KR20080058609A - Unification-based type wireless lan protocol analysis apparatus, analysis method thereof, and practice teaching method thereof - Google Patents

Abstract

An integrated wireless LAN protocol analysis apparatus, and an analysis method and a practice teaching method using the same are provided to automate a channel analyzing and setting process, minimize a loss of a wireless LAN packet, and provide data for accurate wireless LAN analysis. A wireless LAN analysing system(140) performs network management, protocol analysis, and a training package for data communication practice. A protocol decoder collects a packet generated from a wireless LAN node, summarizes and analyzes a protocol based on a basic protocol header, and displays information. A net tool manages a wireless LAN network, checks a state of a system, tracks a path by automatically searching an IP address and a name, and provides information about a communication network. A network management information is displayed in the form of diagrams and graphs with respect to the packet and channel information to provide information for a network management. The protocol decoder includes decode, nodes, protocols, summary channels, signal, matrix, and log.

Description

Integrated wireless LAN protocol analysis equipment and analysis method and training method using same {Unification-based type Wireless LAN Protocol Analysis Apparatus, analysis method

1 is a block diagram of a conventional WLAN protocol analysis system.

2 is a setting screen of the conventional AcroLan

3 is a block diagram of a wireless LAN protocol analysis system according to the present invention.

Figure 4 is a program screen shown using the decoder function of the wireless LAN protocol analysis equipment according to the present invention.

Figure 5 is a program screen shown using the node function of the wireless LAN protocol analysis equipment according to the present invention.

Figure 6 is a program screen shown using the protocol function of the wireless LAN protocol analysis equipment according to the present invention.

7 is a program screen shown using a decoder function of the wireless LAN protocol analysis equipment according to the present invention.

8 is a program screen shown using the channel function of the wireless LAN protocol analysis equipment according to the present invention.

Figure 9 is a program screen shown using the signal function of the wireless LAN protocol analysis equipment according to the present invention.

10 is a program screen shown using the matrix function of the wireless LAN protocol analysis equipment according to the present invention.

11 is a program screen shown by using the log function of the wireless LAN protocol analysis equipment according to the present invention.

12 is a program screen shown using the Ping function of the wireless LAN protocol analysis equipment according to the present invention.

Figure 13 is a program screen shown using the IP Scan function of the wireless LAN protocol analysis equipment according to the present invention.

14 is a program screen shown using the Trace Route function of the WLAN protocol analysis equipment according to the present invention.

15 is a program screen shown using the DNS Lookup function of the wireless LAN protocol analysis equipment according to the present invention.

16 is a program screen shown using the Domain information function of the wireless LAN protocol analysis equipment according to the present invention.

Figure 17 is a full screen of the program for diagnosing the WLAN network of the WLAN protocol analysis method according to the present invention.

18 is a general operation flow chart of the algorithm to which the WLAN protocol analysis method according to the present invention is applied.

19 is a summary analysis screen of the received packet to which the algorithm is applied as a result screen of the WLAN protocol analysis method according to the present invention.

20 is a screen showing the nucleus value and ASCII value of the received packet as a result screen of the WLAN protocol analysis method according to the present invention.

21 is a screen analyzing a received packet as a result screen of the WLAN protocol analysis method according to the present invention.

FIG. 22 is a flowchart illustrating a state of belonging of corresponding network nodes of a WLAN protocol analysis method according to the present invention; FIG.

FIG. 23 is a screen showing the membership status of corresponding network nodes as a result screen of the WLAN protocol analysis method according to the present invention; FIG.

24 is a screen showing the type of packets transmitted in the corresponding network through the type analysis of the received packet as a result screen of the WLAN protocol analysis method according to the present invention.

FIG. 25 is a flowchart illustrating the operation of identifying a type of a packet transmitted in a corresponding network through a type analysis of a received packet of the WLAN protocol analysis method according to the present invention. FIG.

FIG. 26 is a flowchart illustrating operation of determining bandwidth use per channel of the WLAN protocol analysis method according to the present invention; FIG.

FIG. 27 is a screen illustrating a connection / communication state of nodes based on a calculation of a destination and a destination of network nodes as a result screen of the WLAN protocol analysis method according to the present invention; FIG.

28 is a screen showing bandwidth usage per channel as a result screen of the WLAN protocol analysis method according to the present invention.

29 is a flowchart illustrating the operation of the signal strength and the noise state per channel in the WLAN protocol analysis method according to the present invention;

30 is a screen showing the signal strength and noise state per channel as a result screen of the WLAN protocol analysis method according to the present invention.

31 is a screen for changing the setting and channel of the WLAN card as a result screen of the WLAN protocol analysis method according to the present invention.

 32 is a flowchart illustrating an operation of determining connection / communication status of nodes based on calculation of a transmission destination and a destination of network nodes in the WLAN protocol analysis method according to the present invention.

 33 is a screen for modifying and generating a packet to the result screen of the WLAN protocol analysis method according to the present invention.

 34 is a flowchart illustrating the operation of the filter rule of the WLAN protocol analysis method according to the present invention.

 35 is a screen for setting the 802.11 packet to receive as a result screen of the WLAN protocol analysis method according to the present invention.

 36 is a screen for setting a port to receive as a result screen of the WLAN protocol analysis method according to the present invention.

 37 is a screen for setting the IP to be received as a result screen of the WLAN protocol analysis method according to the present invention.

 38 is a screen for setting a MAC address to receive as a result screen of the WLAN protocol analysis method according to the present invention.

 39 is a screen for setting the size and data of a packet to be received as a result screen of the WLAN protocol analysis method according to the present invention.

40 is a full screen of the protocol tester of WLAN protocol analysis method training according to the present invention.

41 is a data input result screen of the protocol tester of WLAN protocol analysis method training according to the present invention.

42 is a result screen of the protocol tester of WLAN protocol analysis method training according to the present invention.

43 is a packet selection screen of the protocol tester of the WLAN protocol analysis method training according to the present invention.

44 is a program screen for analyzing the MAC frame of the WLAN protocol analysis method training according to the present invention.

45 is a program screen for Beacon frame analysis of WLAN protocol analysis method training according to the present invention.

