KR20010073968A - Method for analysing and simulating protocol of local area network for education - Google Patents

Abstract

PURPOSE: A method for analyzing the LAN protocol is provided to improve the understanding about the TCP/IP(Transport Control Protocol/Internet Protocol) of LAN by enabling a user to easily perform the monitoring for the TCP/IP suite of LAN, adding the firewall function, and performing the simulation according to the user's definition, and to offer the recorded media which can read the program in the computer. CONSTITUTION: The LAN protocol obtained by LAN card is outputted(20). According to a selection of a function by the user(21), the LAN protocol is monitored by the LAN card. A packet is created and the simulation is performed according to the type of MAC(Medium Access Control) address, which the user selects(23). The performance result is outputted(24).

Description

METHOOD FOR ANALYSING AND SIMULATING PROTOCOL OF LOCAL AREA NETWORK FOR EDUCATION}

The present invention relates to the analysis and simulation of a local area network (LAN) protocol. In particular, the present invention provides an analysis and a user-defined simulation function of a local area network protocol in a computer equipped with a LAN card. The present invention relates to a method for analyzing and teaching simulation, and a computer-readable recording medium recording a program for realizing the method.

In general, as a method for analyzing a protocol operating in a local area network, monitoring software is used, and the monitoring software is configured as a computer-based (PC-based) operating on a Windows-based computer equipped with an Ethernet LAN card, It consists of stand-alone devices.

In addition, only the function of displaying the contents of the monitoring of the TCP / IP protocol suite of the local area network so as to be easily understood by the user in the window environment is performed, and the simulation function is not performed.

The conventional LAN protocol analysis method as described above allows the user to select a menu through a graphical user interface (GUI) environment, and when the monitoring function is selected, the medium access control (MAC) protocol from the LAN card starts. Read. Monitoring is performed by dividing Ethernet into IEEE802.3 which performs the case of Ethernet and Logical Link Control (LLC).

If the protocol type is Ethernet, there is an Internet protocol (IP) as a network layer. The transport layer, which is the upper layer of the network layer, is transport control protocol (TCP), user datagram protocol (UDP), interior gateway protocol (IGP), interior gateway protocol (EGP), routing information protocol (RIP), and open shortest path first (OSPF). Protocols such as HyperText Transfer Protocol (HTTP), File Transfer Protocol (FTP), TELNET, RLOGIN, Simple Mail Transfer Protocol (SMTP), and Domain Name Service (DNS). ), Such as TFTP (Trival File Transfer Protocol). In addition, upper layers of the UDP protocol of the transport layer include SNMP (Small Network Management Protocol) and DNS (Domain Name Service) protocols.

As a display form of information on various protocols such as hexadecimal (HEXA), a method of outputting the protocol parameters in summary form and a combination of hexadecimal (HEXA) and summary form of any protocol There is a method of detailed printing in the form of mapping of parameters and hexa (HEXA) values.

However, the conventional LAN protocol analysis method as described above has a limitation in broadening the understanding of the protocol because the user only designs the protocol through programming and performs the monitoring function without checking the result. There is a problem that the value is expensive.

Accordingly, the present invention has been made to solve the above problems, the user can easily monitor the TCP / IP protocol suite of the local area network, add a firewall function, and perform the simulation according to the user definition The purpose of the present invention is to provide a method of analyzing and simulating a local area network protocol and a computer-readable recording medium that records a program for realizing the method.

1 is a configuration diagram of an apparatus for analyzing and simulating a local area network protocol to which the present invention is applied.

Figure 2 is an embodiment processing flow diagram for a local area network protocol analysis and educational simulation method according to the present invention.

FIG. 3 is a detailed flowchart of one embodiment of a subroutine for performing protocol display in FIG. 2.

4A-4D are detailed flowcharts of one embodiment of a subroutine for performing monitoring in FIG.

FIG. 5 is a detailed flowchart of one embodiment of a subroutine for performing a simulation in FIG.

FIG. 6 is a detailed flowchart of one embodiment of a subroutine for forming user data / TCP / IP / Ethernet transmission data in FIG.

7 is a detailed flowchart of one embodiment of a subroutine for forming the Ethernet header in FIG.

8A and 8B are detailed flowcharts of one embodiment of a subroutine for forming an IP header in FIG. 6;

9A and 9B are detailed flowcharts of one embodiment of a subroutine for forming a TCP header in FIG.

10A and 10B are detailed flowcharts of an embodiment of a subroutine for selecting a simulation function in FIG. 5.

FIG. 11 is a detailed flowchart of an embodiment for performing user data / logical connection control / 802.3 transmission data formation in FIG. 5; FIG.

12A and 12B are detailed flowcharts of one embodiment for forming an 802.3 packet in FIG.

FIG. 13 is a detailed flowchart of an embodiment for forming a UDP / IP / Ethernet series packet in FIG.

14 is a detailed flowchart of an embodiment for forming an ICMP / IP / Ethernet series packet in FIG.

FIG. 15 is a detailed flowchart of an embodiment for forming an EGP / IP / Ethernet series packet in FIG. 11;

FIG. 16 is a detailed flowchart of an embodiment for forming a RIP / IP / Ethernet series packet in FIG.

FIG. 17 is a detailed flowchart of an embodiment for forming an OSFP / IP / Ethernet series packet in FIG. 11; FIG.

FIG. 18 is a detailed flowchart of an embodiment for forming an IGMP / IP / Ethernet series packet in FIG.

FIG. 19 is a detailed flowchart of an embodiment of a subroutine for displaying a result of performing FIG. 2; FIG.

20 is a detailed flowchart of one embodiment of a subroutine for editing a packet in FIG.

21 is a detailed flowchart of an embodiment of a subroutine for performing a firewall function in FIG.

FIG. 22 is a detailed flowchart illustrating one embodiment of a subroutine for performing an educational function in FIG. 2; FIG.

23A and 23B are detailed flowcharts of one embodiment for performing an educational simulation in FIG. 22.

