JP2002077159A - Traffic-monitoring device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a traffic-monitoring device for merging the statistical information of a plurality of physical ports in an IP network. SOLUTION: The traffic-monitoring device comprises a plurality of line- monitoring modules for creating each of a statistical value table for each IP address by monitoring the data of a one-way communication line in the IP network, and a statistical processing module collecting the statistical value table for each of the plurality of IP addresses for statistical processing.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to an IP (Internet Pro
tocol) A traffic monitoring device for monitoring and managing traffic between hosts in a network.

[0002]

2. Description of the Related Art Conventionally, IPs composed of optical fibers, etc.
(Internet Protocol) The network is one-way communication (transmission line Tx, reception line Rx), so when an administrator monitors traffic between hosts, a network monitoring device is connected for each line and individual networks are connected. They collected circuit traffic information and monitored network usage from the data.

[0003]

Since an IP (Internet Protocol) network composed of optical fibers and the like is one-way communication (transmission line Tx, reception line Rx), an administrator monitors traffic between hosts. At this time, the conventional network monitoring device (probe) can monitor only one of the physical ports of the transmission line Tx and the reception line Rx, and therefore IN (transmission), OUT ( (Receive) Only one of the traffic could be monitored and managed.

For this reason, a conventional network monitoring device (probe) uses one IP in an IP network.
To monitor and manage traffic information in both IN (outgoing) and OUT (receiving) directions for an address, the statistics of the transmission line Tx and the reception line Rx are integrated for each address to generate comprehensive traffic information. And the processing on the administrator side becomes complicated. In addition, there is a problem in that statistics using a plurality of lines and a change in a method according to an increase in the number of addresses to be managed are required.

SUMMARY OF THE INVENTION The present invention has been made in view of the above-mentioned conventional problems and circumstances, and can integrate (merge) statistical information of a plurality of physical ports to solve the above-mentioned problems. It is an object of the present invention to provide a traffic monitor device capable of performing the above.

[0006]

In order to solve the above-mentioned problems, a plurality of line monitor modules for monitoring data of a one-way communication line in an IP (Internet Protocol) network and creating a statistical value table for each IP address, respectively. By configuring a traffic monitor device with an integrated processing module that collects a plurality of statistical value tables for each of the IP addresses and performs an integrated process, an integrated (merged) process of statistical information of a plurality of physical ports is performed. Can be. (Claim 1)

[0007] The line monitor module may include an interface processing unit that performs interface conversion of data obtained from the one-way communication line, and may extract an IP packet from the interface-converted data and generate an IP packet for each IP address. A statistical processing unit for each address that creates a statistical value table for each of the above; a module address managing unit that extracts the statistical value table for each of the IP addresses at a constant cycle; By temporarily storing a statistical value table for each IP address and comprising a statistical value storing memory forming an interface with the integrated processing module, data can be managed in both directions without relying on an administrator. (Claim 2)

[0008] In the traffic monitor device,
Address registration information management for the integrated processing module to extract a newly added IP address from the statistical value table for each IP address collected from a plurality of line monitor modules and to create a connection destination registration table for associating the plurality of statistical value tables Unit and a statistical table integration processing unit that creates an integration table in the order of registration in the connection destination registration table, whereby processing can be speeded up.
(Claim 3)

[0009] Further, by using the number of packets and the number of octets as the statistical value for each IP address collected by the line monitor module, the use state of the network can be easily managed. (Claim 4)

In addition, by adding a traffic distribution for each priority and a traffic distribution for each protocol to the statistical value for each IP address collected by the line monitor module, a more detailed management of a network use state can be performed. (Claim 5)

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows a schematic configuration diagram of a traffic monitor device according to an embodiment of the present invention. As shown in FIG. 1, a traffic monitor 1 according to the present embodiment
A plurality of line monitor modules 101a and 101b for monitoring data of a one-way communication line (transmission line Tx, reception line Rx) in an IP (Internet Protocol) network and creating a statistical value table for each IP address,
And an integrated processing module 102 for collecting statistical value tables for a plurality of IP addresses and performing integrated processing.

The line monitor module 10
1a and 101b are unidirectional communication lines (transmission line T
x, receiving line Rx), an interface processing unit 11 for performing interface conversion of data obtained from the interface, and an address-based statistical processing unit 1 for extracting an IP packet from the interface-converted data and creating a statistical value table for each IP address.
2, an in-module address management unit 13 for extracting a statistical value table for each IP address at a constant cycle, and a temporary storage for a statistical value table for each IP address extracted from the in-module address management unit at a fixed cycle. , DPRAM (Dual Por
t RAM) and a memory 14 for storing statistic values.

