以網路流量分析網路使用者之行為－以淡江大學為例

本研究是以實際網路流量數據，來分析使用者的網路行為。目前大部分流量分析主要是以Netflow資料為主，但此種方式會造成「無法分類」(Others)類別流量過大的情況。因此本研究設計並實作一套資料收集方法及軟體，不但採用Netflow資料且結合監聽封包的方式，來改善其統計結果。本研究是以淡江大學校園網路作為個案研究。本研究發現：佔用頻寬最大比例者為P2P軟體之檔案資料傳輸，約佔總頻寬34%，其中最大項目為eDonkey，佔總頻寬使用量約24%；群組的流量，大部分是群組內少數使用者所使用；寬頻及窄頻使用者行為有顯著不同，其中，寬頻使用者是以下載檔案為主，而窄頻使用者是以收信為主；在檔案的傳輸中，以副檔名為dat、mpg、avi等影片檔及副檔名為iso、mdf、img等光碟映射檔為主要傳輸類別。

關鍵字

使用者行為； Netflow ；網路流量

並列摘要

Based on the network traffic flow data, this study will analyze the network user's behaviors. Currently, most of the traffic analysis reports are mainly based on the Cisco Netflow data only, which will categorize a lot of services belonging to 'others'. Therefore, we use a different approach and design software to collect data. Our approach, combining Netflow data and packet-sniffing, will reduce the percentage of 'others'. TamKang University campus network environment is our study case. Our study has the following findings: most of the network bandwidth is used by P2P software to transfer the files, approximately 34%. Among the P2P software, the largest service item is the eDonkey, approximately 24%. Most of the traffic in each group is used by only a few users. The behaviors of the broadband users are significantly different than the narrowband users. To download the files is the major purpose of the broadband users, but the narrowband users are used to get their Emails. The files with the video files extensions of dat、mpg、avi and with image file extensions of iso、mdf、img are the primary file types transferred by campus users.