Formal design of packet filtering systems

Abstract

Observing network traffic is necessary for achieving different purposes such as system performance, network debugging and/or information security. Observations, as such, are obtained from low-level monitors that may record a large volume of relevant and irrelevant events. Thus adequate filters are needed to pass interesting information only. This work presents a filtering mechanism that acquirs the intersting packets from the underlying network due to the user specifications. The packets are acquired according to specific grammar rules, and they are preserved in an observation file called log-file.