46 is a program screen for analysis of probe frame of WLAN protocol analysis method training according to the present invention.

47 is a program screen for authentication frame analysis of WLAN protocol analysis method training according to the present invention.

48 is a program screen for association frame analysis of WLAN protocol analysis method training according to the present invention.

49 is a program screen for Logical Link Control frame analysis of WLAN protocol analysis method training according to the present invention.

** Description of the symbols for the main parts of the drawings **

100: wireless LAN protocol analysis system 110: terminal

120: AP & WLAN card 130: RF Grabber

140: wireless LAN protocol analysis equipment 150: WAN

160: switch 170: router

The present invention captures and stores all information generated in the entire wireless network process (signal information, wireless internet, etc.) and collects them in real time according to the needs of the user to analyze, statistics, network optimization, network management, and operation. The present invention relates to a wireless LAN protocol analysis device that performs data sniffing or collection occurring in all wireless network nodes by installing repair, blocking (Fire Ball), and RF Grabber.

Generally, there is no clear standard for defining a wireless LAN.Wireless LAN (Wireless Local Area NetWork) refers to building a wireless network environment in an indoor or outdoor environment such as an office, a shopping mall, or a home, and in technical terms, a hub. It refers to a method of building a network by using radio waves or light instead of wires to clients such as personal computers (PCs), notebook PCs, and personal digital assistants (PDAs).

The feature of the wireless LAN is that wireless LAN users are guaranteed the mobility to access information in real time anywhere in a specific area, which can bring productivity and service increase that is differentiated from the wired environment, and can be used to cut walls or ceilings. Although the operation is unnecessary, can be quickly and easily deployed, and the initial wireless LAN deployment cost is larger than that of the wired LAN, but in the long run considering the realistic enterprise environment that requires frequent movement, change, or additional work of the network due to organizational change. The saving effect is big, and it can be constructed with various types of topology according to the demand of the application field.

As shown in FIG. 1, a conventional WLAN analysis system usually performs a WLAN packet collection activity on a specific channel based on one WLAN card. In Korea, only one channel is selected from 13 channels. These WLAN packets cannot be analyzed, and there is a limitation in not being able to adequately cope with the flexible WLAN environment in which the main communication channels change from time to time.

For example, there may be a function to collect data by circulating each channel for a certain period of time, but this is a collection method according to a uniform time division that does not consider the amount of transmission / reception of wireless LAN packets actually occurring in each channel. There is a problem in that a situation in which a WLAN packet of a more active WLAN channel is lost due to a time allocated to a channel that is not, causes a situation that it is not sufficient to collect data necessary for analysis of the WLAN environment.

In addition, a method of determining whether a PC (Personal Computer) equipped with a '802.11 a / b / g / e / i / n / m'-based wireless LAN card works well is a diagnostic tool provided by a corresponding vendor. As an example of knowing the current state of the card, referring to the state screen of AcroLan based on 'Intersil' of FIG. 2, State, Current Tx, Current Channel, Throughput (bytes / sec) Tx, Throughput (bytes / sec) Rx There is a problem of lack of information to solve the situation where only data of link quality and signal strength can be known.

In addition, the '802.11 a / b / g / e / i / n / m' based wireless protocol practice method looks at the standard of the corresponding frame. When the program corresponding to the standard is produced, the program is produced by combining the coding and the standard. There was a problem that was not easy to do.

In order to solve the above problems, the present invention is to efficiently and flexibly cope with the entire WLAN channel within limited resources, to collect various WLAN packets, and to provide sufficient data required by the WLAN analysis system. There is a purpose.

An object of the present invention is to propose a method for analyzing a network in a wireless LAN, and to solve a problem to use an efficient wireless LAN network.

In addition, 'retransmission and fragmentation due to interference', 'unreasonable node belonging to AP', 'wrong RTS / CTS Threshold setting', 'unreasonable active scan', and 'problem of relative node' which are factors that reduce the transmission rate in WLAN , 'Problems caused by excessive bandwidth on the channel', 'Problems caused by signal and noise strength on the channel', and 'Performance problems of APs and nodes' are suggested. There is a purpose.

In addition, the purpose of the present invention is to propose a protocol practice method using a programming language and to enable efficient WLAN protocol practice.

In order to achieve the above object, the present invention provides an apparatus for analyzing a wireless LAN system for providing a wireless LAN service,

A protocol decoder which collects packets generated in a WLAN node such as 802.11 a / b / g / e / i / n / m and displays information by analyzing protocol summary based on a basic protocol header;

A tool for managing the WLAN network, a net tool for checking a system status, automatically searching for an IP address and a name, tracking a route, and providing information on a communication network;

Network management information which provides information for network management by displaying the received packet and channel information in a chart form and a graph form;

It is composed of wireless network protocol analysis equipment that not only provides network management and protocol analysis, but also supports educational package for data communication practice.

In addition, in the analysis method for identifying and solving network problems in the WLAN protocol analyzer,

The first step of analyzing the received packet on the channel set to diagnose the network according to the 802.11 a / b / g / e / i / n / m standard and displaying the Retransmitted bit and the Fragment bit in the frame control field Wow;

A second step of determining affiliation status of corresponding network nodes by calculating MAC, BSSID, and ESSID of the received packet;

A third step of identifying the type of the packet transmitted in the corresponding network through the type analysis of the received packet;

Based on the calculation of the destination and destination of the network nodes, the node is displayed as 'dot' and the connection is represented as 'line' for free viewing after analyzing the node connection status. A fourth step of identifying a connection / communication state of the nodes;

Total packets per channel, Management packets / bytes, Control packets / bytes, Data packets / bytes, FromDS, ToDs, Maximum signal strength / dBm, Maximum noise strength / dBm, Minimum signal strength / dBm A fifth step of identifying bandwidth usage per channel by displaying minimum noise strength / dBm, current signal strength / dBm, current noise strength / dBm, number of packets / bytes for each DataRate, and time;

Displaying a signal and noise in the form of a graph per channel to determine signal strength and noise strength for each channel;

The seventh step of receiving only the desired packet through the setting of the function of generating a packet to affect the WLAN network; WLAN protocol analysis method consisting of.

