one network to another branch network. The forwarding device can also be a mirroring module for data mirroring in a switch that supports port data mirroring, and the mirroring module can be used to obtain a copy of the network data that is connected to the network through the outlet; the data forwarding device can also be a switch, and the switch is dedicated to It is used to bypass the network data entering the network from the egress. Of course, it can also be other network devices that can obtain a copy of the network data from the egress.

The split filter server is used to separate the specified type of data packets from the network data transmitted by the optical splitter, analyze the useful data from the split data packets, and report these data to the statistical analysis server. For non-specified types of data is discarded. The data packets of the specified type are mainly TCP data packets, and also include Radius data packets for user authentication and billing. The data packets carry the user's IP address and user account. According to the Radius data packet, the user's IP address and user account can be recorded. Correspondence between user accounts.

The analysis rules are configured on the statistical analysis server, and the data filtered out by the diversion and filtering are analyzed and counted according to the analysis rules, and the basis for multi-users to share the Internet is provided. The analysis rule includes at least the set value for analyzing the change characteristic of the IP packet Identification, and may also include the set value for analyzing the change characteristic of the port of the IP packet, the corresponding relationship between the IP address and the account, and the like.

The distribution filtering server and the statistical analysis server may be the same server, or may be independent servers.

Referring to Figure 2, the process of detecting multiple users or multiple hosts accessing the network through the same IP or account is as follows:

Step 1: All network data connected to the Internet is split from the network by the optical splitter, and introduced to the split filtering server in the access monitoring system.

Step 2: The distribution filtering server performs filtering analysis, extracts TCP data packets and Radius data packets from network data according to the protocol type in the IP packet, and discards other redundant data packets.

Step 3: The distribution filtering server extracts the source IP address and IP packet Identification from the TCP data packet, and reports these data to the statistical analysis server.

If the Radius data packet is obtained, the user IP address and corresponding account information are extracted from the data packet, and reported to the statistical analysis server.

Step 4: After the statistical analysis server receives the source IP address and the corresponding IP packet Identification, it analyzes the change characteristics of the IP packet Identification of the TCP data of the same source IP address, and judges whether the user corresponding to the IP address is a shared Internet user. If the statistical analysis service receives the IP address and the corresponding account information, it will record the correspondence between the IP address and the account.

There are two ways to analyze the change characteristics of IP packet Identification:

1. By calculating the difference between the IP packet identifiers of two consecutive TCP packets with the same IP address, compare the difference with the corresponding set value, if the difference is greater than the set value, determine the source The host corresponding to the IP address is a shared access host, otherwise it cannot be determined that the host is a shared access host (in this case, it can be a non-shared access host by default). For example, if the Identifications of two data packets from the same IP address are 79231 and 4171 for a continuous period of time, it proves that there are two users using this public network IP to share the Internet. When considering the change characteristics of the IP packet Identification, it is generally considered suspicious if the jump is greater than 200.

In this way, since the statistical analysis server only compares the IP packet identification changes in two consecutive TCP packets of the same IP address, when it cannot be judged that the user corresponding to the access IP is a shared Internet user, it can Only the latest IP address and its corresponding IP packet identifier are saved.

2. By setting a detection period, when the detection period expires, calculate the difference between the largest IP packet identifier and the smallest IP packet identifier among the IP packet identifiers with the same source IP address in this period, and compare the difference with the corresponding set If the difference is greater than the set value, it is determined that the host corresponding to the source IP address is a shared access host, otherwise it cannot be determined that the host is a shared access host (in this case, it can be defaulted as a non-shared access host into the host). The set value in this case should be different from the set value in the previous method, which is related to the length of the set detection cycle. The length of the detection period can be set according to actual needs, such as 1 minute, 5 minutes or 1 hour.

After it is determined that the user accesses the Internet through the shared IP address, the corresponding user account information can be obtained according to the corresponding relationship between the IP address and the account, and the account report of the shared Internet access can be output, and the data used as the analysis basis can also be output at the same time.

Due to the random allocation of IP packet Identification, when two or more hosts access Internet resources through NAT at the same time, the change of IP packet Identification is relatively large under normal circumstances, but there may also be small changes. Therefore, it can be combined with port changes. Detect shared access hosts. Its processing process is shown in Figure 3:

Step 10: The optical splitter splits all network data connected to the Internet from the network, and introduces it to the splitting and filtering server in the access monitoring system.

Step 11: The distribution filtering server performs filtering analysis, and extracts TCP data packets and Radius data packets from network data according to the protocol type in the IP packet.

Step 12: The distribution filtering server extracts the source port number, source IP address and IP packet Identification from the TCP data packet, and reports these data to the statistical analysis server.

