NETWORK MONITORING

SYSTEM
Literature Survey
 A. Basic terminology
Network monitoring tool
Network monitoring tool is the networking tool that is used to examine
usage of local area network and provide a statistical data of uploads and
downloads in a network. Monitoring tool is usually used to monitor I/P traffic
between the LAN and the internet. It is a network diagnostic system that is used
to monitor local area network and provide a statistical display of the same. The
data can be further used to improve the network efficiency. Other problems such
as locating the down server, receiving incorrect work request etc can also be
removed.
 Simple network management protocol

Simple network management protocol (SNMP) is based on agent/manager

model. The model consists of an agent, a manager, a database containing
information about the management and the network protocols.
In SNMP the administrative computer which is more commonly called as manager
has the task of monitoring and managing a group of systems in a network. The
systems that are managed by the manager have a continuous program running
known as agent, which reports the information to the manager via SNMP.
Devices such as Routers, printers, servers etc use SNMP.
WinPcap
 It is a freeware which is used for direct network access under windows.
WinPcap provides architecture for network analyses and packet capturing for
win32 platform.
WinPcap can facilitate:
 Raw packet capturing
 Filtering the packets according to the set of rules defined by the user.
 To gather statistical data related to network traffic.
Why do we need it??
 Network Traffic Monitoring (NTM) is a network analytic tool that observes
local area network usage and provides a statistical display of uploads and
downloads in a network. The network display monitor displays following
information:

 • Source address of the system that sends frame to the network.

 • The protocol that was used to send the frame.
 • Destination address of the system where the frame will be received.
 • Data of the message that is sent.

 Capturing is the process by which a network monitor collects the information.

All the information is stored by default in capture buffer. Also, one can
apply restrictions on the information to be captured by the system and the
data to be displayed on the monitor.
 The network monitoring tool is essential to keep the track of the packets that
are entering and leaving the system. NMT can provide an statistical data of
the network traffic and thus improvements can be made on the system.
C. Current research and progress
 Microsoft is currently empowering a project to build a network
monitoring tool to achieve “State of art”. By introducing this system one
can improve network efficiency and monitor the same more efficiently.
 Moreover researches are adopting various techniques, such as use of an
Active measurement system in which a probe traffic is injected into the
network and then monitor the performance of the system from the
performance of the injected packets.
PROBLEM DEFINITION

 PREVIOUS NETWORK MONITORING TOOLS

ARE NOT USER FRIENDLY.
 THE SECURITY WAS NOT THE PRIMARY
OBJECTIVE.
 RESTORAL CAPABILITIES WERE NOT
A BIG ISSUE.
 TRAFFIC REROUTING WAS NOT A
PROMINENT FEATURE IN THEIR
INVENTORY.
PLATFORM DEPLOYED-VISUAL C++

WHY VISUAL C++ ? ??

 MICROSOFT FOUNDATION CLASS LIBRARIES.

 AUTOMATIC GENERATION OF INTERFACE.

 OBJECT ORIENTED APPROACH.

 INCORPORATES SEVERAL NEW PROTOCOLS.

 SYSTEM ARCHITECTURE

Management clients ( PCs, workstations )

Network

Management server Management server

Management MIB Management MIB
application application

Network

Element Element
manager manager

Network resources ( servers, routers, hosts ) with management agents

 SYSTEM DESIGN:
 What is it??
System design describes the requirements that are
needed by our system. It also emphasis on the
operating requirement and the system and its sub
system’s architecture. The input/output layout,
interphases, detailed design, and processing logic
are also covered.
  Understood The scope
 How to do it?
 Who will do what?
 What makes it
different
DEVELOPMENT LIFECYCLE

 Functional
requirement
 Objectives
 Need
PLANNING

 UML Diagrams to
ANALYSIS describe
operations
 Procedural flow
 Input output
layout

DESIGN
 Yet on it??

