Design and Implementation of System for Supervising Worm Virus Based on NetFlow
Pingshui Wang · Computer Technology and Development · 2007
NetFlow is one kind of layer 3 switch technologies which is used in switch and route system of Cisco.The NetFlow service can provide the detailed data stream statistics information about the address,the protocol,the port and the service type and so on.Using the tools such as Flow-tools to analyze the data stream of NetFlow,it is easy to discover the IP addresses of virus-infected computers,since the worm virus can initiate massive scanning connection during their spreading process.Using SNMP,the switch ports linked with the computers which use these IP addresses can be located and the virus-infected computers can be isolated from the network by closing the corresponding switch ports.At the same time the recorded detailed information of the contamination computers may help administrator to deeply analyze and process.