Finally, in the exercise of the WLAN protocol,

A first step of practicing a protocol using a protocol tester;

A second step in which the training program of the first step brings a packet actually captured by the wireless LAN protocol analyzer;

A third step of creating an analysis routine according to the 802.11 a / b / g / e / i / n / m format in a practice program using VC ++ using the captured packet in the second step; How to practice.

Hereinafter, with reference to the accompanying drawings to describe the present invention in detail.

Hereinafter, the equipment constituting the WLAN protocol analysis system of the present invention will be described.

As shown in FIG. 3, a network environment is wirelessly established in an indoor or outdoor environment such as an office, a shopping mall, or a home, and a client such as a personal computer (PC), a notebook PC, and a personal digital assistant (PDA) in a hub. The present invention relates to building a network using radio waves or light instead of wires, and the AP (Access Point) 120 is wireless with the terminal 110 such as a personal computer (PC), a notebook PC, and a personal digital assistant (PDA). Provides wireless LAN service through communication.

The RF Grabber 130 is a hardware-based remote wireless LAN capture terminal that captures packets transmitted from the AP 120 and encapsulates them in real time in the form of a stream such as UDP (User Datagram Protocol) and TCP (Transmission Control Protocol). It transmits and saves cost by analyzing up to 15 wireless LAN protocol analysis client clients by connecting one RF Grabber in 1: N method.

More specifically, in the channel setting for WLAN packet collection, the WLAN communication measures the amount of WLAN packets transmitted and received by circulating each channel for a predetermined time for one WLAN card for evaluating active channels. The wireless LAN packet is sorted according to a large number of repairs and receptions, and the dedicated N-1 wireless LAN cards are allocated in order to receive the wireless LAN packet. For the last one WLAN card, the weight of the WLAN packet collection time according to the sorting order for the channels for which the dedicated WLAN card has not been allocated, that is, more packet collection time for the channel to which many WLAN packets travel. In this method, the WLAN packet of the channel having a large amount of WLAN packet transmission / reception is lost due to the time allocated to the channel having a small amount of transmission / reception of the WLAN packet during uniform time distribution by varying the WLAN packet collection time of the remaining channel. Minimize that. In addition, the above process is repeated at regular intervals for proper response to the flexible WLAN environment.

The WLAN packets collected as described above are stored in the management area of the WLAN packet collector prior to being delivered to the WLAN analyzer 140, which is the time point for requesting the WLAN transmission of the WLAN analyzer 140 and wirelessly. It is a buffer structure for preventing the loss of a WLAN packet occurring in the gap of the WLAN packet receiving time of the LAN packet collector. In the multi-input and output method based on the asynchronous input and output method, the wireless LAN packet collector from the wireless LAN analyzer 140 forwards the wireless LAN packet to a predetermined number, regardless of the fulfillment of the delivery request. When the WLAN packet is collected in advance and the WLAN packet is collected in the WLAN analyzer, the requested operation is sequentially performed to reduce the mutual communication gap between the WLAN packet collector and the WLAN analyzer, thereby reducing the number of WLAN packets. It constructs a structure that delivers a large amount of received WLAN packets without loss.

And the feature of the RF Grabber 130 is installed in the area where the wireless LAN service is provided, if the RF Grabber is connected to the network through the Ethernet cable (Ethernet Cable) assigned an IP address company, region, country and worldwide It is possible to collect and analyze the packet data generated in each wireless LAN node distributed in real time and can be applied for various purposes, and by changing the AP mode, general 802.11 a / b / g / e / i / n / m It can also be used as a 54Mbps wireless router, and it is easy to set capture options with the built-in Web Management Systems.

The wireless LAN analysis device 140 analyzes and statistics by dividing all information generated in the entire wireless network process (Signal information, wireless Internet, etc.) in real time by using the packet captured by the RF Grabber 130 give.

In addition, various data analysis through optimization of AP, powerful analysis through uniform user interface, and one-click user interface provide various pop-up menus and various analysis data for network management.

The wide area network (WAN) 150 is a diverse and comprehensive computer communication network that is constructed over a wide area, and connects the RF Grabber 130 and the wireless LAN protocol analysis equipment. 160 is connected to the RF Grabber and the wireless LAN protocol analysis equipment one by one to switch the frame according to the MAC Address (Physical Address), the router 170 is connected to the WAN and the IP packet according to the IP Address Set the path.

The wireless LAN protocol analysis equipment for analyzing a wireless LAN system for providing a wireless LAN service in the wireless LAN protocol analysis system configured as described above is a wireless LAN such as 802.11 a / b / g / e / i / n / m. A protocol decoder for collecting the packets generated at the node and analyzing the protocol summary based on the basic protocol header to display information; A tool for managing the WLAN network, a net tool for checking a system status, automatically searching for an IP address and a name, tracking a route, and providing information on a communication network; Network management information which provides information for network management by displaying packet and channel information in a chart form and a graph form; It not only provides network management and protocol analysis, but also integrates educational packages for data communication practice.

The wireless LAN protocol analysis device has a built-in powerful protocol decoder, and is a powerful protocol decoder such as hexa decoder and detail decoder, along with basic protocol header-oriented protocol summary analysis after packet capture, and the protocol decoder includes a decode and a node ( Nodes), Protocols, Summary Channels, Signal, Matrix, and Log.

Hereinafter, the components of the decoder of the WLAN protocol analysis equipment will be described in detail.

The decode is composed of three windows in which packets captured after capturing packets are analyzed for each protocol as shown in FIG. 4A, and FIG. 4B is a summary window showing the captured packets in order. The captured packet is analyzed from the start of capture to the summary window until it stops, and FIG. 4C shows a data window that shows one packet as actual Hexa and ASCII values. 4D shows a detail window for analyzing the currently selected packet for each protocol.

Here, the relation between the data window and the detail window is listed in order of the packets captured in the summary window. When one packet is selected in the summary window, the corresponding packet selected in the data window showing the hexa value and the detail window are analyzed and output. . When one piece of information analyzed in the detail window is selected, a corresponding field is displayed in the data window. Similarly, when one field is selected in the data window, the corresponding information is displayed in the detail window.

The nodes display the captured packet information as a diagram as shown in FIG. 5.

