Smart network traffic monitoring system

Abstract

The rapid Internet development has eventually increased the network traffic as well. Therefore, the IP-based network traffic measurement has attracted network administrators and organizations for commercial, social and technical purposes. The need for traffic measurement is to understand the network itself in terms of the reliability and performance. Thus, Network Analyzer (NA) is developed to be able to analyze network traffic. Developments in embedded system technologies making it possible to design new low operational-cost but highly flexible NA systems. The core of the developed system is an embedded hardware running a scaled-down version of Linux Operating System (OS), a popular choice of operating system for embedded applications. This research proposed a new design and development of a Smart Network Traffic Monitoring (SNetMon) system based on single board computer (SBC) and using open source embedded GNU/Linux OS. The system is capable of capturing network packet, analyze and display data. The system is a portable device for network administrator to analyze network traffic. The main hardware components of SNetMon system are TS-7800 SBC, LCD panel and SD card. SNetMon software system is also a portable software which able to run on large variety of device platform. It is composed of three modules; Capturing Packet Module (CPM), System Control Module (SCM) and View Module (VM). CPM is developed using C language to capture, extract, analyze and store data. SCM is developed using PHP language to control CPM, query selected data and save into JavaScript Object Notation (JSON) format. VM is developed using Hyper Text Markup Language (HTML), Cascading Style Sheet (CSS) and JavaScript language. It will be loaded and processed from the client side by web-browser, analyze the data and to plot graphs. SNetMon system performance is compared between PC and Wireshark, a well known de facto standard network analyzer. Result depicted show data capture rates of SNetMon is very much identical with wireshark (less than 0.1%) during execution. The performances of two difference GNU/Linux kernels, 2.6.21 and 2.6.34, are reported. Results indicate that the new kernel has better performance, more bandwidth and low latency. The results prove that SNetMon on SBC system design and implementation is highly competitive even though it has low processing power and memory.