* Explanation of symbols for the main parts of the drawings

10: Local area network (LAN) 11: LAN card

12: central processing unit 13: main memory device

According to an aspect of the present invention, there is provided a local area network protocol analysis and education simulation method performed by a computer equipped with a local area network card, the method comprising: a first step of outputting a local area network protocol obtained through the local area network card; A second step of monitoring a local area network protocol using the LAN card according to a function selection of a user; A third step of generating a packet according to a type of a medium access control (MAC) address selected by a user and performing simulation; And a fourth step of outputting a result of performing the second and third steps.

The present invention also provides a LAN card-equipped computer having a microprocessor, comprising: a first function of outputting a local area network protocol obtained through the LAN card; A second function of monitoring a local area network protocol using the LAN card according to a function selection of a user; A third function of generating a packet according to a type of a medium access control (MAC) address selected by a user and performing simulation; And a computer-readable recording medium having recorded thereon a program for realizing a fourth function for outputting the result of performing the second function and the third function.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an apparatus for analyzing and simulating a local area network protocol to which the present invention is applied.

As shown in the figure, an apparatus for analyzing and simulating a local area network protocol to which the present invention is applied includes a local area network 10 and a packet transmitted by various protocols to the local area network 10 and formed by a user. A LAN card 11 for transmitting a packet, a central processing unit 12 for controlling and managing the overall operation, and a program stored in the central processing unit 12 and used during or during operation. It includes a main memory device 13 for storing various kinds of data.

However, the computer hardware environment having the configuration as described above is only a technique well known in the art, so a detailed description thereof will be given here.

Now, the process of performing the local area network protocol analysis and simulation in the main memory device 13 will be described in more detail.

2 is a flowchart illustrating an exemplary embodiment of a LAN protocol analysis and education simulation method according to the present invention.

First, the protocol obtained from the local area network 10 is displayed (20), and the function analysis function is selected (21).

According to the selection result 21, the monitoring function 22 or the simulation 23 is performed, the monitoring or simulation execution result is displayed 24, and the corresponding packet is transitioned 25.

According to the selection result 21, the firewall function 26 or the educational function 27 is performed.

3 is a detailed flowchart of an exemplary embodiment of the subroutine displaying the protocol in FIG. 2, wherein the LAN card 11 transfers traffic from the local area network 10 to the memory 100 and the traffic to the main memory 101. After transmission (101), the traffic, ie, protocol information, of the local area network (10) is displayed (103, 104 or 105) according to the selection of the output form.

4A to 4D are detailed flowcharts of one embodiment of a subroutine for performing monitoring in FIG. 2.

First, the Ethernet / 802.3 transmission / reception addresses of the traffic received from the LAN card 11 are arranged (100), and it is determined whether the type of the Ethernet protocol is IP (107).

In the determination result 107, if the type of the Ethernet protocol is IP, the IP protocol header is arranged (108). If the type of the Ethernet protocol is not IP, it is determined whether the type of the protocol is 802.3 (109).

In the determination result 109, if the type of the Ethernet protocol is 802.3, the logical connection control protocol header and association are arranged (110), and if the type of the Ethernet protocol is not 802.3, the type of the protocol is ARP (Address). Resolution Protocol) (111).

As a result of the determination 111, if the type of the Ethernet protocol is ARP, the ARP protocol header is arranged (112), and if the type of the Ethernet protocol is not ARP, the header is regarded as another protocol and the header is arranged (113). Is returned.

After performing the IP protocol header cleanup process 108, it is determined whether the type of the IP protocol is TCP (114).

As a result of the determination, if the type of the IP protocol is TCP, the TCP protocol header is arranged (115). If the type of the IP protocol is not TCP, it is determined whether the type of the protocol is UDP (116).

If the determination result 116, if the type of the IP protocol is UDP, UDP protocol hash is summarized (117), and if the type of the IP protocol is not UDP, the type of the protocol is ICMP (Internet Control Message Protocol). (118).

In the determination result 118, if the type of the IP protocol is ICMP, the ICMP protocol header is arranged (119), and if the type of the IP protocol is not ICMP, the type of the protocol is IGP (Interior Gateway Protocol). The authorization is determined (120).

If the determination result 120, if the type of the IP protocol is IGP, the IGP protocol hash is summarized (121), and if the type of the IP protocol is not IGP, the type of the corresponding protocol is EGP (Exterior Gateway Protocol). The authorization is determined (139). (See FIG. 4D.)

If the determination result 139, if the type of the IP protocol is EGP, the EGP protocol hash is summarized (140), and if the type of the IP protocol is not EGP, the type of the protocol is RIP (Routing Information Protocol). The authorization is determined (141).

If the determination result 141, if the type of the IP protocol is RIP, the RIP protocol hash is summarized (142), and if the type of the IP protocol is not RIP, the type of the protocol is OSPF (Open Shortest Path First). (143).

If the determination result 143, if the type of the IP protocol is OSPF, the OSPF protocol header is cleaned up (144), and if the type of the IP protocol is not OSPF, it is outputted in another form (145), and then returned. do.

After performing the TCP protocol header cleanup process 115, it is determined whether a reception port of the corresponding TCP protocol is a known port (122).

As a result of the determination 122, if it is not a known port, user data is cleaned up (123), and if the receiving port is a known port, it is determined whether the receiving port is HTTP (HyperText Transfer Protocol) (124). 4b)

If the receiving result is 124, if the receiving port is HTTP, the HTTP protocol header is cleaned up (125), and if the receiving port is not HTTP, it is determined whether the corresponding receiving port is TELNET (126).

As a result of the determination 126, if the receiving port is TELNET, the TELNET protocol header is cleaned up (127), and if the receiving port is not TELNET, it is determined whether the corresponding receiving port is FTP (File Transfer Protocol) (128). .

As a result of the determination 128, if the receiving port is FTP, the FTP protocol header is cleaned up (129), and if the receiving port is not FTP, it is determined whether the corresponding receiving port is TFTP (Trial File Transfer Protocol) (130). ).

As a result of the determination 130, if the receiving port is TFTP, the TFTP protocol header is arranged (131), and if the receiving port is not TFTP, it is determined whether the corresponding receiving port is DNS (Domain Name Service) (132). .

