JP2000278265A - Method and system for generating network model - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system which generates a network model denoting a network configuration and traffic information delivered thereto by taking consistency only from a plurality of sets of traffic information in the same time zone collected from each segment of the network model. SOLUTION: A traffic collection device 100 records information and time relating to packets collected as traffic information, collects packets synchronously with the time for each segment and transmits them to a network model generator 200. The network model generator 200 calculates traffic volume between segments, estimates a path to which the traffic is delivered on the basis of the time when the packet is collected at each segment, estimates the information of segments at the outside of an object of traffic collection by interpolating the topology with each network address of each packet to generate a network model.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention generates a network model in which a network configuration and traffic information flowing therethrough are collected from only a plurality of pieces of traffic information in the same time zone collected from each segment of a network with consistency. The present invention relates to a method and a system for generating a network model.

[0002]

2. Description of the Related Art An information communication network is basically composed of nodes (computers constituting a network, network devices having a switching function and a concentrating function) and links (communication lines connecting the nodes). This logical connection between nodes and links is called a network topology. In an example in which a plurality of LANs are interconnected, there may be a hierarchical structure in which relay is performed by a gateway and a WAN. In this case, reliability, confidentiality,
An optimal topology is determined in consideration of operability, economy, and the like. Further, the transmission speed of the line and the number of lines are determined from the amount of traffic to be processed. Optimal Networks is a representative system for generating the above network model.
There is Optimal Performance provided by the company. This network model generation system converts the topology model
Generates traffic models from topology information obtained by Optimal Surveyor and creates traffic models from Network General's Sniff
Generated from traffic information obtained by er.

[0003]

However, according to the above-mentioned prior art, there is a problem that traffic information measured in a plurality of observation target segments cannot be accurately integrated. The reason is that the time at which traffic is collected in each segment does not match. There is also a defect that the network model generated from the topology information and the traffic information is not uniform. This is because the information sources of the topology information and the traffic information are different. The present invention has been made in view of the above circumstances, and uses only a plurality of pieces of traffic information of the same time zone collected from each segment of the network to match a network configuration and a network model that summarizes traffic information flowing therethrough. An object of the present invention is to provide a method and system for generating a network model, which can extract statistical information on traffic volume strictly by generating the information, and can estimate information on a route on which traffic flows and segment information outside of traffic collection targets.

[0004]

According to the method of generating a network model of the present invention, a traffic collection device is installed in each target segment of a network and collects traffic information for each segment, and a network model is generated from the collected traffic information. In a network model generation system comprising a model generation device, information and time relating to packets collected as the traffic information are recorded, and packets are collected by synchronizing the time of each segment to calculate the traffic amount between segments. , Based on when packets were collected in each segment,
It is characterized in that a network model is generated by inferring information on segments that are not traffic collection targets by complementing the topology from the network address of each packet. Further, a plurality of traffic information collection devices installed in each target segment of the network, previously synchronizing the time with another traffic collection device, recording and transmitting information on collected packets and the collected time as traffic information, From a network model generation device that notifies a plurality of traffic information collection devices of a start time and a stop time of traffic information collection and generates a network model from a topology model and a traffic model generated only by traffic information collected within the time. Used in a network model generation system comprising: receiving and recording traffic information collected from each of the traffic collection devices; and setting a network address of a transmitting / receiving node of a packet included in the received traffic information. When a network address outside the target segment is described, a topology model outside the target segment is complemented from the address to generate a topology model, and each packet is generated from the received traffic information. By determining the route through which packets pass by comparing the collection times of the packets, calculating traffic statistics by paying attention to the sending and receiving nodes of each packet, generating a traffic model, and generating a network model from the generated topology model and network model It is also characterized by generation.

