設計與實作Linux 作業系統的網路行為分析之工具

Abstract

隨著資訊與網路科技的快速發展，造就了數位多媒體裝置的興起，使得資訊家電與網路的整合成為一個新的課題。同時，也因為市場的需求的增加，傳統的資訊產品開發方式已經不能滿足市場上迫切的需求，網通市場因此導向了快速整合一途。 隨著資訊產品的整合加速，產品的開發週期也因此受到了壓縮，相對的測試時間也跟著縮短，使得市場上充斥著各種性能良誘不齊的多媒體網路裝置。因此，如何開發出一個網路評比工具，用來快速的分析網路裝置的行為模式，進而分析出其整體效能，甚至是找出系統效能上的瓶頸，也是一個很重要的課題。 目前為止，很少看到有這樣的工具存在於市面上，也因此開發出能夠監控網路核心行為的工具程式便成了一件刻不容緩的事情。 首先，這樣的工具程式一定要能具備如下幾項功能，才能滿足分析網路行為的基本需求。(1)必須具備分析網路堆疊核心函數的功能，藉此將封包進出網路堆疊的路徑透明化(2)必須具備有監控網路核心事件發生的功能，網路行為會受到諸多因素而改變如：網路斷線、IP位址改變等(3)必須具備有封包截取器，才能解析封包內容，以了解網路協議的行為(4)必須具備有能夠快速分析網路行為與系統效能之能力。 本論文主要目標在於開發一個網路效能評比工具NBA(Networking Behavior Analysys Tool)以整合上述所有功能，以量測在不同網路層所花費的時間。藉此工具找出封包在傳送及接收時所發生的延遲時間以及分析網路通訊堆疊的整體效能。 論文的最後，將會實測出本軟體的處理能力，以確保對核心原始碼的改動不會造成太多的負面效應，以影響測試結果的公正性。

In this thesis, we present the design and implementation of a tool that can be used to analyze the networking behavior of networking devices. While analyzing the networking behavior of networking devices, we need to consider not only the network accessibility but also the critical performance metrics, such as transmission delays, response times, and packet losses, of the devices. These metrics depend on the integrated behavior of both the networking protocols and kernel software of the devices. However, no tools so far can be used to analyze such integrated behavior on an embedded networking device. We first developed a kernel behavior profiler that can profile the processes of kernel functions and occurrences of events. In addition, we also develop a packet capturer that can sniffer and record layer-2 packets, both frame header and payload. We then develop an integrated analyzer that is responsible for integrating the kernel log and sniffer data, and provides an interface for a user to analyze the integrated behavior of networking devices. In order for the analyzer to integrate the kernel log with sniffer data, we analyzed the packet format and the packets process procedures executed by the kernel functions, and deduced the information we need to record in kernel behavior log. Furthermore, we also adopt memory-based profiling approach to store the kernel behavior log. In addition, we also use virtual memory techniques to map a user space to the kernel space and develop a background backup process to move the kernel log to a mass storage device. Experimental results show our kernel behavior profiler can record kernel behavior and backup log very effectively with a negligible overhead. Finally, the integrated analyzer also provides an integrated view of the networking behavior. With the integrated viewer, a user can select a packet and examine its corresponding kernel functions and events.