IMPLEMENTATION
 Our implementation
We have used UML diagrams to describe operations and
functions or our system including its structural and
behavioural view
Use Case Diagram

1) Actors:
• Network: It represents a collection of machines connected to the host machine
and passes the packets from one machine to another.
• NPM Tool: it takes packets from the network, analyzes them and monitors the
network.
• System owner: System owner is the client accessing services from the server.

2) Use Cases:
• IP Packets: All the IP packets in the network come to NPM for analyses.
• Alert system: Alerts the system owner if a anomaly is detected.
• Log file: Keep track of the IP address and name of the machine which is stored in
the database.
• Anomaly detection: Detects if there is any deviation from the specified rules.
• Monitors network
• Calculates Bandwidth
• Provides GUI
TOOLS/PROTOCOLS Required

INTRODUCTION TO VISUAL C++

 Visual C++ is the most powerful front-end tool and graphical user interface
that is mainly used for developing application programs.
 The added advantages of Visual C++ are the built in Microsoft Foundation
Class (MFC) Libraries.
 These Libraries include base classes for creating windows, form, dialogue,
sockets etc. These libraries are included to reduce the overhead of
developer in creating windows and interfaces and he can focus on the
application development. In addition Visual C++ support network
programming with giving access to NIC.
 WinPcap

 WinPcap is a free, public system for direct network access under Windows.
WinPcap is an architecture for packet capture and network analysis for the
Win32 platforms.

 The purpose of WinPcap

 Capture raw packets
 Filter the packets according to user-specified rules before dispatching them to
the application
 Transmit raw packets to the network
 Gather statistical values on the network traffic
3.2.1 WinPcap structure
SNMP
 SNMP is based on the manager/agent model consisting of a manager, an
agent, a database of management information, managed objects and the
network protocol. The manager provides the interface between the human
network manager and the management system. The agent provides the
interface between the manager and the physical device(s) being managed
 The manager and agent use a Management Information Base (MIB) and a
relatively small set of commands to exchange information.
 SNMP uses five basic messages
 GET
 GET-NEXT
 GET-RESPONSE
 SET
 TRAP
Layered Communication
IMPLEMENTATION
NMS is implemented in following modules.
 Network Browser
• Scanning the network for system: Using findalldev() and openlive()
Function
• System Status: Checks the number of active users in the network and their Ip
and Mac address
• ARP request is send using pcap_sendpacket() and reply is received using
pcap_next_ex().
• Machine Name: Computer name is retrieved from the system using Winsock
function

FUNCTIONS
 pcap findalldev()
 pcap openlive()
 pcap setfilter()
 pcap compile
 pcap Loop()
 pcap next ex()
 pcap send packet()
 pcap close()
 TRAFFIC MONITORING
Main feature of our project is monitoring traffic in the network

• Network traffic analyzer

The port numbers are used to identify the application layer
protocols (HTTP,FTP,DNS etc.)

• Protocol analyzer
This monitors the protocol used by each system and thus enables to
calculate bandwidth usage.

• Bandwidth monitor
Bandwidth is calculated by monitoring the number of packets traverse.
Size of each packet *Number of packets=Value of bandwidth
TESTING
Unit Testing
 We did unit testing on our various sub units of the program.
 The function pcap_findalldevs() was tested for the various networks that can
be opened.
 The function Pcap_open_live() was tested to check the working which was to
open the live capture function.
 Pcap_setfilter() was tested to check the association of the filter to a capture.
Integration Testing
 The integration testing produced errors as Unit testing was not a success.
System Testing
 The system testing will be done once we get favorable outcomes from the
Integration testing.
Comparison Testing
 The comparison testing will be done and the output of the software will be
tested with the software which is available in the market.
Future Enhancement

Project can be further enhanced to

 Fault management
 Alerts and threshold
 Windows event log monitoring
 Traffic management
 Network Security
 Network scheduling
QUESTIONS ???