System and method for realizing multiple link point-to-point silent interception by port image

Abstract

The system comprises: communication equipment, third party router and audio monitor. Said third party router comprises an operation managing module, a support module, a driving module, a relay module, a port mapping module and an access control module. The method comprises: 1) connecting the third party router to the monitoring lines and the audio monitor; 2) configuring port parameters in order to make said parameter keep consistence with the parameters of the monitoring lines and to make binding between the virtual port of multi links and the port of WAN; 3) rebuilding the fragment packet received from the virtual port of multi links; converting the link layer packaged format into the Ethernet packaged format; 5) analyzing the content of data packet.

Description

technical field [0001] The invention relates to the field of data communication, in particular to a system and method for realizing multi-link point-to-point silent interception through port mirroring. Background technique [0002] In a switched network environment, generally the communication between two workstations will not be monitored by a third party. However, in some cases, we may need to monitor all data packets entering and leaving the network for the management server installed with monitoring software to capture the data. For example, Internet cafes need to provide this function to send the data to the public security department for review. In order to ensure information security and protect company secrets, enterprises urgently need a port in the network that can provide this real-time monitoring function. Using the port mirroring function in an enterprise can monitor and manage the network data inside the enterprise well, and when the network fails, it can do a...

AI Technical Summary

Problems solved by technology

[0003] However, at present, switches or routers that support port mirroring function are widely used to monitor the network. By configuring the switch or router to forward the data of one or more ports to a certain port, the monitoring of the network is realized. This monitoring is currently limited to the Ethernet type. For E1 / CE1, T1 / CT1, POS and other WAN ports, there is currently no equipment that can monitor them, and if a professional WAN port analysis instrument is used, the price of the instrument is too high

For virtual ports bundled with multi-links such as E1, since MPPP itself uses fragmentation to send data packets, this increases the difficulty of monitoring data packets. At present, no manufacturer can realize virtual ports bundled with multi-links. Port mirroring, so that the virtual port of the multi-link bundle cannot be silently listened to

Images