As a result of the determination 132, if the receiving port is DNS, the DNS protocol header is cleaned up (133), and if the receiving port is not DNS, it is determined whether the corresponding receiving port is RLOGIN (134).

In the determination result 134, if the reception port is RLOGIN, the RLOGIN protocol header is cleaned up (135), and if the reception port is not RLOGIN, it is determined whether the corresponding reception port is the Simple Network Management Protocol (SNMP) (136). ).

As a result of the determination 136, if the receiving port is SNMP, the SNMP protocol header is cleaned up (137), and if the receiving port is not SNMP, the user data is cleaned up (138).

FIG. 5 is a detailed flowchart illustrating an example of a subroutine for performing a simulation in FIG. 2. When the type of a packet to be simulated is selected (30), if the selected packet is a user data / TCP / IP / Ethernet. Form the user data / TCP / IP / Ethernet transmission data (31), select the simulation function (32), and return, and if the selected facet type is user data / logical connection control / 802.3, then the user data / logical association After the session / 802.3 transmission data is formed (33), it is returned.

6 is a detailed flowchart of an embodiment of a subroutine for forming user data / TCP / IP / Ethernet transmission data in FIG. 5.

First, it is selected whether to directly enter the Ethernet header (200).

As a result of the selection (200), if an Ethernet header direct input is selected, an Ethernet header is formed (201), whether to input an IP header is selected (202), and if an Ethernet header direct input is not selected, a default Ethernet header is selected. Form (203).

When the selection result 202 selects an IP header input, an IP header is formed (204), a TCP header is selected (205). If an IP header input is not selected, a default IP header is formed. (206).

As a result of the selection (205), if a TCP header input is selected, a TCP header is formed (207), whether to input user data is selected (208), and if a TCP header input is not selected, a default TCP header is formed. (209).

When the selection result 208 selects the user data input, the user data is input (210), and the memory of the hexa value is arranged (211).

If the selection result 208 does not select the user data input, the memory of the hexa value is arranged without entering user data (211).

7 is a detailed flowchart illustrating an embodiment of a subroutine for forming the Ethernet header in FIG. 6.

First, it is selected whether to input the counterpart Ethernet address (212).

As a result of the selection 212, when the other side of the Ethernet address input is selected, the other side of the Ethernet address is input (213), the protocol type is selected or not (214), if the other side of the Ethernet address input is not selected, the other side Ethernet address It is determined whether to process the ARP (215).

As a result of the determination (215), when the other side of the Ethernet address ARP is processed, the other side's IP header is formed (216), the other side's Ethernet address is formed (217), and if the other side's Ethernet address ARP is not processed, the other side's Ethernet address is processed by default. In operation 218, a process of selecting whether to input the protocol type is performed (214).

If the selection result 214, the protocol type input is selected, the protocol type is input (219), it is determined whether the Ethernet header is normal (220), if the protocol type input is not selected, the protocol type is defaulted ( In step 221, the process of determining whether the Ethernet header is normal 220 is performed.

As a result of the determination 220, if the Ethernet header is normal, it is returned. If not, it is performed again from the step 212 of selecting the counterpart Ethernet address input.

8A and 8B are detailed flowcharts of one embodiment of a subroutine for forming an IP header in FIG. 6.

First, it is selected whether to input the IP header in hexa (222).

As a result of the selection 222, if the input is hexa, the IP header is hexa inputted (224), and if the input is not hexa input, it is selected whether to input the counterpart IP address (223).

As a result of the selection (223), if the other party's IP address input is selected, the other party's IP address is input (225), and whether or not to input his own IP address (226). Default processing (227), and selects whether to input its own IP address (226).

As a result of the selection 226, if it is selected to input its own IP address, it inputs its own IP address (228), selects whether to enter a protocol type (229), and if it is not selected to enter its own IP address, The process defaults to the IP address 230 and selects whether to enter the protocol type 229.

If the selection result 229, the protocol type input selection, input the protocol type (231), select whether to enter the protocol version type (232), if not the protocol type entry selection, default processing of the protocol type In operation 233, a process of selecting whether to input the protocol version type is performed (232).

The selection result 232, if the protocol version type input selection, enter the protocol version type (234), select whether to enter the TTL (Time To Live) (235) (see Figure 8b), enter the protocol version type If not, the process of defaulting the protocol version type and selecting whether to input the TTL is performed (235).

If the selection result 235, TTL input selection, enter the TTL (237), select whether to enter the service type (238), if not TTL input selection, default processing of the TTL (239), the service A process of selecting whether to input a form is performed (238).

In the result of selection 238, if a service type input is selected, a service type is input (240), a flag or not is selected (241), and if a service type input is not selected, a service type is defaulted (242). In operation 241, a process of selecting whether to input the flag is performed.

In the result of the selection 241, if a flag input is selected, a flag is input (243), a flag offset selection is selected (244), and if not a flag input selection, a flag is processed (245). A process of selecting whether to input a fragment offset is performed (244).

If the selection result 244 is a fragment offset input selection, input a fragment offset (246), select whether to input an option (247), and if not a fragment offset input selection, default processing of a fragment offset (248). In operation 247, a process of selecting whether to input the option is performed.

The selection result 247, if the option input selection, input the option (249), the other elements are returned after the user has processed (250), if not the option input selection, default option processing (251) In operation 250, the user processes the other elements.

9A and 9B are detailed flowcharts of an embodiment of a subroutine for forming a TCP header in FIG. 6.

First, it is selected whether to enter a hexa value in the TCP header (251).

As a result of the selection (251), if the hex value input is selected in the TCP header, the hex value is input in the TCP header (253) and returned. If the hex value input is not selected in the TCP header, the counterpart TCP port is selected. (252).

As a result of the selection 252, if the other party's TCP port input is selected, the other party's TCP port is entered (254), or the user's TCP port is selected (255). Default processing (256), and selects whether to enter the own TCP port (255).

As a result of the selection (255), if the input of the TCP port is selected, the user inputs his TCP port (257), selects whether to enter a window (258), and if not input his TCP port, the TCP port of his own In operation 259, a process of selecting whether to input the window is performed.

