Application of Network Protocol Analysis Software

The network structure is complex and changeable. All kinds of network protocols are difficult to grasp, let alone applications. Here we can use the network protocol analysis software for management. Some people often ask why I can only see my own communication? Why can't I see the Communication Status of XX? Is it software limitations? In fact, this kind of problem is not the limitation of the software, but caused by improper installation and deployment of the software. We know that the network protocol analysis software works in sniffing mode. It must collect raw data packets in the network to accurately analyze network faults. However, if the installation location is incorrect, the collected data packets will be significantly different, which will affect the analysis results and cause the above problems. In view of this situation, I think it is necessary to introduce the installation and deployment of the network protocol analysis software, but since there is not much time, I will briefly introduce it below.

Generally, the installation and deployment of the network protocol analysis software are as follows:

Shared Network

The network that uses the Hub as the network switch device is a shared network. The Hub works in the OSI Layer in the shared mode. If your lan's central switch device is a Hub, you can install the network protocol analysis software on any host in the LAN. In this case, the software can capture all the data communication in the network, the installation diagram is as follows.

Swap network with image Function

The network that uses a Switch as the center Switch of the network is a switched network. A Switch works on the data link layer of the OSI model. Its ports can effectively separate conflicting domains. The network connected by the Switch will separate the entire network into many small domains.

If the vswitch in your network has the image function, you can configure the port image on the vswitch, and then install the network protocol analysis software on the host that connects the Image Port, in this case, the software can capture all the data communication in the network. The installation diagram is as follows.

Swap network with no image Function

Some simple vswitches may not have the image function and cannot monitor and analyze the network through port images. In this case, you can concatenate a shard (Tap) or Hub (Hub) between the vswitch and the router (or firewall) to complete data capture. The installation diagram is as follows.

Analyze a department or CIDR block at a specified point

In actual situations, the network topology is often very complex. During network analysis, we do not need to analyze the entire network, but only need to analyze some departments or network segments with abnormal work. In this case, you can install the network protocol analysis software on a mobile computer, and then attach a shard (Tap) or Hub (Hub ), you can easily capture data from any department or network segment. The installation diagram is as follows.

Proxy Server Internet sharing

A large part of the current small network may still share the Internet with the proxy server. For this network analysis, you can directly install the network analysis software on the proxy server, the installation diagram is as follows.

Note: In this case, you need to capture data from both the internal and external NICs of the proxy server.