| 摘要: | P2P(Peer-to-Peer)軟體為點對點通訊傳輸工具，可讓使用者直接連接到其他世界各地任何地方的使用者電腦，進行文件的共用與交換。由於P2P軟體執行時經常佔用不少頻寬，傳輸的檔案可能夾帶病毒使電腦被病毒感染，或被使用者利用來傳輸非法軟體或檔案。目前的網路設備雖有日誌檔(Log File)供管理者查詢，但大多僅能提供事後調查而非即時監控功能。因此本研究利用頻寬控制設備-AceNet來瞭解淡江大學P2P使用行為並透過安全營運中心(Security Operation Center)-ArcSight系統建立一個即時監控平台提供管理者即時監控P2P的使用情形。本研究發現淡江大學最常使用的P2P軟體為BT、PPStream、ClubBox與eDonkey軟體。BT軟體由於能提供使用者互相傳輸較新的檔案，因此為使用人數最多的軟體。各P2P軟體連線次數與每連線數的流量是相對的，連線次數高的軟體，每連線數流量就低，每連線數流量較低，可減少使用者上傳的負荷，但是相對地使用者硬碟存取頻率就會提高，容易讓硬碟損壞。在流量部份，學校的流量主要由某些單位所佔用，某些單位的流量主要由某一個或兩個IP(Internet Protocol)所佔用。在週流量分析部份，週末流量較高於星期三或四，主要是少數IP在週末進行全速掛載P2P軟體。透過即時監控平台，提供管理者觀察P2P的使用情形，包含每日主機個數、使用者的IP與每週P2P使用排行，讓管理者針對單位或個別IP直接監控與調查。
P2P (Peer-to-Peer) software tool for peer-to-peer communication and transmission that allow users directly connect to other’s computer with sharing and exchanging files all over the world. As a result of the implementation of P2P software often occupy a lot of bandwidth. The transmission of the files with virus may infect other’s computer. User could transfer illegal software or files through the internet. Although the log files in the current network equipments supply the manager with information, the log file can only provide posterior investigation but not the real-time monitor. In our research, we apply AceNet, a kind of bandwidth controlling equipments, to recognize the user’s behavior in Tamkang University, and establish a management platform that provide real-time monitor the state of the use of P2P. In this case, we found that the most commonly used P2P software are BT, PPStream, ClubBox and eDonkey. BT software provides users with each other due to transfer newer files, so for the largest number of use. The number of the P2P software to connect the number of each flow is relative. Such as, the higher the number of connect, the lower the number of data-flow in each connect. On the one hand the lower number of connections can reduce the load of users upload, on the other hand the user’s hard disk access frequency will be increased easily damage the hard disk. In the flow part, the main flow of the school occupied by certain departments and the flow of these departments are primarily occupied by one or two IP (Internet Protocol). In the weekly traffic analysis, we found that the traffic of weekend is higher than the traffic of Wednesday or Thursday. The main reason is a small number of IP at the weekend in full swing mount P2P software. the real-time monitoring platform provide managers to observe the use of P2P, including daily number of hosts, the user''s IP and weekly top P2P use, so that managers can directly monitor and investigate on individual departments or IP. |