The protocol indicates the capacity and number of packets in the form of a percentage as shown in FIG. 6. The captured packet is a frame that manages packet transmission. It is displayed by dividing into Control, which is a frame that controls, and Data, which is a frame that manages data transmission of a packet.

The summation divides the captured information into Time, Packets, Error, Size, and Wep items as shown in FIG. 7 and displays them in two forms, a chart form and a graph form.

The channels indicate the information of the channel used as the transmission path of the packet as shown in FIG. 8, and the signal divides the information of the channel into a signal and a noise, respectively, as shown in FIGS. As shown in FIG. 9B, the matrix displays information of nodes and links used for packet transmission as shown in FIG. 10, in a diagram and a chart form, and the log is shown in FIG. It shows the usage information of LAN protocol analyzer program.

In addition, the WLAN protocol analysis device has a net tool for managing a network, the net tool is composed of a Ping, IP Scan, Trace Route, DNS Lookup, Domain information.

Hereinafter, the components of the net tool of the WLAN protocol analysis equipment will be described in detail.

The Ping checks the status of the system, performs more detailed and various ping tests than the IP scan, and specifies single, continuous, multiple IP and Host Name input values.

Accordingly, the ping result is displayed as IP Address, Response Time, and Status Bar. FIG. 12A shows yahoo.co.kr for 10 test counts for a single ping, and FIG. 12B shows 192.168.0.1 for continuous pings. This is the result of two test counts up to 192.168.60, and FIG. 12C shows the result of two test counts by inputting a desired address in an edit box for multi-ping.

The IP Scan automatically searches for an IP address and a name, and checks whether a target device is running or a network is connected to a specified IP address to check connectivity of a communication device, IP addresses running within the range and the corresponding node names are automatically searched every 100 times in TIMEOUT time to patch the information independently.

Accordingly, the IP scan is displayed as a progress bar as shown in FIG. 13A and provides a report in the form of a report. FIG. 13B is a click of the view button of FIG. 13A and provides a result in the form of a node map. The IP, Host Name and RTT for the selected node are displayed in the right box, and in FIG. 13C, the result button of FIG. 13A is clicked. Round Trip Time (RTT) is provided.

The trace route traces the input route of the HOST or IP, and the trace result is provided in the form of the report of FIG. 14A and the node map of FIG. 14B, and the number of hops, IP address, and information (host name or NetBIOS) are included in the report. Name) and RTT (Response Time) are displayed, and if the node map selects any node, the IP, Host Name and RTT for the node are displayed in the right box.

When the DNS Lookup does not know the IP address of the state host, it queries the Domain Name System (DNS). The domain name system converts the domain name of the host to the IP address as shown in FIG. 15, and finds the NetBIOS Name of the target IP address. Shows.

The Domain Information provides information about a communication network. The Domain Information is a service for providing information about a communication network managed by a network information center (NIC). The domain information retrieves information about the communication network such as a user from an IP address or a domain name of a partner host. . Accordingly, as shown in FIG. 16, a user, an address, and the like are displayed as user organization information of the queried domain.

Therefore, the wireless LAN protocol analysis device is capable of monitoring and real-time analysis at the same time, so that various pop-up menus and network management can be performed through powerful data analysis and one-click user interface through various data analysis and uniform user interface for AP optimization. It is characterized by providing analytical data.

Hereinafter, an analysis method using a wireless LAN protocol analysis device in the wireless LAN protocol analysis system of the present invention will be described.

The present invention is to reduce the transmission rate in the wireless LAN as' increased retransmission and fragmentation due to interference ',' unreasonable node belonging to AP ',' wrong RTS / CTS Threshold setting ',' unreasonable active scan ',' Problem ”,“ problem due to excessive bandwidth usage of a corresponding channel ”,“ problem due to signal and noise strength of a corresponding channel ”, and“ problem performance of an AP and a node ”as shown in FIG. 17 to use a seamless WLAN network. Let's do it.

In the confirmation according to 'increase in retransmission and fragmentation' due to the interference,

After analyzing the received packet on the channel set to diagnose the network according to 802.11 a / b / g / e / i / n / m standard, it displays Retransmitted bit and Fragenet bit in the frame control field. As shown in FIG. 18, packet reception, packet analysis, and databaseization of data to be analyzed are performed. The 802.11 a / b / g / e / i / n / m packet analysis method includes the received packet as shown in FIG. As shown in the above, the target, source, length, basic service set identification (BSSID), type, subtype, channel, signal level, noise level, transmission rate, presence or absence of WEP (Wired Equivalent Privacy), and time are analyzed. When one packet is selected from among the packets listed as shown in FIG. 19, the selected packet is displayed as a hexa value and an ASCII value as shown in FIG.

The selected packet is analyzed according to the 802.11 a / b / g / e / i / n / m standard format, the analyzed data is displayed in a tree form that is easy to understand and suitable for the user, and the detailed field of the packet is displayed. When it is selected, the hexa value and the ASCII value are matched and displayed, and it is determined that the appearance of the Retransmitted and Fragment fields in the analyzed data is the result of interference when more than 10 occurrences appear.

Finally, if it is determined that the result of the interference, the location of the node equipped with the wireless LAN protocol analysis equipment is measured by changing the location, and the area where the frequency of retransmission and fragmentation does not occur is searched.

Accordingly, as shown in FIG. 21, when retransmission and fragmentation are confirmed continuously and determined to be caused by interference when 10 or more appear, the problem can be solved by changing the position of the corresponding node.

Regarding the 'node belonging to the AP overload', it is possible to determine the affiliation status of the corresponding network nodes through calculation of medium access control (MAC), basic serivice set identification (BSSID), and extended service set identification (ESSID) of the received packet. It shows the status of belonging to AP by placing ESS (Extended service set) as the top and placing BSS (Extended service set) which is a normal AP address under it and each client or node.

That is, as shown in FIG. 22, the relationship between the ESSID, the BSSID, and the MAC is derived through the operation flow chart, and the derived data is displayed in a tree form in a convenient and proper format, and displayed in the tree form. When there are more than 40 nodes, it is determined that there is a character in the efficiency of the corresponding AP.

