Network traffic monitoring

摘要

A network traffic monitoring method includes generating packet information for packets destined for a target subnet. The method includes identifying network connections associated with an application running on a device based on socket activities performed by the application. The method further includes filtering out network traffic information between the application and the target subnet based on the identified network connections and the packet information.

主权项

1. A network traffic monitoring method, comprising:
generating packet information for packets destined for a target subnet; inserting breakpoint triggers into an application to detect socket activities performed by the application and by sub-processes of the application at the target subnet; identifying network connections associated with the application running on a device, based on the socket activities performed by the application; aggregating an amount of network traffic information by identifying an amount of incoming traffic and an amount of outgoing traffic that has passed between the application and the target subnet based on the identified network connections and the packet information, the aggregating ignoring network traffic between other applications running on the device and devices in other subnets; and estimating an expected cost of the aggregated amount of network traffic information attributed to the application and the target subnet.