The selection result 258, if the window input selection, inputs the window (260), selects whether or not to input the sequence number (261), if not the window input selection processing the window (262), the A process 261 of selecting whether to input the sequence number is performed.

The selection result 261, if the sequence number input selection, inputs the sequence number (263), selects whether to enter the response number (264) (see Fig. 9b), if not the sequence number input selection, the sequence number In step 265, a process of selecting whether to input the response number is performed (265).

In response to the selection result 264, if a response number input selection is selected, input a response number (266), select whether to input a control field (267), and if not a response number input selection, process a response number by default (268). In step 267, the control field is selected.

If the result of the selection (267), the control field input selection, enter the control field (269), select whether or not to enter the emergency pointer (270), if not the control field input selection, and defaults to the control field (271) In step 270, a process of selecting whether to input the emergency pointer is performed.

If the selection result 270 is an emergency pointer input selection, input an emergency pointer (272), select whether to input an option (273), and if it is not an emergency pointer input selection, process an emergency pointer by default (274). In operation 273, a process of selecting whether to input the option is performed.

If the selection result 273 is an option input selection, the option is entered (275), the other elements are processed by the user (276), and if not an option input selection, the option is defaulted (277), and the other elements are A user process 276 is performed.

10A and 10B are detailed flowcharts of one embodiment of a subroutine for selecting a simulation function in FIG. 5.

First, it is selected whether to transmit only the formed TCP packet (278).

As a result of the selection 278, if the formed TCP packet transmission is selected, only the formed TCP packet is transmitted (279), and if it is not the selected TCP packet transmission selection, it is selected whether to perform only the TCP connection function (280).

In the selection result 280, if the TCP connection function is performed, the TCP connection request packet is transmitted to the other party (281), and when the TCP connection response and connection request packet are received from the other party (282), the TCP connection response packet is sent to the other party. After transmission (283), it is returned. If it is not the TCP connection function execution selection, it selects whether to perform only the TCP release function (284).

If the selection result 284 is selected to perform the TCP release function, it is determined whether the TCP connection is completed (285).

As a result of the determination (285), if the TCP connection is completed, the TCP release request packet is transmitted to the other party (286), after receiving a response to the TCP release request from the other party (287), and receiving the TCP release request packet from the other party. If it is 288, it transmits a response to the TCP release request pass to the counterpart, performs TCP release, and then returns.

As a result of the determination 285, if the TCP connection is not completed, a TCP connection is requested to the other party (290) and returned.

If the selection result 284 does not indicate that the TCP release function is to be performed, it is selected whether to repeatedly perform the TCP connection and release function (291).

As a result of the selection 291, if the TCP connection and disconnection function is repeatedly selected, the TCP connection request packet is transmitted to the other party (292), and after receiving the TCP connection response and connection request packet from the other party (293), the TCP is sent to the other party. The connection response packet is transmitted (294).

When the TCP release request packet is transmitted to the other party (295), the response to the TCP release request is received from the other party (296), and the TCP release request packet is received from the other party (297), the TCP release request packet is sent to the other party. After sending a response to the request (298), it is determined whether a session stop command has been received (299).

As a result of the determination 299, if the operation stop command is not received from the user, a process 292 of transmitting a TCP connection request packet to the counterpart is performed, and if the operation stop command is received from the user, it is returned.

As a result of the selection 291, if the TCP connection and disconnection function is not repeatedly selected, whether to perform the TCP transaction generation function is selected (300).

If the selection result 300 indicates that the TCP traffic generation function is not selected, it is returned. If the TCP traffic generation function is selected, the TCP connection request packet is transmitted to the other party (301), and the TCP connection response and connection request packet are received from the other party. After that (302), the TCP transmission packet is transmitted to the other party (303), the user data is inserted into the TCP packet (304), and after the other party's TCP data is transmitted (305), a stop command is received from the user. Determine (306).

In response to the determination result 306, when the operation stop command is received from the user, it is returned. If the operation stop command is not received from the user, a process 301 of transmitting a TCP connection request packet to the counterpart is performed.

FIG. 11 is a detailed flowchart illustrating an embodiment for forming user data / logical connection control / 802.3 transmission data in FIG.

First, an 802.3 packet is formed (307), and a packet forming operation is selected (330).

According to the selection result 330 to form a UDP / IP / Ethernet series packet (340), to form an ICMP / IP / Ethernet series packet (360), to form an EGP / IP / Ethernet series packet (380), A RIP / IP / Ethernet series packet is formed (400), an OSPF / IP / Ethernet series packet is formed (420), or an IGMP / IP / Ethernet series packet is formed (440).

12A and 12B are detailed flowcharts of an embodiment for forming an 802.3 packet in FIG. 11.

First, it is selected whether to input the partner 802.3 address (308).

As a result of the selection 308, if the other side's 802.3 address input is selected, the other side's 802.3 address is inputted and the DSAP (Destination Service Access Point) is selected (310). It is selected whether to perform ARP processing (311).

If the result of selection 311, the partner 802.3 address ARP processing is selected, a partner IP header is generated, a partner Ethernet address is formed, and a process of selecting whether to input the DSAP is performed (310). If it is not the ARP process selection, a process 310 of defaulting ARP and selecting whether to input the DSAP is performed. Since the process of generating the counterpart IP header 312 is the same as described with reference to FIGS. 8A and 8B, a detailed description thereof will be omitted, and the process of forming the counterpart Ethernet address 313 is described with reference to FIG. Since it is the same as described in 6, the detailed description thereof will be omitted.

As a result of the selection 310, if the DSAP input is selected, the DSAP type is input (315), and whether to input the SSAP (Source Service Access Point) is selected (316). If not, the DSAP type is processed by default. In operation 317, a process of selecting whether to input the SSAP is performed (316).

If the selection result 316, SSAP input selection, input SSAP type (318), select whether to input the control field type (320) (see Fig. 12b), if not SSAP input selection, default SSAP type In operation 319, a process 320 for selecting whether to input the control field type is performed.

