基于 NDIS中间层驱动的高速网络设备监测技术 *

传统的基于应用层的网卡监测方式已难以对高速网卡活动信息进行实时、准确监测。为此 ,分析基于 NDIS( network driver interface specification)中间层驱动和 Windows网络数据包过滤技术的特点 ,采用核心态 NDIS中间层驱动程序实现了与底层网络接口设备具体细节无关的高速网络设备监测技术 ,设计并实现了 Windows平台下基于 NDIS的网卡监测器。它分为应用层和驱动层两个模块 ,能够在保证高性能的情况下在数据链路层同时对多个网卡进行精确监测 ,其主要特点是对所

High-speed network device monitoring based on NDIS IMD

Traditional application layer based network interface card( NIC) method became inefficient in real-time and accu-rate high-speed NIC monitoring. With the analysis of network driver interface specification( NDIS) and packet filtering under Windows platform, the paper proposed an NIC independent high-speed network and monitoring method based on NDIS. The NIC monitor was implemented with application layer module and the driver layer ones. The monitor is capable of monitor multi-ple NICS simultaneously and accurately. Its main characteristic is analyzing and processing all the packets in the kernel layer.