在 Linux 系统上出于学术目的模拟“类似服务器”的端口活动（仅限软件端口）
我正在研究一种算法，监控软件端口的行为，并相应地通过电子邮件向用户发送有关可疑活动的通知。
该项目分为三个部分：
1.创建或者更确切地说，我所说的模拟计算机端口上的大量活动。
2. 监视此端口活动并使用我的算法来确定可疑活动。
3.通过电子邮件向用户发送我的结论。
由此看来，我在模拟系统上许多软件端口上的大量活动时遇到了问题。基本上我需要原始数据来处理。我的意思是我的算法首先需要大量的端口活动！现在我自己没有生产服务器！那么我如何（在某种程度上）在我的小型桌面上复制或模拟大型服务器的端口活动？当然;实际上，我并不需要实际运行数百个网站，只需要足够的软件端口活动来让我的算法获得足够的数据来处理......有什么想法吗？
I am working on an algorithm that monitors the behavior of software ports and accordingly sends notifications to the user about suspicious activity through email.
This projects moves forward in 3 parts:
1. Creating or rather what I am calling simulating a lot of activity on my computers ports.
2. Monitoring this port activity and using my algorithm to determine suspicious activity.
3. Sending email to the users with my conclusions.
From this, I am having problem with simulating lots and lots of activity on a number of software ports on my system. Basically I need raw data to work with. I mean my algorithm is going to need a large amount of port activity in the first place! now i do not have a production server for myself! So how do i (sort of) replicate or simulate the port activity of large scale servers on my puny desktop ? Of course; I actually don't need to actually run hundreds of websites, just need enough software port activity to get my algorithm enough data to work with .. any ideas people?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不知道我是否完全理解您的需求。 “模拟”可以从两个方面来思考。尽管如此，这就是答案。
您的应用程序的设计是什么？如果是“直接”（或“天真”），即检查机器上的实际端口并随后执行操作，那么模拟它的问题就在于这种设计。
（其余部分基于这个假设）
您应该让您的设计更加模块化，消除耦合和分离关注点。
您的应用程序中基本上存在三个问题：监视物理端口，根据逻辑端口的活动（此处为分离）做出决策，最后，通知行为（发送电子邮件） / 任何）。
这些部分中的每一个都应该是独立的。可按原样进行测试，无需应用程序的其他部分。
该设计的结果：简单的模拟。对于“模拟”部分，您只需要模拟第二个关注点，而不是第一个关注点。
可能的解决方案：在我前一段时间工作的公司，他们正在做低级网络重型应用。他们非常成功地使用黑板。他们在黑板上写满了与网络相关的事件，代码对这些事件做出反应，可能会生成新的事件，然后将其带回硬件。这可以优雅地让他们在各种网络操作场景（例如插入/移除网卡等）中测试应用程序，而无需实际痛苦地尝试模拟它。
如果您的问题是尝试真正模拟端口上的物理活动，有人可能会建议一些白帽“模拟攻击”产品/服务。您可能需要第二台计算机来从外部发出网络活动（因为您可能会区分本地主机活动和外部网络活动）。
I don't know if I understand your needs perfectly. "Simulating" can be thought of in two ways. Nevertheless, here is the answer.
What is the design of your application? If it is "straightforward" (or "naive"), that is, you check the actual ports on the machine and do the action afterwards, than the problem of simulating it lies in this design.
(The rest is based on this assumption)
You should have your design much more modularized, removing coupling and separating concerns.
There are basically three concerns in your application: monitoring physical ports, making decision based on the activity of logical ports (here, the separation) and finally, notification behaviour (sending emails / whatever).
Each of these parts should be self-contained. Testable as-is, without need for the other parts of the application.
Result of this design: trivial simulation. For the "simulation" part, you only need to simulate the second concern, not the first.
Possible solution: in the company I worked some time ago, they were making low-level network heavy application. They used blackboard very successfully. They filled the blackboard with network-related events, and the code reacted to these events possibly generating new ones which were then taken back to the hardware. This elegantly let them to test application in various scenarios of networking action (like inserting/removing network card etc.) without actually painfully trying to actually simulate it.
If your question was trying to really simulate physical activity on ports, someone can probably suggest some white hat "simulating attack" products/services. You would need second computer probably to issue the network activity from outside (because you probably discriminate localhost activity from outside network activity).