When the selection result 320 selects a control field type input, inputs a control field type (321), selects whether to input logical connection control protocol data unit (PDU) user data (322), and inputs a control field type. If not, the control field type is processed by default (323), and the process of selecting whether to input the logical connection control PDU user data (322) is performed.

If the selection result 322, the logical connection control PDU user data input selection, input the logical connection control PDU user data (324), calculate the logical connection control PDU data length (325), input the logical connection control PDU user data If not selected, a default processing of the logical connection control PDU user data (326), a process of calculating the logical connection control PDU data length 325 is performed, and then returned.

FIG. 13 is a detailed flowchart illustrating an embodiment of forming a UDP / IP / Ethernet series packet in FIG. 11.

First, it is selected whether to enter a hexa value in the UDP header (341).

As a result of the selection 341, if the hex value is input to the UDP header, the hex value is input to the UDP header (342), and if it is not the hex value input selection to the UDP header, the opposing UDP port is selected. (343).

As a result of the selection (343), if the opposing UDP port input is selected, the opposing UDP port is input (344), it is selected whether to input its own UDP port (345), and if the opposing UDP port input is not selected, the opposing UDP port is selected. The default processing is performed, and a process of selecting whether to input the own UDP port is performed (345).

As a result of the selection (345), if the user's UDP port input selection, enter his UDP port (347), if the user adds other elements (348), if not his UDP port input selection, his UDP port Default processing (349), and the user adds the other elements (348).

After the user adds the other elements (348), the user selects whether to input user data (350).

If the selection result 350, the user data input selection, input the user data (351), after generating the UDP / IP / Ethernet-based packet, after cleaning the memory of the hexa value (352), it is returned, select the user data input Otherwise, after generating the UDP / IP / Ethernet series packet, the process of arranging the memory of the hexa value is performed (352).

14 is a detailed flowchart illustrating an embodiment of forming an ICMP / IP / Ethernet series packet in FIG. 11.

First, it is selected whether to enter a hexa value in the ICMP header (361).

As a result of the selection 361, if the hexa value input is selected in the ICMP header, the hexa value is input in the ICMP header (362), and returned. If the hexa value is not selected in the ICMP header, the TYPE is selected. (363).

If the result of the selection 363 is a TYPE input selection, a TYPE is input (364), a code input is selected (365), and if a TYPE input is not selected, a TYPE is processed by default (366) and the code input is performed. A process 365 of selecting whether or not to perform is performed.

If the selection result 365 is a code input selection, the code is input (367), the other elements are added by the user (368), if not the code input selection, the code defaults to processing (369), and the other elements The user adds process 368.

After performing step 368, after forming the ICMP / IP / Ethernet series packet, the memory of the hexa value is cleaned up (370) and returned.

FIG. 15 is a detailed flowchart illustrating an embodiment for forming an EGP / IP / Ethernet series packet in FIG. 11.

First, it is selected whether to input a hexa value in the EGP header (381).

As a result of the selection 381, if the hex value is input to the EGP header, the hex value is input to the EGP header (382), and if the hex value is input to the EGP header, the hexa value is selected. 383).

As a result of the selection (383), if the TYPE input is selected, input the TYPE (384), select whether to enter a version (385), if not the TYPE input selection, default processing of the TYPE (386), and the version A process 385 of selecting whether to input is performed.

If the selection result (385), if the version input selection, the version is entered (387), and whether to enter the code (388), if not the version input selection, defaults to the version (389), and the code A process 388 of selecting whether to input is performed.

If the selection result (388), if the code input selection, the code is input (390), the other elements are added by the user (391), if not the code input selection, the code defaults (392), and the other elements A user performs a process 391.

After performing step 391, after forming the EGP / IP / Ethernet series packet, the memory of the hexa value is cleaned up (393) and returned.

16 is a detailed flowchart illustrating an embodiment of forming a RIP / IP / Ethernet series packet in FIG. 11.

First, it is selected whether to enter a hexa value in the RIP header (401).

As a result of the selection (401), if the hex value is input to the RIP header, the hex value is input to the RIP header (403), and returned. If the hex value is not selected to the RIP header, the command is selected. (403).

The selection result 403, if command input selection, inputs a command (404), selects whether to enter a version (405), otherwise processes the command by default (406), and enters the version. The process of selecting whether or not to perform (405) is performed.

If the selection result 405, the version input selection, enter the version (407), the other elements are added by the user (408), if not the version input selection, defaults to the version (409), and the other elements The user performs the process of adding 408.

After performing step 408, after forming the RIP / IP / Ethernet series packet, the memory of the hexa value is cleaned up (410) and returned.

17 is a detailed flowchart illustrating an embodiment of forming an OSPF / IP / Ethernet series packet in FIG. 11.

First, it is selected whether or not to input a hexa value in the OSPF header (421).

As a result of the selection 421, if the hex value is input to the OSPF header, the hex value is input to the OSPF header (422), and returned. If the hex value is not selected to the OSPF header, the type is selected. (423).

If the selection result (423), if the TYPE input selection, input the TYPE (424), select whether to enter the version (425), if not the TYPE input selection, default processing of the TYPE (426), the version input A process 425 of selecting whether or not to be performed is performed.

The selection result 425, if the version input selection, enter the version (427), the other elements are added by the user (428), if not the version input selection, defaults to the version (429), and the other elements The user performs the process of adding 428.

After performing step 428, after forming the OSPF / IP / Ethernet series packet, the memory of the hexa value is cleaned up (430) and returned.

18 is a detailed flowchart illustrating an embodiment of forming an IGMP / IP / Ethernet series packet in FIG. 11.

First, it is selected whether to enter a hexa value in the IGMP header (441).

As a result of selection 441, if hex value input is selected in the IGMP header, after inputting the hexa value in the IGMP header (442), it is returned. If the hex value is not selected in the IGMP header, the TYPE is selected. (443).

In the result of selection 443, if a TYPE input is selected, a TYPE is input (444), a version input is selected (445), and if a TYPE input is not selected, a TYPE is processed by default (446), and the version input is performed. A process 445 of selecting whether or not to be performed is performed.