Therefore, as shown in FIG. 23, if an administrator has more than 40 nodes belonging to one AP, several nodes belong to another AP for efficiency.

Regarding the 'wrong RTS / CTS threshold setting' and 'overload active scan', the received packet is identified by the type of the packet transmitted in the corresponding network through type analysis, and the type and subtype of the received packet are identified. Through the types of Management, Control, and Data, the subtype is placed underneath, and as shown in FIG. 24, statistics of Bytes, the number of packets, and the specific gravity are displayed on the subtype.

In more detail, in the method for identifying the type of packet transmitted in the network, as shown in FIG. 25, the type and subtype of the transmitted packet are derived and displayed in a tree form through an operation flowchart. If the occurrence of RTS / CTS occurs more than 10 times before and after the data frame using the result data of 19, it is determined that there is a problem in the threshold value of the corresponding node, and the threshold value of the corresponding node is set to 2048 to solve the problem. Solve.

If more than 10 probe requests appear in the corresponding node, it is determined that the AP to which the node belongs is absent, and if it is determined that the AP is absent, the node belongs to another AP to eliminate the occurrence of the probe request. .

Therefore, if the appearance of the RTS / CTS occurs more than 10 times before and after the data frame through the screen of the received packet of FIG. 19, the administrator checks the node and increases the threshold value of the node to increase the weight of the RTS / CTS. You can increase the transmission rate by lowering it. And if more than 10 Probe Requests appear in succession, it is possible to remove the Probe Request by attaching the node to another AP.

As for the problem of the other node, when there is a problem in communication, if there is no problem with one node, it is to check the other node. As shown in FIG. As shown in FIG. 27, the nodes are displayed as 'points' as 'lines', and the nodes are connected to each other by moving the connections. Check the communication status.

Accordingly, as shown in FIG. 28, the packet is represented by the counter node, the number of packets, the number of bytes, and the like through the connection state based on the address of the received packet. In addition, through FIG. 28, the administrator can check which node is communicating with which node in the current network, thereby providing an opportunity to check the other node together when there is a problem.

Regarding the 'problem caused by excessive bandwidth usage of the corresponding channel', the total packet count, management packet count / byte, control packet count / byte, data packet count / Bytes, FromDS, ToDs, Maximum Signal Strength / dBm, Maximum Noise Strength / dBm, Minimum Signal Strength / dBm, Minimum Noise Strength / dBm, Current Signal Strength / dBm, Current Noise Strength / dBm, Packets / Bytes for Each DataRate In addition, time is displayed to determine bandwidth usage per channel.

Therefore, based on the usage of packets per channel, the usage of packets of channels other than the corresponding channel is displayed as shown in FIG. 30, and when a channel to be received is changed, a channel may be set as illustrated in FIG. 30, the administrator can know the usage of the currently set channel. If the transmission rate to the set channel is low, the manager can change the channel by comparing with another channel.

Regarding the 'problem caused by the signal and noise intensity of the corresponding channel', the signal and noise intensity per channel are displayed in the graph form as shown in FIG. 27 through the operation flowchart of FIG. do. And, through FIG. 27, the manager can know the signal strength and the noise strength of the current and other 14 channels, and can select a channel having the lowest interference rate.

As for the performance problem of the AP and the node, as shown in FIG. 33, a desired packet is generated and generated according to the operation flow chart of FIG. 34, and the channel for receiving a desired packet as shown in FIGS. Set the baud rate, signal and noise strength, presence of WEP, IP, MAC, Port, data at desired location, packet size and let the decoder analyze.

In other words, by measuring the location of the node equipped with the wireless LAN protocol analysis equipment, and by searching the area where the frequency of occurrence of retransmission and fragmentation does not occur, and set the packet reception, 802.11 a / b / g / e / i Generate a packet to check the performance of the AP and node on the basis of / n / m, and after generating the packet of the discovery request, authentication request, membership request, withdrawal request in Figure 19 with respect to the generated packet AP and node Check the performance of the channel, baud rate, signal dBm, noise dBm, WEP, IP address of destination and destination, MAC address of destination and destination, port of destination and destination, data at desired location, and packet. Set it.

Therefore, through the window of FIG. 33, the administrator checks whether the AP responds correctly to the discovery request, authentication request, membership request, re-association request, and withdrawal request, and responds to the client properly. Have you check performance. For example, if the user wants to confirm the search request, the packet of the search request may be selected in FIG. 19 and the packet may be generated.

The present invention configured as described above is a test / research and development tool in a communication equipment developer and a new protocol development company using VC ++, a program called Protocol Tester, in order to practice efficient wireless LAN protocol in wireless LAN. It can be used as educational equipment for school and communication equipment related industry.

Hereinafter, the training practice method of the protocol analysis method of the present invention will be described in detail.

The step of practicing the protocol by using the Protocol Tester is 'Version', 'Type', 'Subtype', 'Frame Control Flags', 'Duration' according to the order of the protocol header to be practiced in the Protocol Tester program as shown in FIG. ',' Address1, 2, 3, 4 ',' Sequence ',' Fragment 'in order.

Then, the training program takes the packet actually captured by the wireless LAN protocol analyzer, inputs the next data corresponding to the packet as shown in FIG. 41, and confirms the result through the 'result button'.

As shown in FIG. 42, the result of the Protocol Tester can be confirmed. In other words, the value entered by the user is compared with each protocol module built-in to compare or wrong, and the wrong item is False and the right item is displayed as True.

In addition, in order to test the packets automatically collected from the network or other stored packets by using the Protocol Tester, as shown in FIG. 43, other packets can be selected through a combo box selection to apply to the items corresponding to the tester. If the user inputs the correct data value as the Hexa value and presses the “Result” icon, each item entered is displayed as correct or incorrect. The wrong item can be repeated until it is correct.

And if all the data values of the tester for the packet are correct, the user directly writes, develops and compiles the analysis module using a programming language such as C, C ++, Visual C, etc. After setting the data, press the Run and Analyze button icon to display the analysis value.

Therefore, all the training procedures of the protocol tester consist of the above procedure.

The protocol practice includes '802.11 a / b / g / e / i / n / m MAC', 'Beacon', 'Probe Request', 'Probe Response', 'Authentication', 'Association Request' and 'Association Response' ',' Logical Link Control '.

