The Research of Address Message of an Unknown Single Protocol Data Frame

摘要

Network protocols are sets of standards for certain network communications. The identification and analysis of network protocol are of significance to network management and security. There are various technologies of protocol identification, but in the process of identification protocols, in order to simplify the identification process and improve the efficiency of protocol identification, unknown mixed multi-protocol needs to be separated into single protocol so as to make further identification. This paper presents an efficient method to determine the single protocol address message based on the previous research of separating unknown mixed data frame into single protocol. By this way, the data frames of single protocol are split into point-to-point data frame according to the address; consequently, the final identification of unknown protocol can be realized. Moreover, the method was evaluated by analysis of the ARP and TCP data; this method is able to find the more than 2/3 of address information.