The selection result 445, if the version input selection, input the version (447), the other elements are added by the user (448), if not the version input selection, defaults to the version (449), and the other elements The user adds a process 448.

After the process 448, after forming the IGMP / IP / Ethernet series packet, the memory of the hexa value is cleaned (450), and returned.

19 is a detailed flowchart of an exemplary embodiment of a subroutine for displaying a result of execution in FIG. 2.

First, it is selected whether to display all the received information (500).

If the result of the selection 500 selects all received information displays, after displaying all received information (501), if the selected information display is not selected, only the same packet as the own IP address is displayed. Select (502).

As a result of the selection 502, if the display of the same packet as the own IP address is selected, only the same packet as the own IP address is displayed (503) and returned. It is selected whether to display only the same packet as (504).

In the result of the selection 504, if the display of the same packet as the other party's IP address is selected, only the same packet as the other party's IP address is displayed (505) and returned. Select whether to display only packets (506).

If the selection result 506 is the same packet display selection as its own TCP port, only the same packet as its own TCP port is displayed (507), and if it is not the same packet display selection as its own TCP port, the other side TCP port is selected. It is selected whether to display only the same packet as (508).

As a result of the selection 508, if the same packet display selection as the counterpart TCP port is selected, only the same packet as the counterpart TCP port is displayed (509), and if it is not the same packet display selection as the counterpart TCP port, it is returned immediately.

20 is a detailed flowchart of an embodiment of a subroutine for editing a packet in FIG. 2.

First, whether to input the frame number is selected (600), if the frame number input is selected, the frame number is outputted first (601), and if not the frame number input selection, a word word is input (602). .

In the result of the selection 602, if the word word input is selected, the corresponding word word is output from the input word (603). If the word word input is not selected, the user selects whether to use the page up / down function (604).

If the selection result 604 selects to use the page up / down function, the page up / down function is performed (605). If the page up / down function is not selected, other functions are performed (606). .

FIG. 21 is a detailed flowchart illustrating an embodiment of a subroutine for performing a firewall function in FIG. 2.

First, it is determined whether the transmission IP address, the IP address to be protected and the TCP port (700).

If the determination result 700, the transmission IP address and the IP address and TCP port to be protected, it is determined whether the IP address to be transmitted or protected (701), if the transmission IP address and the IP address and TCP port to be protected, noise information (703), and TCP release processing (706).

In the determination result 701, if the IP address to be transmitted or protected is determined, it is determined whether the upper layer of the IP address is TCP (702), and if it is not the IP address to be transmitted or protected, the transmission IP address and the IP address to be protected and UDP It is determined whether it is a port (704).

In the determination result 702, if the upper layer of the IP address is TCP, the process of transmitting the noise information is performed (703). If the upper layer of the IP address is not TCP, the noise information is transmitted (705). Is returned.

As a result of the determination 704, if the transmission IP address and the IP address and UDP port to be protected are transmitted, the noise information is transmitted (705), and returned if the transmission IP address and the IP address and UDP port to be protected are returned.

FIG. 22 is a detailed flowchart illustrating one embodiment of a subroutine for performing an educational function in FIG. 2.

First, it is determined whether the educational monitoring is performed (800).

If the determination result 800, the educational monitoring is performed, after capturing the traffic on the local area network and the firmware (firmware) function calls the application program with the parameters of the start address pointer and the information length of the memory packet (820), the display function If not (840), if not the educational monitoring is performed, the educational simulation is performed (960), and the compilation and display is performed (940).

According to the selection of the display function, a program for forming Ethernet / 802.3, an IP packet, a TCP packet, and an application layer packet is created (860 to 920), and compiled and displayed (940). Here, the process of preparing the program to form the Ethernet / 802.3, IP packet, TCP packet and application layer packet is the same as the monitoring process performed in Figures 4a to 4d will be omitted.

23A and 23B are detailed flowcharts of one embodiment for performing an educational simulation in FIG. 22.

First, it is selected whether to transmit only the formed TCP packet (961).

If the selection result 961, if the selected TCP packet transmission selection, write a program for forming a TCP packet (962), the application program calls a firmware function with parameters of the pointer and the information length (963), and the formed TCP Send a packet (964).

As a result of the selection 961, if the TCP packet transmission selection is not formed, it is selected whether to perform only a TCP connection function (965).

If the selection result 965 is a TCP connection function selection, a program for forming a TCP connection request packet is created (966), and an application program calls a firmware function with parameters of a pointer and an information length (967). The TCP connection request packet is transmitted (968).

Then, after receiving the TCP connection response and connection request packet from the other party (969), writing a program for forming the TCP connection response packet (970), the application program calls the firmware function with parameters of the pointer and the information length ( 971) and transmits the formed TCP connection response packet (972).

As a result of the selection (965), if the TCP connection function is not selected, it is selected whether to perform only the TCP release function (973).

If the selection result (973), if the TCP release function is selected, it is checked whether the TCP connection is completed (974), if the TCP connection is not completed, after performing the TCP connection functions (966 to 972) (975), In step 974, a process of checking whether the TCP connection is completed is performed, and when the TCP connection is completed, a program for forming a TCP release request packet is written (976), and the application program uses the pointer and the information length as parameters. Call the function (977), and transmit (978) the formed TCP release request packet.

In response to receiving the TCP release request packet from the other party (979) and receiving the TCP release request packet (980), a response packet forming program for the TCP release request packet is created (981), and the application program generates a pointer and A firmware function is called with the information length as a parameter (982), and a response packet for the formed TCP release request is transmitted (983).

As a result of the selection 933, if the TCP release function is not selected, it is selected whether to repeatedly perform the TCP connection and release function (984).

If the selection result (984), if the TCP connection and disconnection function is selected repeatedly, a TCP connection request packet forming program is created (985), and the application program calls a firmware function with parameters of the pointer and information length (986), The formed TCP connection request packet is transmitted (987).