Therefore, in the practice program using VC ++ with the captured packet, an analysis routine is written in the 802.11 a / b / g / e / i / n / m format, and the practice using VC ++ is based on 802.11 a / b / g / e / i / n / m Activate the project to practice for MAC frame analysis module.

Here, the part that needs to be written for frame analysis is PacketDecode function of relevant view class.

Table 1 below refers to the prototype of the PacketDecode function of the corresponding view class.

Void CCnCAnyPa80211AnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) Function summary When the packet analysis menu of the program is selected, the parameter passed to the executed function is related information of the currently received packet. In this function, we write the part that analyzes the contents of the packet and outputs the result. Parameters pPacket: The first starting address of the received packet. NLen: The total length of the received packet. Other contents It belongs to CnCAnyPa80211Analyer class and its contents are implemented in CnCAnyPa80211AnalyzerView.cpp file.

As shown in Table 1, the practice of the protocol is to separate and analyze the corresponding frame from the packet data in the stream form received through the PacketDecode function and output the result. It is preferable to maintain, and the packetDecode is expanded in a manner of proceeding by calling the function maintained in the simple form.

As shown in FIG. 44A, the corresponding function may be directly accessed through a class view as a member function belonging to a view class or through a corresponding view class file in which the function is implemented.

In addition, the project receives and analyzes the data through the wireless LAN protocol analysis equipment. The wireless LAN protocol analysis equipment may collect and transmit the contents of the actual wireless LAN communication. Use the basic.wpk file, which collects all WLAN data. The file is located in the packet samples folder below the installation folder, and as shown in FIG. 44B, the file is selected by reading the Open item in the File area from the menu of the WLAN protocol analyzer.

Therefore, when the training program is executed, it is executed as shown in FIG. 44C. After the training for the protocol is finished, the contents of analyzing the protocol can be confirmed as shown in FIG. 44D.

For the Beacon frame analysis module, open the project as shown in FIG. 45A using Visual Studio, and create a Probe analysis module for the PacketDecode function of the CCnCAnyPaBeaconAnalyzerView class.

First, because the Beacon frame is a Manage frame (type is '0') and the subtype is 8, it is written as in the following Table 2.

Void CCnCAnyPaBeaconAnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) {// Create Analysis Module PFRAME_CONTROL fc = (PFRAME_CONTROL) pPacket 'int i = 24; if (fc-> Type! = 0 || fc-> SubType! = 8) {WriteText ("＼r＼nThis data is not to be analyzed. ＼r＼n"); return; } PacketDecodeBeacon (pPacket + i, nLen -i); }

And declare the function in the header file of View as Table 3.

// Operation public: void PacketDecode (UCHAR * pPacket, int nLen); void PacketDecodeBeacon (UCHAR * pPacket, int nLen); void DecodeTimeStamp (UCHAR * time); void DecodeBeaconInterval (WORD w); void DecodeCapabilityinfomation (WORD w); void DecodeSsid (UCHAR * pPacket, int nLen); void DecodeSupportedRates (UCHAR * pPacket, int nLen); void DecodeDSParameteSet (UCHAR * pPacket, int nLen); void DecodeTIM (UCHAR * pPacket, int nLen);

Here, void PacketDecodeBeacon (UCHAR * pPacket, int nLen); is a Beacon analysis function and void Decodexxx (UCHAR * time); is a function for each subfield.

Therefore, when the training program is executed, the analyzed contents can be confirmed as shown in FIG. 45B.

The Probe Request and Probe Response frame analysis module is created by using Visual Studio to open a project as shown in FIG. 46A and creating a Probe analysis module for the PacketDecode function of the CCnCAnyPaProbeAnalyzerView class. The Association frame includes a request frame and a response frame. Are written inside the PacketDecode function.

First, since the Probe Request and Probe Response frames are Manage frames (type is '0') and the subtypes are 4 and 5, they are written as shown in Table 4 below.

Void CCnCAnyPaProbeAnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) {// Create Analysis Module PFRAME_CONTROL fc = (PFRAME_CONTROL) pPacket 'if (fc-> Type! = 0) return; int i = 24; if (fc-> SubType == 4) PacketDecodeProbeReq (pPacket + i, nLen-i); esif (fc-> SubType == 5) PacketDecodeProbeRes (pPacket + i, nLen-i); }

And declare the function as shown in Table 5 in the header file of View.

// Operation public: void PacketDecode (UCHAR * pPacket, int nLen); void PacketDecodeProbeReq (UCHAR * pPacket, int nLen); void PacketDecodeProbeRes (UCHAR * pPacket, int nLen); void DecodeTimeStamp (UCHAR * time); void DecodeBeaconInterval (WORD w); void DecodeCapabilityinfomation (WORD w); void DecodeSsid (UCHAR * pPacket, int nLen); void DecodeSupportedRates (UCHAR * pPacket, int nLen); void DecodeDSParameteSet (UCHAR * pPacket, int nLen);

Here, void PacketDecodeProbeReq (UCHAR * pPacket, int nLen); is ProbeReq analysis function, void PacketDecodeProbRes (UCHAR * pPacket, int nLen); is ProbeRes analysis function and void Decodexxx (UCHAR * time); are functions for each subfield. .

Therefore, if the training program is executed, the contents of analysis of Probe Request and Probe Respon can be confirmed as shown in FIGS. 46B and 46C.

The above authentication uses Visual Studio to open the project as shown in Figure 47a and create a Probe analysis module for the PacketDecode function of the CCnCAnyPaAuthAnalyzerView class.

First, Authentication is a Manage frame (type is '0') and subtype is 0x0b, so write it as in the following table 6.

Void CCnCAnyPaAuthAnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) {// Create Analysis Module PFRAME_CONTROL fc = (PFRAME_CONTROL) pPacket 'if (fc-> Type! = 0) return; int i = 24; if (fc-> SubType == 0x0) PacketDecodeAuth (pPacket + i, nLen-i);

And declare the function in the header file of View as Table 7.