The network model generation system of the present invention is installed in each target segment of the network, synchronizes the time in advance with another traffic collection device, and records and transmits information on collected packets and the collected time as traffic information. A plurality of traffic information collecting devices to notify the start and stop times of the traffic information collection to the plurality of traffic information collecting devices,
A network model generation system comprising a topology model generated only by traffic information collected within the time and a network model generation device for generating a network model from the traffic model, wherein the traffic information collected from each of the traffic collection devices And a traffic information acquisition unit in the network model generation device for receiving and acquiring the network information, and a network address of a transmitting / receiving node of a packet included in the received traffic information to form a topology of the entire network, and a network address outside the target segment. Is described, the topology generation means in the network model generation apparatus for generating a topology model by complementing the topology outside the target segment from the address, and the received traffic A traffic generation in the network model generation device, which determines a route through which the packet passes by comparing the collection time of each packet from the information, calculates a traffic statistic by paying attention to the transmission / reception node of each packet, and generates a traffic model Means, and a network model generating means in the network model generating apparatus for generating a network model from the topology model and the network model generated by the topology generating means and the traffic generating means, respectively. The traffic information collection device has a time synchronization unit for synchronizing the time according to a predetermined protocol, a timer unit for receiving and counting the traffic collection start and stop times notified from the outside, and the notified traffic collection start time. A traffic recording unit that starts collecting traffic information and records each collected packet as traffic information together with the collection time until the notified end time is reached, and traffic communication that transmits the collected traffic information to the network model generation device Consisting of means.

[0006] In the above-described configuration, the traffic collection device installed in each target segment of the network synchronizes the time with the time of another traffic collection device in advance by time synchronization means. The network model generation device notifies each traffic collection device of the traffic collection start / end time, and receives traffic information from each traffic collection device. Traffic information includes
The information on the collected packets and the collected time are recorded together. The network model generation device uses a topology generation unit to generate a network address / transmission address of a transmission / reception node of packet information included in the received traffic information.
The topology of the entire network is configured based on the physical address, and when the network address outside the target segment is described, the topology outside the target segment is complemented from the address to generate a topology model. Then, the traffic generation means determines the route through which the packet passes by comparing the collection time of each packet from the traffic information, and pays attention to the transmission node (or reception node) of each packet information to calculate the accurate statistics of the traffic volume. Calculate and generate traffic models from them. The network model generation means generates a network model 304 from the topology model and the traffic model. In this way, it is possible to generate a topology model and a traffic model from the same information source, that is, traffic information of the same time zone in each target segment of the network, and to generate a consistent network model.

[0007]

FIG. 1 is a block diagram showing an embodiment of the present invention. The network model generation system of the present invention includes a plurality of traffic collection devices 100 installed for each target segment, and only one network model generation device 200. Traffic collection device 10
0 indicates time synchronization means 101, timer means 102, traffic recording means 103, and traffic communication means 1
04. The network model generation device 200
It includes a traffic information acquisition unit 201, a topology generation unit 202, a traffic generation unit 203, and a network model generation unit 204.

The time synchronizing means 101 in the traffic collecting apparatus 100 has a function of synchronizing the time of the traffic collecting apparatus 100 with the time of another traffic collecting apparatus.
In accordance with the traffic collection start time and the traffic collection end time notified from the traffic information acquisition unit 201 of the network model generation device 200, the command to start and end the collection is given. Traffic recording means 1
03 collects and records the traffic information of the segment according to the instruction of the timer means 102. The traffic communication unit 104 has a function of transferring the recorded traffic information to the traffic information acquisition unit 201 of the network model generation device 200. The traffic information acquisition means 201 in the network model generation device 200 notifies the traffic collection device 100 of the traffic collection start time and the traffic collection end time, and receives traffic information from the traffic collection device 100. The topology generation unit 202 generates a topology model from the traffic information 1 to n collected by the traffic collection devices 1 to n. The traffic generation unit 203 generates a traffic model from the traffic information 1 to n. The network model generation means 204 generates a network model from the topology model and the traffic model.
The traffic information 301 includes a network address of the target segment and packet information. Here, the packet information indicates detailed information of each packet, and includes information on a collection time, a network address / physical address of a transmitting node, a network address / physical address of a receiving node, and a packet size. Topology model 30
2 includes intra-segment topology information. Here, the intra-segment topology information includes node information of the target segment. The node information includes a network address and a physical address of a node in the segment. The traffic model 303 includes a transaction model. Here, the transaction model represents the flow of data between the sending node and the receiving node, and includes sending node information, receiving node information, route information, and statistical information indicating traffic volume. The network model 304 includes a topology model and a traffic model.

