An approach for automating the monitoring and analysis of incoming network traffic in large-scale computer networks is proposed in the paper. The authors suggest using the Linux Berkeley Packet Filter tool to automate traffic analysis in computer networks. The software structure is developed, which includes two main parts: the service machine and the user machine, it is based on the modular principle, which allows for rapid improvement and modernization of the system. The main algorithms for software functionality are built, namely: the algorithm for processing network packets using the Berkeley Packet Filter tool, and the algorithm of the user-space program for loading the Berkeley Packet Filter program to kernel space and setting up communication with it. A study model of program functioning dynamics based on the Petri net theory has been developed. As a result of the application of models based on the Petri net in the software development process, the system works correctly, all states are accessible, and there are no dead ends. A simulation model of the application of the Berkeley Packet Filter tool for the automation of computer network traffic analysis was designed, and the script was created for testing the developed software system. Implemented Python script generates a flow of network packets with random values in the sender IP address, receiver port number, and protocol. These packets, created by the IP address spoofing methodology, later are sent to the service machine's network interface. The developed computer network traffic monitoring software, that uses the Berkeley Packet Filter tool and is implemented in C, C++, and Python programming languages, provides collecting and processing of computer network traffic data. The output of the analysed results is displayed in a user-friendly form. The development and testing of the created software were carried out on the operating system Arch Linux version 5.10.3, which was previously installed on a virtual machine. The results of traffic testing in computer networks in different modes of normal operation and during DDoS attacks are given. In particular, an example of sidebar output with network traffic statistics over a long period, an example of output with network traffic spike parameters, and an example of a warning message, that the sidebar dashboard will show, are presented.
[1] Cai, W., Song, X., Liu, C., Jiang, D., & Huo, L. (2022). An Adaptive and Efficient Network Traffic Measurement Method Based on SDN in IoT. In Proceedings of the International Conference on Simulation Tools and Techniques, Istanbul, Türkiye, 20 21 October 2022, Springer: Cham, Switzerland, 64 74.
https://doi.org/10.1007/978-3-030-97124-3_6
[2] Calavera, D., & Fontana, L. (2020). Linux Observability with BPF. 1005 Gravenstein Highway North, Sebastor, CA 96472: O'Relly Media, Inc.
[3] Cilium. (2022). Cilium documentation on BPF. Retrieved from: https://docs.cilium.io/en/stable/bpf/
[4] Gonçalves, E. M. N., Machado, R. A., Rodrigues, B. C., & Adamatti, D. (2022). CPN4M: Testing Multi-Agent Systems under Organizational Model Moise+ Using Colored Petri Nets. Appl. Sci., 12, 5857.
https://doi.org/10.3390/app12125857
[5] Haverbeke, M. (2018). Eloquent JavaScript, 3rd edition, No Starch Press. Retrieved from: https://eloquentjavascript.net/
[6] Horodetska, O. S., Hykavy, V. A., & Onyshchuk, O. V. (Ed). (2017). Computer networks. Vinnytsia: VNTU Publishing House. [In Ukrainian].
[7] Java, G. P. (2002). IPTraf User's Manual. Retrieved from: iptraf.seul.org/2.6/manual.html
[8] Kim, I., & Xu, S. (2019). Bus voltage control and optimization strategies for power flow analyses using Petri net approach. Int. J. Electr. Power Energy Syst., 112, 353 361.
https://doi.org/10.1016/j.ijepes.2019.05.009
[9] Kostyuchenko, A. O. (2020). Basics of Python programming. Chernihiv: FOP Balykin S. M. [In Ukrainian].
[10] Mo, L., Lv, G., & Wang, B. (2022). A Fine-Grained Network Congestion Detection Based on Flow Watermarking. Appl. Sci., 12, 8094.
https://doi.org/10.3390/app12168094
[11] Nayak, P., & Knightly, E. W. (2022). Virtual speed test: An ap tool for passive analysis of wireless lans. Comput. Commun, 192, 185 196.
https://doi.org/10.1016/j.comcom.2022.05.031
[12] NetLog. (2022). Official site. Retrieved from: https://netlog.sourceforge.net/
[13] OpenSSH. (2022). Official site. Retrieved from: www.openssh.com
[14] Prototype Kernel. (2022). Kernel documentation for eBPF maps. Retrieved from: https://prototype-kernel.readthedocs.io/en/latest/bpf/ebpf_maps.html
[15] Roland-riegel. (2018). Nload. Official site. Retrieved from: www.roland-riegel.de/nload/
[16] Shpak, Z. Ya. (2011). Programming in the language of S. Lviv: Publishing House of Lviv Polytechnic. [In Ukrainian].
[17] Silver Moon. (2020). 18 Commands to Monitor Network Bandwidth on Linux server. Retrieved from: https://www.binarytides.com/linux-commands-monitor-network/
[18] Tcpdump & libpcap. (2022). Official site. Retrieved from: www.tcpdump.org
[19] Teslyuk, T. V. (2018). The analysis of the dynamics of the functioning of multilevel systems using models based on hierarchical petri networks. Scientific Bulletin of UNFU, 28(8), 149-154.
https://doi.org/10.15421/40280830
[20] Trofymenko, O. G., Prokop, Y. V., Shvaiko, I. G., Bukata, L. M., Kosyreva, L. A., Leonov, Y. G., & Yasinsky, V. V. (2010). C++. Fundamentals of programming. Theory and practice. Odesa: "Fenix" Publishing House. [In Ukrainian].
[21] Wang, Y., Yin, X., Yin, X., Qiao, J., & Tan, L. (2022). A Petri Net-Based Power Supply Recovery Strategy for the Electric Power System of Floating Nuclear Power Plant. Appl. Sci., 12, 9026.
https://doi.org/10.3390/app12189026
[22] Wilson, M. (2021). 11 Best Network Monitoring Tools Software of 2021. Retrieved from: https://www.pcwdld.com/best-network-monitoring-tools-and-software