In the network security monitoring system, it is important to trace information source timely and accurately, which is an important way to investigate and collect evidence. But because of public network’s IP limited resources, LAN hosts usually share the public network’s IP resources by NAT way, and conceal internal network structure, which make the network security monitoring system unable to locate the real effective sensitive information source in LAN. Based on the study of WINPCAP network sniffing technology and the ARP deception protocol in exchange network environment, a network security monitoring system with mechanical properties suitable for LAN environment is designed and realized, which locate information source accurately through filtering and matching the sensitive information transmitting in LAN by setting the capture factors as key words of document, web site shared by FTP, QQ number etc.
Network Security Monitoring System on Snort with Bot Telegram as a Notification