// Operation public: void PacketDecode (UCHAR ＊ pPacket, int nLen); void PacketDecodeAuth (UCHAR * pPacket, int nLen); void DecodeAlgorithnNumber (WORD w); void DecodeTransactionSequnceNumber (WORD w); void DecodeStatusCode (WORD w);

Here, void PacketDecodeAuth (UCHAR * pPacket, int nLen); is an authentication analysis function, and void Decodexxx (UCHAR * time); is a function for each subfield, and as shown in FIG. 47B, the result can be confirmed.

The association request and association response frame analysis module is created by using Visual Studio to open a project as shown in FIG. 48A and creating a probe analysis module for the PacketDecode function of the CCnCAnyPaAssocAnalyzerView class. The association frame includes a request frame and a response frame. Are written inside the PacketDecode function.

First, since the Association Request and Association Response frames are Manage frames (type is '0') and the subtypes are 0 and 1, the Association Request and Association Response frames are prepared as shown in Table 8 below.

Void CCnCAnyPaAssocAnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) {// Create Analysis Module PFRAME_CONTROL fc = (PFRAME_CONTROL) pPacket 'if (fc-> Type! = 0) return; int i = 24; if (fc-> SubType == 0) PacketDecodeAssocReq (pPacket + i, nLen-i); esif (fc-> SubType == 1) PacketDecodeAssocRes (pPacket + i, nLen-i); }

And declare the function as shown in Table 9 in the header file of View.

// Operation public: void PacketDecode (UCHAR * pPacket, int nLen); void PacketDecodeAssocReq (UCHAR * pPacket, int nLen); void PacketDecodeAssocRes (UCHAR * pPacket, int nLen); void DecodeCapabilityinfomation (WORD w); void DecodeListenInterval (WORD w); void DecodeStatusCode (WORD w); void DecodeAssociationID (WORD w); void DecodeSsid (UCHAR * pPacket, int nLen); void DecodeSupportedRates (UCHAR * pPacket, int nLen);

Where void PacketDecodeAssocReq (UCHAR * pPacket, int nLen); is an Association Request analysis function, void PacketDecodeAssocRes (UCHAR * pPacket, int nLen); is an Association Response analysis function, and void Decodexxx (UCHAR * time); is for each subfield. Functions.

Therefore, when the training program is executed, the analysis contents of the association request and association response can be confirmed as shown in FIGS. 48B and 48C.

The Logical Link Control frame analysis module is created by using Visual Studio as shown in FIG. 49A and creating a Probe analysis module for the PacketDecode function of the CCnCAnyPaLlcAnalyzerView class.

First, since the Logical Link Control frame is a Manage frame (type is '2') and the subtype is each '0', it is written as Table 10 below.

Void CCnCAnyPaLlcAnalyerView :: PacketDecode (UCHAR * pPacket, int nLen) {// Create Analysis Module PFRAME_CONTROL fc = (PFRAME_CONTROL) pPacket 'if (fc-> Type! = 2) return; int i = 24; if (fc-> SubType == 0) PacketDecodeLlc (pPacket + i, nLen-i); }

And declare the function in the header file of View as Table 11.

// Operation public: void PacketDecode (UCHAR * pPacket, int nLen); void PacketDecodeLlc (UCHAR * pPacket, int nLen);

Here, void PacketDecodeLlc (UCHAR * pPacket, int nLen); is a Logical Link Control analysis function.

Therefore, when the training program is executed, the analyzed contents of the Logical Link Control can be confirmed as shown in FIG. 49B.

Therefore, the present invention is a harmful site or user extracted by using a network management system, a network management station (NMS) and an analyzer essential for analyzing, researching, managing, and optimizing a WLAN system and a network for providing a WLAN service. It is an integrated device that consists of Net Tool used for firewall, maintenance installation operation, and education products that provide WLAN technology and WLAN analyzer design and development process.

That is, a protocol decoder product that collects packets generated from wireless LAN nodes such as 802.11 a / b / g / e / f / i / m / n, analyzes basic protocol headers and data, and displays detailed information (Product or Module). And Net Tool, a product to check the status of the system, automatically search for the IP address and name, track the route, and provide information on the communication network as a tool for managing the wireless LAN (network) network. Signal, Noise, Though put, communication speed (Byte / Sec, Packet / Sec, Error / Sec, etc.), connection status, protocol amount and ratio, connection status and other information WLAN network management products (Module) and WLAN protocols that strongly support network management by displaying charts and data in the form of graphs (circular, bar, linear, point, staircase, etc.) Analysis equipment Based on the data and information obtained through the NetTool and WLAN management and optimization products, you can block users or sites, allow access, provide QoS according to user grades, and control the flow of packets and data. Provides a blocker or firewall product that can be controlled according to the input.

Basic theory verification and implementation practice using WLAN protocol analysis equipment and educational products, protocol analysis related to WLAN, and real-time collected or stored protocol data using Protocol Tester or Simulator, and hex or ASCII analysis is input and entered into Protocol Tester. If you pass the step of designing and producing analysis module in high-level languages such as C, C ++, Visual C, etc., if you are 100% correct, you can design and manufacture analyzer or simulator, blocker manufacturing, traffic generator design directly in wireless LAN environment. By providing integrated wireless LAN protocol analysis equipment, which supports the educational package for practical training, users can identify, solve and optimize network problems, and cultivate and educate all core technologies. Powerful, Convenient Integrated WLAN Protocol Analyzer A.

As described above, preferred embodiments according to the present invention have been described, but the present invention is not limited to the above-described embodiments, and the present invention is not limited to the scope of the present invention as claimed in the following claims. Anyone with knowledge of the present invention will have the technical spirit of the present invention to the extent that various modifications can be made.

As described in detail above, the present invention proposes an efficient packet collection and delivery method for all WLAN channels by appropriately responding to a flexible WLAN environment, thereby automating the channel analysis and setting process for the WLAN packet collection, Minimizing the loss of WLAN packet in LAN packet collection and delivery, it provides the data for accurate WLAN analysis.

In addition, the present invention proposes a solution to a network problem that is expected to be related to a method and diagnostics related to WLAN protocol analysis, allows an administrator to solve the above problem quickly, and enables other users to efficiently operate the WLAN service. It is effective to use.