FIGS. 2 to 6 are views cited for explaining the operation of the embodiment of the present invention shown in FIG.
A traffic information acquisition unit 201 in the traffic collection device 100, the network model generation device 200,
Topology generating means 202, traffic generating means 20
3. Flow chart of the operation procedure of the network model generation means 204.

The operation of the embodiment of the present invention shown in FIG. 1 will be described below with reference to the flowcharts of FIGS. The overall operation will be described first. First, a traffic collection request is notified from the traffic information acquisition means 201 in the network model generation device 200 to each traffic collection device 100. Each traffic collection device 100 transmits the traffic information collected according to the notified time to the traffic information acquisition unit 201. The network model generation device 200 that has received the traffic information generates a topology model with the topology generation unit 202, generates a traffic model with the traffic generation unit 203, and generates a network model with the network model generation unit 204.

In the traffic collecting apparatus 100, an NTP (Network Time Protocol) is set in advance.
l) and the like, each traffic collection device 100
The time between them is synchronized (step A1 in FIG. 2). Then, the traffic collection start / end time notified from the network model generation device 200 is received as data (step A2). When the notified traffic collection start time comes, traffic information collection is started (step A3). Each collected packet information is recorded in the traffic information together with the collection time, and when the notified traffic collection end time comes, the collection of the traffic information ends (step A4). Then, the collected traffic information is transmitted to the network model generation device 200 (step A5).

The traffic information acquisition means 201 of the network model generation device 200 first registers a traffic collection device of each segment of the target network (step B1 in FIG. 3). Next, a collection start time and a collection end time of the traffic are set (step B).
2). The set traffic collection start / end times are notified to the registered traffic collection devices (step B3). Then, the traffic information collected from each traffic collection device is received (step B4) and recorded (step B5).

Then, the topology generating means 202 extracts the traffic information i (1 ≦ i ≦ n) obtained from each of the traffic collection devices 1 to n one by one (step C1 in FIG. 4), and obtains the network address i of the target segment i.
Is obtained (step C2). Then, packet information is extracted one by one from the traffic information i (step C3), and information on the transmitting node and the receiving node is extracted (step C4). The extracted network address of the node is compared with the network address i of the target segment i acquired in step C2 to determine whether the node is a node of the segment i or a node outside the segment (step C2).
5). In the case of the node of the segment i, if the local node is not registered in the intra-segment topology information i, it is registered (step C6). For nodes outside the segment,
If the network address of the node is not registered in the extra-segment topology information, it is registered (step C7), and if the physical address of the node is not registered in the gateway information, it is registered (step C8). When processing of all packet information included in the traffic information i is completed,
The physical address of the node registered in the gateway information is searched from the node information of the intra-segment topology information i and registered as a gateway (step C9). When all the traffic information has been processed, all the nodes registered in the extra-segment topology information are searched from the network addresses of the nodes for the existence of intra-segment topology information 1 to n in which the node is to be registered. . If the corresponding intra-segment topology information exists, the node is registered in the intra-segment topology information. If the corresponding intra-segment topology information does not exist, a new intra-segment topology information is created, and the dummy gateway node information is created. And the node information of the node are registered to complement the topology model (step C10).