Upon receiving the TCP connection response and connection request packet from the other party (988), a TCP connection response packet forming program is created (989), and the application program calls the firmware function with parameters of the pointer and the information length (990). After transmitting the formed TCP connection response packet (991), it is determined whether the stop command is stopped by the user (992), and if the user stop command is received, it is returned, and if it is not received, the TCP connection request packet The process of writing a program to form a method 985 is performed.

If the selection result 984 does not indicate that the TCP connection and disconnection function is repeatedly selected, it is selected whether to perform the TCP traffic generation function (993).

If the selection result (993), if not the TCP traffic generation function selection, is returned, and if the TCP traffic generation function selection, the TCP connection request packet forming program is created (994), the application program using the pointer and information length parameters as the firmware Call the function (995), and send the formed TCP connection request packet (996).

After receiving the TCP connection response and connection request packet from the other party (997), writing a TCP connection response packet forming program (998), and after the application program calls the firmware function with parameters of the pointer and the information length (999). In step 1000, the TCP connection response packet is transmitted.

Next, a TCP data packet forming program is created (1001), TCP user data is inserted (1002), and the application program calls a firmware function with a pointer and an information length parameter (1003), and then the formed TCP data After transmitting the packet (1004), it is determined whether a stop command has been received from the user (1005), and if a stop command is received, it is returned, and if the stop command has not been received, the TCP connection request packet forming program is created. Perform process 994.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those having ordinary skill in the art to which the present invention pertains. It is not limited to the drawing.

As described above, the present invention enables a user to directly generate a packet, to perform simulation of various functions, and to check protocol information obtained through a LAN card, thereby improving the understanding of the protocol and the design technique. It works.

Claims (24)