If the Radius data packet is obtained, the user IP address and corresponding account information are extracted from the data packet, and reported to the statistical analysis server.

Step 13: The statistical analysis server analyzes the port number change characteristics of the same source IP address, and judges whether the user corresponding to the IP address is a shared Internet user, if it cannot be determined that it is a shared Internet user, then proceed to step 14, if it is determined to be a shared Internet user user, then output corresponding information and continue to judge the host computer corresponding to the next IP address.

Analyzing the port change characteristics of TCP data can be performed in the following two ways:

1. By calculating the difference between the port numbers of two consecutive TCP packets with the same IP address, the difference is compared with the corresponding set value, and if the difference is greater than the set value, it is determined The host corresponding to the source IP address is a shared access host, otherwise it cannot be determined that the host is a shared access host (in this case, it can be a non-shared access host by default). For example, if the ports of two TCP data packets from the same IP address are 3024 and 4140 for a continuous period of time, it proves that there are two users using this public network IP to share the Internet. When considering port change characteristics, in a short period of time, if the port hops are generally greater than 100, it can be considered that there are two users using the public network IP to share the Internet.

In this way, since the statistical analysis server only compares the port changes in two consecutive TCP packets of the same IP address, when it cannot be judged that the user corresponding to the access IP address is a shared Internet user, the port In terms of numbers, only the port number corresponding to the latest IP address can be saved.

2. By setting a detection cycle, when the detection cycle expires, calculate the difference between the largest port number and the smallest port number among the port numbers with the same source IP address in this cycle, and compare the difference with the corresponding setting If the difference is greater than the set value, it is determined that the host corresponding to the source IP address is a shared access host, otherwise it cannot be determined that the host is a shared access host (in this case, the default is non-shared access host). The set value in this case should be different from the set value in the previous method, which is related to the length of the set detection cycle, and the length of the detection cycle can be set according to actual needs, such as 1 minute, 5 minutes or 1 hour, etc. are all available.

Step 14, the statistical analysis server analyzes the change characteristics of the IP packet Identification, and judges whether the user corresponding to the IP address is a shared Internet user, and the judgment method is the same as the above step 4.

Similarly, if the statistical analysis service receives the IP address and corresponding account information, it will record the correspondence between the IP address and the account. After it is determined that the user accesses the Internet through the shared IP address, the corresponding user account information can be obtained according to the corresponding relationship between the IP address and the account, and the account report of the shared Internet access can be output, and the data used as the analysis basis can also be output at the same time.

In addition, the shared access host can also be detected only through port changes, as shown in Figure 4, and the processing process is as follows:

Step 20: Splitting all network data connected to the Internet from the network by the optical splitter, and introducing it to the splitting and filtering server in the access monitoring system.

Step 21: The distribution filtering server performs filtering analysis, extracts TCP data packets and Radius data packets from the network data according to the protocol type in the IP packet, and discards other redundant data packets.

Step 22: The distribution filtering server extracts the source IP address and source port number from the TCP data packet, and reports these data to the statistical analysis server.

Step 23: After receiving the source IP address and the corresponding source port number, the statistical analysis server analyzes the source port change characteristics of the TCP data with the same source IP address, and determines whether the user corresponding to the IP address is a shared Internet user. The method of analyzing the port change characteristics of the TCP data is the same as the above, and the rest of the processing process is the same as the above, and will not be described again.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (14)

1. one kind is detected the method for sharing the access main frame in network, it is characterized in that comprising the steps:

A, from network, obtain the network data of access network;

B, from described network data, extract transmission control protocol tcp data bag, and from this tcp data bag, extract source IP address and corresponding IP bag sign;

C, according to the variation characteristic of the IP bag sign of the tcp data bag of identical source IP address, determine whether the pairing main frame of this source IP address is to share to insert main frame, wherein, variation characteristic according to the IP bag sign of the tcp data bag of identical source IP address determines whether specifically to comprise for sharing the process that inserts main frame:

Calculate the difference of the IP bag sign of continuous and two tcp data bags that source IP address is identical;

Described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference; Or,

In the sense cycle of setting then, calculate the difference of maximum IP bag sign and minimum IP bag sign in the IP bag sign that source IP address is identical in this cycle;

Described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference.

2. the method for claim 1 is characterized in that, also extracts source port number from described tcp data bag in step B.

3. method as claimed in claim 2 is characterized in that, also comprises step before step C:

C1, according to the source port number variation characteristic of the tcp data bag of identical source IP address, determine whether the pairing main frame of this source IP address is to share to insert main frame, and can not determine that main frame is to share then to carry out step C when inserting main frame.