Further, the traffic generating means 203 extracts packet information from all the traffic information 1 to n obtained from each traffic collection device one by one in chronological order (steps D1 and D2 in FIG. 5). The network address information of the target segment is obtained from the described traffic information (step D).
3) Extract information on the transmitting node and the receiving node (step D4). The extracted network address of the transmitting node is compared with the network address acquired in step D3, and it is determined whether the transmitting node is a local transmitting node existing in the segment or a transmitting node outside the segment (step D5). In the case of packet information having a local transmission node, if the transaction model of the packet information is not registered in the traffic model, the packet information is registered to create routing information and statistical information, and if registered, the statistical information is updated (steps D5 and D5). D6). In the case of packet information having a transmission node outside the target segment, if the transmission node of the packet information does not exist in any of the target segments specified in step B1 shown in FIG. 3, the transaction model of the packet information is If registered, register to create route information and statistical information, and if registered, update statistical information (steps D7 and D7).
6). When the transmission node of the packet information exists in any of the target segments specified in step B1 of FIG. 3, the corresponding transaction model in the traffic model is searched, and the route information is corrected (steps D7 and D8). . Then, the same process is repeated for all packet information to generate a traffic model.

Finally, the network model generating means 20
In FIG. 4, first, transaction models are extracted one by one from the traffic model (step E in FIG. 6).
1). The transmission node and the reception node of the transaction model are mapped to the topology model (step E
3). Then, each relay node of the route information of the transaction model is mapped to the topology model (step E4). Then, the same process is repeated for all transaction models to generate a network model.

In the above-described embodiment, the traffic generating means 203 whose operation procedure is shown as a flowchart in FIG. 5 has been described focusing on the transmitting node of the traffic. FIG. 7 is a flowchart. Except for changing the operation procedure, the configuration and the operation of the other blocks are the same as those already described.

The operation of another embodiment of the traffic model generating means 203 will be described below with reference to the flowchart shown in FIG. First, packet information in all the traffic information 1 to n obtained from each traffic collection device is extracted one by one in chronological order (steps F1 and F2 in FIG. 7), and from the traffic information in which the packet information is described, the target segment is extracted. Network address information is acquired (step F3), and information on the transmitting node and the receiving node is extracted (step F4). By comparing the extracted network address of the receiving node with the network address acquired in step F3, it is determined whether the receiving node is a local receiving node existing in the segment or a receiving node outside the segment (step F5). In the case of packet information that has a local receiving node in the target segment, if the transaction model of the packet information is not registered in the traffic model, register it to create routing information and statistical information, and if registered, update the statistical information (Steps F5 and F6). In the case of the packet information of the receiving node outside the target segment, if the receiving node of the packet information does not exist in any of the target segments specified in step B1 of FIG. 3, if the transaction model of the packet information is not registered If it is registered, it creates route information and statistical information, and if registered, updates the statistical information (steps F7 and F6). If the receiving node of the packet information exists in any of the target segments specified in step B1 of FIG. 3, the corresponding transaction model in the traffic model is searched, and the route information is corrected (step F).
7 and F8). Then, the same processing is repeated for all pieces of packet information.

As described above, the present invention provides a network including a traffic collection device installed in each target segment of a network and collecting traffic information for each segment, and a model generation device for generating a network model from the collected traffic information. In the model generation system, information and time relating to the packets collected as the traffic information are recorded, and by collecting the packets by synchronizing the time of each segment, the traffic amount between the segments is calculated, and the packets are collected in each segment. In addition to estimating the path through which traffic flows based on the specified time, the network model is generated by estimating information on segments that are not targeted for traffic collection by complementing the borology from the network address of each packet. Accordingly, a network model in which the network configuration and the traffic information flowing therethrough can be generated consistently from only a plurality of pieces of traffic information of the same time zone collected from each segment of the network. A mechanism can be provided.

[0019]

As described above, according to the present invention, since packets are collected by synchronizing the time for each segment, statistical information on traffic volume in traffic information between segments can be strictly extracted. In addition, since the exact time at which each packet was collected is obtained, the path through which traffic flows can be estimated based on the time at which the packet was collected in each segment. Furthermore, since the information sources of the traffic model and the topology model that make up the network model are the same, a consistent network model can be generated. Information can be inferred.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention.