In addition, the present invention relates to a method for practicing a wireless LAN protocol. After practicing a protocol using a protocol tester, a method for practicing a protocol using VC ++ is presented, and an effective wireless LAN protocol can be practiced.

Claims (10)

An apparatus for analyzing a WLAN system for providing a WLAN service, the apparatus comprising: A protocol decoder which collects packets generated in a WLAN node such as 802.11 a / b / g / e / i / n / m and displays information by analyzing protocol summary based on a basic protocol header; A tool for managing the WLAN network, a net tool for checking a system status, automatically searching for an IP address and a name, tracking a route, and providing information on a communication network; Network management information which provides information for network management by displaying packet and channel information in a chart form and a graph form; Wireless LAN protocol analysis equipment, characterized in that not only provide network management, protocol analysis, but also integrated support for education package for data communication practice. The method of claim 1, The protocol decoder includes a decoder, a node, a protocol, a summary channel, a signal, a signal, a matrix, and a log. LAN protocol analysis equipment. The method of claim 1, The net tool is a WLAN protocol analysis equipment, characterized in that consisting of Ping, IP Scan, Trace Route, DNS Lookup, Domain information. In an analytical method that identifies and resolves network problems, The first step of analyzing the received packet on the channel set to diagnose the network according to the 802.11 a / b / g / e / i / n / m standard and displaying the Retransmitted bit and the Fragment bit in the frame control field ; A second step of determining affiliation status of corresponding network nodes by calculating MAC, BSSID, and ESSID of the received packet; A third step of identifying a type of a packet transmitted in a corresponding network through type analysis of the received packet; Based on the calculation of the destination and destination of the network nodes, the node is displayed as 'dot' and the connection is represented as 'line' for free viewing after analyzing the node connection status. A fourth step of identifying the connection / communication status of the nodes; Total packets per channel, Management packets / bytes, Control packets / bytes, Data packets / bytes, FromDS, ToDs, Maximum signal strength / dBm, Maximum noise strength / dBm, Minimum signal strength / dBm A fifth step of identifying bandwidth usage per channel by displaying minimum noise strength / dBm, current signal strength / dBm, current noise strength / dBm, number of packets / bytes for each DataRate, and time; Displaying a signal and noise in the form of a graph per channel to determine signal strength and noise strength for each channel; A seventh step of receiving only a desired packet through setting of a function of generating a packet to affect the WLAN network; WLAN protocol analysis method consisting of. The method of claim 4, wherein In the first step of 802.11 a / b / g / e / i / n / m packet analysis method, A first step of analyzing and displaying the received packet by destination, transmission source, length, BSSID, type, sieve type, channel, signal level, noise level, transmission rate, presence or absence of WEP, and time; A second step of displaying the packet as a nucleus value and an ASCII value when one packet is selected from the packets listed in the first step; A third step of analyzing the packet selected in the first step according to an 802.11 a / b / g / e / i / n / m standard format; A fourth step of displaying the data analyzed in the third step so that the user can easily grasp the proper format in a tree form; A fifth step of matching and displaying the nucleus value and the ASCII value of the second step when the detailed field of the packet is selected in the fourth step; A sixth step of determining that occurrence of the Retransmitted and Fragment fields in the data analyzed in the third step is a result of interference when the occurrence of the retransmitted and fragment fields is more than 10 times; If it is determined that the result of the interference is a result of the sixth step, a seventh step of searching for an area where the frequency of occurrence of retransmission and fragmentation does not occur by changing the location of the node equipped with the wireless LAN protocol analyzer; WLAN protocol analysis method comprising a. The method of claim 4, wherein In the analysis method for identifying the belonging state of the network nodes of the second step, A first step of deriving a relationship between an ESSID, a BSSID, and a MAC through an operation flowchart; A second step of displaying the data derived in the first step in a tree form in a convenient and suitable format; A third step of determining that there is a problem in the efficiency of the AP when there are 40 or more nodes belonging to one AP displayed in a tree form in the second step; WLAN protocol analysis method comprising a. The method of claim 4, wherein In the method of identifying for each type of packet transmitted in the network in the step 3, Deriving a type and a subtype of the transmitted packet and displaying the packet in a tree form; A second step of determining that there is a problem in the threshold value of the node if the occurrence of the RTS / CTS occurs more than 10 times before and after the packet in the first frame; A third step of solving the problem by setting a threshold value of the corresponding node of the second step to 2048; A fourth step of determining that the AP to which the node belongs is absent if more than 10 Probe Requests appear in the corresponding node in the second step; A fifth step of removing the occurrence of a probe request by attaching the corresponding node to another AP if it is determined that the AP of the fourth step is absent; WLAN protocol analysis method comprising a. The method of claim 4, wherein In the method for setting packet reception in the seventh step, Generating a packet to confirm the performance of the AP and the node based on 802.11 a / b / g / e / i / n / m; A second step of checking the performance of the AP and the node by generating a packet of a 'search request', 'authentication request', affiliation request ', and' withdrawal request 'for the packet generated in the first step; A third step of setting packet reception as a channel after the second step; A fourth step of setting packet reception to a transmission rate after the second step; A fifth step of setting packet reception to a signal dBm after the second step; A sixth step of setting packet reception to noise dBm after the second step; A seventh step of setting packet reception to WEP after the second step; An eighth step of setting packet reception to an IP of a destination and a destination after the second step; A ninth step of setting packet reception to a source and destination MAC address after the second step; A tenth step of setting packet reception to a port of a destination and a destination after the second step; An eleventh step of setting packet reception to data at a desired position after the second step; A twelfth step of setting the packet size after receiving the packet in the third to eleventh steps; WLAN protocol practice education method comprising a. In the practice for the wireless LAN protocol, A first step of practicing a protocol using a protocol tester; A second step in which the training program of the first step brings the packets actually captured by the wireless LAN protocol analyzer; A third step of writing an analysis routine in accordance with the 802.11 a / b / g / e / i / n / m format in a training program using VC ++ using the captured packet in the second step; WLAN protocol practice education method consisting of. The method of claim 9, The protocol practice content of the first step is '802.11 MAC', 'Beacon', 'Probe Request', 'Probe Response', 'Authentication', 'Association Request', 'Association Response', 'Logical Link Control' WLAN protocol practice method.

Images