4. method as claimed in claim 3 is characterized in that step C1 comprises step:

Calculate the difference of the source port number of continuous and two tcp data bags that source IP address is identical;

Described difference is compared with corresponding set point,, otherwise carry out step C if this difference, determines then that the pairing main frame of this source IP address inserts main frame for sharing greater than the set point of correspondence.

5. method as claimed in claim 3 is characterized in that step C1 comprises step:

In the sense cycle of setting then, calculate the difference between the maximum source port number and minimum source port number in the source port number that source IP address is identical in this cycle;

Described difference is compared with corresponding set point,, otherwise carry out step C if this difference, determines then that the pairing main frame of this source IP address inserts main frame for sharing greater than the set point of correspondence.

6. as each described method of claim 1 to 5, it is characterized in that, from described network data, also extract the Radius packet, and write down IP address in this packet and the corresponding relation between the account.

7. method as claimed in claim 6 is characterized in that, for after sharing the access main frame, utilizes source IP address to search described corresponding relation to obtain and to export corresponding accounts information at definite main frame.

8. method as claimed in claim 6 is characterized in that, obtains the network data of described access network from network exit by Port Mirroring or beam split mode.

9. one kind is detected the method for sharing the access main frame in network, it is characterized in that comprising the steps:

(1) from network, obtains the network data of access network;

(2) from described network data, extract transmission control protocol tcp data bag, and from this tcp data bag, extract source IP address and corresponding source port number;

(3) according to the variation characteristic of the source port number of the tcp data bag of identical source IP address, determine whether the pairing main frame of this source IP address is to share to insert main frame, wherein, variation characteristic according to the source port number of the tcp data bag of identical source IP address determines whether specifically to comprise for sharing the process that inserts main frame:

Calculate the difference of the source port number of continuous and two tcp data bags that source IP address is identical, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference; Or

In the sense cycle of setting then, calculate the difference between the maximum source port number and minimum source port number in the source port number that source IP address is identical in this cycle, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference.

10. method as claimed in claim 9 is characterized in that, also extracts the Radius packet from described network data, and writes down IP address in this packet and the corresponding relation between the account.

11. method as claimed in claim 10 is characterized in that, for after sharing the access main frame, utilizes source IP address to search described corresponding relation to obtain and to export corresponding accounts information at definite main frame.

12. method as claimed in claim 9 is characterized in that, obtains the network data of described access network from network exit by Port Mirroring or beam split mode.

13. one kind is inserted supervisory control system, it is characterized in that comprising:

Data forwarding device is arranged on monitored main frame group's the exit or the exit of network, is used to transmit the network data by this exit access network;

The shunt filtering server, be connected with described data forwarding device, be used for obtaining network data from described data forwarding device, from this network data, extract transmission control protocol tcp data bag and parse the information that needs, wherein this parses the information that needs and comprises: source IP address and corresponding IP bag sign, or, source port number, source IP address and corresponding IP bag sign, or, source IP address and corresponding source port number;

Statistic analysis server, be connected with described shunt filtering server, determine to share the main frame that inserts according to the analysis rule of information that parses and configuration, wherein, when the information that parses was the IP bag sign of source IP address and correspondence, this analysis rule was that the IP that analyzes the tcp data bag of identical source IP address wraps the variation characteristic of sign; When the information that parses is the IP bag sign of source port number, source IP address and correspondence, this analysis rule is the variation characteristic of the source port number of the tcp data bag of the identical source IP address of analysis, whether the main frame of determining this source IP address correspondence is to share to insert main frame, and can not determine that main frame is when share inserting main frame, determine according to the variation characteristic of the IP bag sign of the tcp data bag of analyzing identical source IP address; When the information that parses was the source port number of source IP address and correspondence, this analysis rule was the variation characteristic of the source port number of the tcp data bag of the identical source IP address of analysis;

The variation characteristic of the source port number of the tcp data bag of the identical source IP address of described analysis comprises: the difference of calculating the source port number of continuous and two tcp data bags that source IP address is identical, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference, or, in the sense cycle of setting then, calculate the difference between the maximum source port number and minimum source port number in the source port number that source IP address is identical in this cycle, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference;

The variation characteristic of the IP bag sign of the tcp data bag of the identical source IP address of described analysis comprises: the difference of calculating the IP bag sign of continuous and two tcp data bags that source IP address is identical, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference, or, in the sense cycle of setting then, calculate the difference of maximum IP bag sign and minimum IP bag sign in source IP address is identical in this cycle the IP bag sign, described difference is compared with corresponding set point, and determine that the pairing main frame of this source IP address inserts main frame for sharing during greater than the set point of correspondence in this difference.

14. access supervisory control system as claimed in claim 13 is characterized in that, described data forwarding device is an optical splitter, perhaps is the mirror image module that is used for mirror image data in the switch, perhaps for being used to transmit the switch of described network data.

Images