FIG. 2 is a flowchart showing an operation procedure of the traffic collection device in FIG.

FIG. 3 is a flowchart showing an operation procedure of a traffic information collecting unit in the network model generation device.

FIG. 4 is a flowchart illustrating an operation procedure of a topology generation unit in the network model generation device.

FIG. 5 is a flowchart showing an operation procedure of a traffic generation unit in the network model generation device.

FIG. 6 is a flowchart showing an operation procedure of a network model generation unit in the network model generation device.

FIG. 7 is a flowchart showing an operation procedure of another embodiment of the traffic generation means in the network model generation device.

[Explanation of symbols]

100: traffic collection device 1 to traffic collection device n, 101: time synchronization means, 102: timer means, 1
03: traffic recording means, 104: traffic communication means, 200: network model generation device, 201
... Traffic information acquisition means, 202 ... Topology generation means, 203 ... Traffic generation means, 204 ... Network model generation means, 301 ... Traffic information 1 to traffic information n, 302 ... Topology model, 303 ...
Traffic model 304: Network model.

Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat II (reference) H04M 3/36

Claims (9)

[Claims] 1. A network model generation system comprising: a traffic collection device installed in each target segment of a network for collecting traffic information for each segment; and a network model generation device for generating a network model from the collected traffic information.
The information and time relating to the packets collected as the traffic information are recorded, and the amount of traffic between segments is calculated by synchronizing the time of each segment and collecting the packets, and the traffic is calculated based on the time at which the packets were collected in each segment. And generating a network model by estimating a route through which the packet flows and estimating information of a segment that is not a traffic collection target by complementing a topology from a network address of each packet. 2. A plurality of traffic collection devices installed in each target segment of the network, preliminarily synchronizing time with another traffic collection device, and recording and transmitting information on collected packets and collected time as traffic information. A network model generation device for notifying the plurality of traffic collection devices of the start and stop times of traffic information collection and generating a network model from a topology model and a traffic model generated only by traffic information collected within the time A network model generation system comprising: a traffic information acquisition unit in the network model generation device for receiving and acquiring traffic information collected from each of the traffic collection devices; and a traffic information acquisition unit included in the received traffic information. The topology of the entire network is constructed based on the network addresses of the sending and receiving nodes of the packets to be transmitted, and if a network address outside the target segment is described, the topology outside the target segment is complemented from the address to generate a topology model. Topology generation means in the network model generation device, determine the route through which the packet passes by comparing the collection time of each packet from the received traffic information,
A traffic generation unit in the network model generation device for calculating a traffic statistic by paying attention to a transmission / reception node of each packet to generate a traffic model; a topology model and a traffic generated by the topology generation unit; A network model generating means in the network model generating apparatus for generating a network model from the model. 3. The traffic collection device receives and counts traffic collection start and stop times notified from the network model generation device, and a time synchronization unit that synchronizes time with another traffic collection device according to a predetermined protocol. Timer means and traffic recording means for starting collection of traffic information when the notified traffic collection start time comes, and recording each collected packet as traffic information together with the collection time until the notified end time, 3. The network model generation system according to claim 2, further comprising traffic communication means for transmitting the collected traffic information to said network model generation device. 4. The traffic information acquisition unit registers a traffic collection device installed in each segment of a target network, sets a collection start time and an end time of the notified traffic, Notifying the registered traffic collection devices of the collected traffic collection start time and end time, and receiving and recording the traffic information collected during the time by each traffic collection device in the memory. The network model generation system according to claim 2, wherein 5. The topology generating means sequentially retrieves traffic information obtained from each traffic collection device and obtains a network address of a target segment, and sequentially retrieves packet information from the traffic information and transmits and receives the packet information from the transmitting / receiving node. Extracting information; comparing the network address of the extracted node with the network address of the obtained target segment; determining whether the node is within the segment or outside the segment; and When the local node is not registered in the intra-segment topology information, the local node is registered, and the physical address of the node is registered if the local node is not registered in the gateway information. Finish processing After searching for the physical address registered in the gateway information from the node information of the intra-segment topology information and registering it as a gateway, after processing all traffic information, Searching for, from the network address of the node, whether or not there is intra-segment topology information in which the node is to be registered, and if the corresponding intra-segment topology information exists, the Registering the node, creating new intra-segment topology information if the corresponding intra-segment topology information does not exist, and registering node information of the dummy gateway to supplement the topology model are programmed and recorded in the memory. thing Network model generation system according to claim 2, wherein. 6. The traffic generating means sequentially extracts packet information in all traffic information acquired from each traffic collection device in time series order,
