Design and Implementation of LAN-Sensitive Information Interception and Analysis System

Abstract:

The LAN usually hides internal network structure by NAT to share a public IP address in the internal network, and thus it is hard to locate the source host precisely distributing sensitive information for a large-scale information monitoring system by analyzing the intercepted packets. So it is hard to fulfill monitoring work efficiently. This paper puts forward a scheme to intercept and analyze the sensitive information in the LAN environment. It studies the ARP spoofing principle and the sniffer technology based on WINPCAP. The scheme includes 7 modules named NIC capture module, packet filtering module and so on. And it achieves sensitive information filtering and matching by the configured rules, such as "keywords", "URL", "QQ number" and so on. The scheme provides a solution for tracking the source host leaking sensitive information within the LAN.

• Periodical: Applied Mechanics and Materials (Volumes 347-350)
• Pages: 2881-2884
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.347-350.2881
• Online since: August 2013
• Authors: Shao Feng Lin, Wei Feng Sun, Lin Na Fan, Hua Wang
• Keywords: ARP Spoof, Network Security Monitor, Protocol Analysis, TCP/IP, Winpcap

References

[1] W, Richard Stevens. TCP/IP detailed description[M], Beijing Machine Press, 2000, 124-128.

[2] The WinPcap Team, The Chinese version of the WinPcap 4. 0. 1 manual, http: /www. coffeecat. net. cn/WinPcap/html/index. html, 2008. 03.

[3] R Fielding, RFC2616, Hypertext Transfer Protocol-HTTP/1. 1, 1999. 06.

[4] Douglas E. Comer. Internet Working with TCP/IP Vol I(4thed)[M], Prentice Hall, (2004).

[5] ARP spoofing, http: /en. wikipedia. org/wiki/Arp_spoofing.

[6] WinPcap documentation, http: /www. winpcap. org/docs/default. htm.