In the LAN protocol analysis and training simulation method performed on a computer equipped with a LAN card, Outputting a local area network protocol acquired through the LAN card; A second step of monitoring a local area network protocol using the LAN card according to a function selection of a user; A third step of generating a packet according to a type of a medium access control (MAC) address selected by a user and performing simulation; And A fourth step of outputting a result of performing the second and third steps LAN protocol analysis and educational simulation method comprising a. The method of claim 1, Local area network protocol analysis and training simulation method further comprising a fifth step of performing a firewall function according to the user's function selection. The method of claim 1, 6. The method of claim 2, further comprising a sixth step of performing an educational function according to the user's function selection. The method according to any one of claims 1 to 3, The first step is, A seventh step of the LAN card capturing traffic in a local area network and transmitting the traffic to the main memory; And LAN protocol analysis and educational simulation method comprising the eighth step of displaying the protocol information in hexa, summary or detailed form according to the user's choice of output format. The method according to any one of claims 1 to 3, The second step, A ninth step of arranging Ethernet / 802.3 transmission / reception addresses of the traffic received from the LAN card and arranging headers of the protocol according to the type of the Ethernet protocol; A tenth step of arranging a protocol header according to a type of a protocol in which the type of the Ethernet protocol is IP; An eleventh step of arranging a protocol header according to a type of a reception port of a protocol in which the type of the IP protocol is TCP; And And a twelfth step of arranging user data when the type of the receiving port of the protocol of which the type of the IP protocol is TCP is an unknown port. The method of claim 5, The third step, A thirteenth step of selecting a type of a packet to be simulated using the LAN card; A fourteenth step of forming user data / TCP / IP / Ethernet transmission data and performing a simulation function according to the selection result of the thirteenth step; And And a fifteenth step of forming user data / logical connection control / 802.3 transmission data according to the selection result of the thirteenth step. The method of claim 5, The fourteenth step, Forming an Ethernet header for the user data / TCP / IP / Ethernet transmission data; A seventeenth step of forming an IP header for the user data / TCP / IP / Ethernet transmission data; An eighteenth step of forming a TCP header for the user data / TCP / IP / Ethernet transmission data; And And a nineteenth step of inputting user data according to the user data input selection for the user data / TCP / IP / Ethernet transmission data. The method of claim 7, wherein The sixteenth step, Receiving a counterpart Ethernet address; A twenty-first step of checking whether the input header is normal after receiving the protocol type; And And repeating the 20th step or less if the test result is abnormal, and forming the IP header using the inputted information if the test result is normal. The method of claim 8, The counterpart Ethernet address of the twentieth step may be input by a user's direct selection, input through ARP (Address Resolution Protocol) processing, or input through default processing. The method of claim 7, wherein The seventeenth step, A 20th step of forming an IP header using the hexa value input by the user when the user selects input of the header data as the hexa value; And When the user selects the menu input, the menu screen receives the other party's IP address, own IP address, protocol type, protocol version type, TTL (Time To Live), service type, flag, fragment offset, and option information. And a twenty-first step of calculating the remainder of the user IP header to generate an IP header. The method of claim 7, wherein The eighteenth step, A 20th step of forming a TCP header using the hexa value input by the user when the user selects input of the header data as the hexa value; And When the user selects the menu input, he receives the other side's TCP port, his TCP port, window, sequence number, response number, control field, emergency pointer and options through the menu screen, and calculates the rest of the user's TCP header. Local area network protocol analysis and educational simulation method comprising the step of generating a header. The method of claim 6, The fourteenth step, A sixteenth step of selecting a simulation function by the user; A sixteenth step of transmitting only the formed TCP packet according to the selection result of the sixteenth step; A seventeenth step of performing a TCP connection function according to the selection result of the sixteenth step; An eighteenth step of performing a TCP releasing function according to the selection result of the sixteenth step; A nineteenth step of repeatedly performing a TCP connection and disconnection function according to the selection result of the sixteenth step; And According to the selection result of the sixteenth step, the local area network protocol analysis and training simulation method comprising a twenty step of performing a TCP traffic generation function. The method of claim 6, The fifteenth step, A sixteenth step of forming an 802.3 packet; A seventeenth step of selecting a work type of the 802.3 packet by a user; An eighteenth step of forming a UDP / IP / Ethernet series packet according to the selection result of the seventeenth step; A nineteenth step of forming an ICMP / IP / Ethernet series packet according to the selection result of the seventeenth step; A 20th step of forming an EGP / IP / Ethernet series packet according to the selection result of the 17th step; A twenty-first step of forming a RIP / IP / Ethernet series packet according to the selection result of the seventeenth step; A twenty-second step of forming an OSPF / IP / Ethernet series packet according to the selection result of the seventeenth step; And And a twenty-third step of forming an IGMP / IP / Ethernet series packet according to the selection result of the seventeenth step. The method of claim 13, The sixteenth step, A twenty-fourth step of inputting a counterpart 802.3 address; A twenty-fifth step of inputting or defaulting a destination service access point (DSAP) according to a user's selection; A twenty sixth step of inputting or defaulting a source service access point (SSAP) according to a user's selection; A twenty-seventh step of inputting a control field type or default processing according to a user's selection; A twenty-eighth step of inputting or default processing logical connection control PDU user data according to a user's selection; And And a twenty-ninth step of calculating the length of the logical connection control PDU data inputted to the user data. The method of claim 13, The eighteenth step, A twenty-fourth step of forming a UDP / IP / Ethernet series packet by forming a UDP header using the hexa value input by the user when the user selects input of the header data as the hexa value; And When the user selects a menu input, a twenty-fifth step of forming a UDP / IP / Ethernet series packet by receiving a counterpart UDP port, its own UDP port, and user data through a menu screen, and then cleaning up the hexadecimal memory LAN protocol analysis and educational simulation method. The method of claim 13, The nineteenth step, A twenty-fourth step if the user selects the input of the header data as the hexa value, forming an ICMP / IP / Ethernet series packet using the user input hexa value; And When the user selects a menu input, the LAN protocol includes a twenty-fifth step of forming an ICMP / IP / Ethernet series packet by adding a TYPE, a code, and other elements through a menu screen, and then arranging the memory of the hexa value. Analytical and Educational Simulation Methods. The method of claim 13, The 20th step, If the user selects input of the header data as the hexa value, forming a EGP / IP / Ethernet series packet using the user input hexa value; And If the user selects a menu input, a twenty-fifth step of forming the EGP / IP / Ethernet series packet by adding the TYPE, version, code, and other elements through the menu screen, and then arranging the memory of the hexa value is included. LAN protocol analysis and educational simulation method. The method of claim 13, The twenty-first step, A twenty-fourth step of forming a RIP / IP / Ethernet series packet using the hexa-value inputted by the user if the user selects input of the header data as the hexa value; And When the user selects a menu input, the local area network includes a twenty-fifth step of forming a RIP / IP / Ethernet packet by adding a command, a version, and other elements through the menu screen, and then arranging the memory of the hexa value. Protocol Analysis and Educational Simulation Methods. The method of claim 13, The twenty-second step is A twenty-fourth step of forming an OSPF / IP / Ethernet series packet using the hexa-value inputted by the user when the user selects input of the header data as the hexa value; And When the user selects a menu input, the local area network includes a twenty-fifth step of forming a OSPF / IP / Ethernet series packet by adding a TYPE, a version, and other elements through a menu screen, and then arranging the memory of the hexa value. Protocol Analysis and Educational Simulation Methods. The method of claim 13, The twenty-third step, A twenty-fourth step of forming an IGMP / IP / Ethernet series packet using the hexa-value input by the user when the user selects input of the header data as the hexa value; And When the user selects a menu input, the local area network includes a twenty-fifth step of forming the IGMP / IP / Ethernet series packet by adding the type, version, and other elements through the menu screen, and then arranging the memory of the hexa value. Protocol Analysis and Educational Simulation Methods. The method according to any one of claims 1 to 3, The fourth step, A seventh step of selecting a display type by the user; An eighth step of displaying all received information according to the selection result of the seventh step; A ninth step of displaying only packets identical to its own IP address according to the selection result of the seventh step; A tenth step of displaying only packets identical to the other party's IP address according to the selection result of the seventh step; An eleventh step of displaying only packets identical to its own TCP port according to the selection result of the seventh step; And And a twelfth step of displaying only the same packet as the counterpart TCP port according to the selection result of the seventh step. The method according to any one of claims 1 to 3, The fifth step, A seventh step of determining whether the source IP address and the IP address and TCP port to be protected; An eighth step of determining whether the transmission IP address and the IP address to be protected and the TCP port are IP addresses to be transmitted or protected as a result of the determination in the seventh step; A ninth step of determining whether the upper layer is TCP if the IP address to be transmitted or protected is determined as the result of the eighth step; A tenth step of determining whether the transmission IP address, the IP address to be protected and the UDP port are not the IP address to be transmitted or protected as a result of the determination in the eighth step; An eleventh step of transmitting noise information if the transmission IP address, the IP address to be protected and the UDP port are determined as the result of the tenth step; A twelfth step, if it is determined that the tenth step is not a transmission IP address, an IP address to be protected, and a UDP port; A thirteenth step of transmitting noise information and performing TCP cancellation processing if the upper layer is TCP as a result of the determination in the ninth step; A fourteenth step of performing a process of transmitting the noise information of the eleventh step if the upper layer is not TCP as a result of the determination of the ninth step; And And a fifteenth step of performing the step of transmitting the noise information of the thirteenth step if the transmission IP address, the IP address to be protected, and the TCP port are not determined, in the seventh step. . The method according to any one of claims 1 to 3, The sixth step, A seventh step of selecting whether the user performs the educational monitoring function; An eighth step of capturing traffic on the LAN according to the selection result of the seventh step, and the firmware function calling an application program; A ninth step of creating a program for forming an Ethernet / 802.3 packet, an IP packet, a TCP packet, or an application layer packet according to selection of a display function after performing the eighth step; A tenth step of compiling and displaying a result of performing the ninth step; And And an eleventh step of performing the educational simulation and the tenth step according to the selection result of the seventh step. In a computer with a LAN card equipped with a microprocessor, A first function of outputting a local area network protocol obtained through said LAN card; A second function of monitoring a local area network protocol using the LAN card according to a function selection of a user; A third function of generating a packet according to a type of a medium access control (MAC) address selected by a user and performing simulation; And A fourth function for outputting a result of performing the second function and the third function A computer-readable recording medium having recorded thereon a program for realizing this.