Acquiring the network address information of the target segment from the traffic information in which the packet information is described, extracting the information of the transmitting node and the receiving node, and comparing the extracted network address of the transmitting node with the acquired network address. Determining whether the packet is a local transmitting node existing in the segment or a transmitting node outside the segment; and in the case of packet information having a local transmitting node, if the transaction model of the packet information is not registered in the traffic model, register it. Creating route information and statistical information, updating the statistical information if registered, and, if the packet information has a transmitting node outside the target segment, all packets for which the transmitting node of the packet information is specified In any of the segments If the transaction model of the packet information is not registered, the step of registering and creating route information and statistical information if the transaction model of the packet information is not registered, the step of updating the statistical information if registered, and the transmission node of the packet information are designated. If it exists in any of the target segments, the corresponding transaction model in the traffic model is searched and the route information is corrected, and the same process is repeated for all packet information to generate a traffic model 3. The network model generation system according to claim 2, wherein? 7. The traffic generating means sequentially extracts packet information in all traffic information obtained from each traffic collection device in time-series order,
Acquiring the network address information of the target segment from the traffic information in which the packet information is described, extracting the information of the transmitting / receiving node, comparing the extracted network address of the receiving node with the acquired network address, Determining whether the receiving node is a local receiving node or a receiving node outside the segment, and if the packet information has a local receiving node in the target segment, register if the transaction model of the packet information is not registered in the traffic model Creating routing information and statistical information, and updating the statistical information if it has been registered; and in the case of packet information of a receiving node outside the target segment, all target segments for which the receiving node of the packet information is designated Exists in any of If you do not, route information transaction model of the packet information is registered, if not registered,
Creating statistics and updating the statistics if registered, and if the receiving node of the packet information is in any of the specified target segments, searching for a corresponding transaction model in the traffic model 3. The network model generation system according to claim 2, wherein a step of correcting the route information and a step of repeating the same processing for all packet information to generate a traffic model are programmed and recorded in a memory. 8. The network model generating means includes: a step of sequentially extracting a transaction model from a traffic model; a step of mapping a transmission node and a reception node of the transaction model to a topology model; and each relay of path information of the transaction model. 3. The network model generation system according to claim 2, wherein a step of mapping nodes to a topology model and a step of repeating the same processing for all transaction models to generate a network model are programmed and recorded in a memory. 9. A plurality of traffic information collection devices installed in each target segment of the network, for synchronizing the time with another traffic collection device in advance, and transmitting information on collected packets and collected time as traffic information; From the network model generation device that notifies the plurality of traffic information collection devices of the collection start and stop times of the traffic information and generates a network model from the borology model and the traffic model generated only by the traffic information collected within the time Used in a network model generation system comprising: receiving and recording traffic information collected from each of the traffic collection devices; and setting a network address of a transmitting / receiving node of a packet included in the received traffic information. Based on the overall network topology, if a network address outside the target segment is described, a topology model is generated by complementing the topology outside the target segment from the address, and each of the topology models is generated from the received traffic information. By comparing the collection times of the packets, the route through which the packets pass is determined, the traffic statistics are calculated by paying attention to the transmission / reception nodes of each packet, a traffic model is generated, and the network model is generated from the generated topology model and network model. Generating a network model.