以開放式軟體Brctl、Tcpdump及IPTables進行網路封包記錄或阻斷的方法

THE WAY OF RECORDING NETWORK PACKETS OR BLOCKING BY USING THE OPEN SOURCE SOFTWARE OF BRCTL、TCPDUMP AND IPTABLES

王建智(Chien-Chih Wang)

指導教授 ： 湯政仁

大同大學/電機資訊學院/通訊工程研究所/碩士(2008年)

摘要

Brctl的目的是將多個網路介面連接起來成為一個虛擬的網路介面，這些多個網路介面彼此之間都會互相傳遞封包。Tcpdump是針對所建立的虛擬網路介面進行網路封包資料的擷取；IPTables是針對所建立的虛擬網路介面去對特定形式的封包進行阻斷。現今網路安全的主要顧慮除了熟知的網路病毒入侵問題，木馬程式及後門程式的植入，或是個人資料的遭到竊取之外；許多機構更是重視機構內部資料的控管，而這些資料的流動的方式，不外乎是檔案傳輸、EMail與即時通訊。本論文提供記錄或阻斷網路封包的方式來建立網路的安全性，針對九種的網路協定進行處理，如HTTP、FTP、TELNET、SMTP、POP3、MSN、Yahoo Messenger、AOL/AIM/ICQ及Google Talk。HTTP、FTP與TELNET，這三個是屬於資料呈現或檔案傳輸的部分。在EMail部分則是SMTP與POP3。最後，MSN、Yahoo Messenger、AOL/AIM/ICQ與Google Talk，這四個皆為即時通訊的部分。

關鍵字

網路封包記錄

並列摘要

The purpose of the Brctl is a virtual network interface, which consists of many network interfaces. Those network interfaces transfer packets for each other. The Tcpdump captures packets from the virtual network interface. The IPTables blocks packets in particular shape or form from the virtual network interface. People have a lot of scruple about the current network security including virus, Trojan horse, backdoor programs and, stealing personal information, but those aren’t the most important things for many apparatus. They attach great importance to control of internal information, that those information are transmitted by transferring files, Email and, instant message. This paper provides methods of recording or blocking network packets that build network security. This paper’s system process nine network protocols like HTTP, FTP, TELNET, SMTP, POP3, MSN, Yahoo Messenger, AOL/AIM/ICQ and, Google Talk. HTTP, FTP and, TELNET belong to transferring files or presenting data. SMTP and POP3 belong to EMail. At last, MSN, Yahoo Messenger, AOL/AIM/ICQ and, Google Talk belong to instant message.

並列關鍵字

tcpdump ； iptables ； linux

參考文獻

[2] L.Garber, “Instant Messaging: A New Target for Hackers,” IEEE Computer Society members, Volume 38 Issue 7, CA, USA, pp 20-23, 2005

[3] 鄭進興、林敬皇、沈志昌、林宜隆, “電腦鑑識方法與程序之研究,” TANET 2003台灣網際網路研討會論文, 2005

[24] D.Koufaty and Deborah T.Marr, “Hyperthreading technology in the netburst microarchitecture,” HYPERTHREADING TECHNOLOGY, Volume 23 Issue 2, pp 56-65, Berkeley, CA, 2003

[25] Patricia McDermott-Wells, “What is Bluetooth?,” Potentials, IEEE , Volume 23 Issue 5, pp 33-35, Miami , FL, 2004

Introduction to Linux Netfilter補充資料, 新竹,台灣, 2002