局域網(wǎng)邊界安全防御綜合設計研究.pdf

1、重慶郵電大學碩士學位論文局域網(wǎng)邊界安全防御綜合設計研究姓名：初振林申請學位級別：碩士專業(yè)：通信與信息系統(tǒng)指導教師：杜江20080524重慶郵電大學碩士論文摘要AbstractAlargelocalaleanetworkisoftendividedintosmallsubnetsformanagementandsecurityButitisnotacceptablebyalldepartmentstodeployallexclusivef

2、irewallbeforeeverysubnetAcommonlowcostcomputersupplyingprotectionforsmalllocalareanetworkscouldbeabetterchoiceLinuxisaflexibleoperatingsystemforallkindsofapplicatioI塔Deployingfirewall，IDSandIPSaccordingtoitspositioninthe

3、networkisquiteeasyBridgeworkingonthedatalinklayerCanservicetheupperapplicationsforcomplexfunctionsbesidesconnectingtwonetworksandforwardframesThethesisdesignsasystemforLANsecuritybasedontheiptablesfirewallandsnort—inline

4、IPSwhicharerunningontheLinuxbridgeandactingwithotherThissystemrunsonacommoncompmerwimtwoadaptivecards，eapturesthepacketsthroughfiltersthem，andthenforwardsthemItistransparenttootherdevicesorotherpeopleItdoesnotchangethene

5、tworktopologyBecauseofnoIPaddress，itisn’tdetectedeasilyIthelpsisolatethebadpacketsfromtheprotectedLANmeanwhilemakesitselfstableandsecureThissystemhassoftwareforguardofsnort—inlineMakingtheguardsoftwarehiddencanprotectitf

6、rombeingfoundandkilledSnort——inlineisarelativelymatureIPSwithexcellentfunctionsandperformanceinopensourcefieldStream4forstatemaintainingandsessionreassemblingisoneofthemostimportantpreprocessorsofsnort_inlinebutitdown’ts

7、upportTCPwindowscaleoptionquitewellThisthesisrevealsitsflawandprovidesaresolveforitThesolutionhasbeentestedfeasibleandworkswellinTCPconnectionswithwindowscaleoptionThisthesisdisplaystheprinciple，theprocedureandatlastthet

8、estofthewholesystemRulesofiptablesandsnort_inline，performanceofthesystemaretestedinnetworkunderV]V[wareinordertosaveresearchexpenseProtectionfunctionofthesystemdesignedbythisthesisdependsoncorrectandefficientrulesSothist