The integrated processing module 102
Is a new addition from the statistical value table for each IP address collected from the line monitor modules 101a and 101b.
It has an address registration information management unit 15 that extracts a IP address and creates a connection destination registration table that associates a plurality of the statistical value tables, and a statistics table integration processing unit 16 that creates an integration table in the order of registration of the connection destination registration table. I have.

Next, a detailed operation of the traffic monitor device according to the present embodiment will be described with reference to FIGS. Traffic monitor device 1 configured as described above
Has physical ports to a plurality of lines for one-way communication, and pulls data from the respective lines of the transmission line Tx and the reception line Rx to the respective interface processing units 11 in the line monitor modules 101a and 101b. The interface processing unit 11 performs interface conversion of data taken from the line. The interface-converted data is passed to the address-based statistical processing unit 12. The address-specific statistic processing unit 12 extracts an IP packet from the data and performs statistic processing for each IP address in a format as shown in FIG.

As shown in FIG. 2, the source host table
(Source host), destination host table
(Recipient host), Matrix table (Src-Dst matrix)
For each of the above, the number of packets, the number of octets (data in 8-bit units), and other items (eg, traffic distribution by priority, traffic distribution by protocol, etc.)
Perform statistics on In addition to the statistical items, a new flag is prepared to manage the detection of a new IP address.
In the case of a new IP address, the flag is set to “1” and a new addition is notified to the integrated processing module 102.

The statistical table created here (see FIG. 2)
Are transferred to the statistic storage memory (DPRAM) 14 at regular intervals by the in-module address management unit 13.
The statistic storage memory (DPRAM) 14 forms an interface with the integrated processing module 102. The integration processing module 102 collects a statistical table from the statistical value storage memory (DPRAM) 14 of each line monitor module and performs a merge process. In the merging process, the master either module for handling statistics plurality of line monitor module, the other modules as a slave, and integrate from the slave to the master.

In the address registration information management section 15, a statistical table collected from each line monitor module (see FIG. 2)
To extract a new address from. Since these two statistical tables are data acquired from different lines, the order of registration of the IP addresses is not the same. Therefore, the two statistical tables are managed using the connection destination registration table shown in FIG.

The connection destination registration table shown in FIG. 3 is composed of IN (sending) and OUT (receiving) pointers for associating two statistical tables. Master module, I on OUT side
On the N side, the corresponding IP in the slave module statistics table
Register a pointer to the address. When not used, initialize by inserting a pointer (NULL) with a value of zero.

FIG. 4 shows a registration image. When a new address is included in the addresses collected from each line monitor module, the address registration information management unit 15 first searches for a free area (NULL) of the OUT pointer in the connection destination registration table from the new address of the master module. . If an empty area is found, or if the IN side has already been registered, the IP address is compared. If the IP addresses match, a pointer is registered in that area. If they do not match, the same search processing is repeated, and IN
Side does not have the same IP address, there is no registration information (I
N, OUT = “NULL”) Register the pointer in the area.

Next, similarly, the empty area (NULL) of the IN pointer is searched for the new address on the slave side, and if there is an empty area, the IP address is compared with the IP address registered with the OUT pointer. If they do not match, the same search process is repeated, and if the same IP address does not exist on the OUT side, a pointer is registered in a new area.

The address registration information management unit 15 always performs this processing when acquiring the statistical table from each line monitor module, and associates the addresses of the master and slave modules, so that the address search processing becomes unnecessary. The processing can be speeded up. After registering all the new addresses, the statistical table merge processing unit 16 performs a merge process of the statistical data. The merge statistics table is created in the order of registration in the connection destination registration table.

FIG. 5 shows a merge statistics table (merged host table). The merge processing of the host table considers the directionality of the transmission line Tx and the reception line Rx, and in each host table, the source host table address of the transmission line Tx and the destination host table of the reception line Rx are merged. There is a need to. This is because the source address on the transmission line Tx becomes the destination address when viewed from the reception line Rx. (The opposite rule is applied to the destination host table.) The merge processing can simplify control by making the registration row of the connection destination registration table and the row image of the merge statistics table the same.

In FIG. 4, the address A on the transmission line Tx side
Since the transmission packet number Pa1 of 1 is registered on the OUT (transmission) side of the first row of the connection destination registration table, the packet number ou of the first row of the merge host table in FIG.
It is stored at the position t (the position marked Pa1). Similarly, the number Pa3 of received packets at the address A3 on the receiving line Rx side is calculated as IN (reception) in the second row of the connection destination registration table in FIG.
The packet is registered at the position (the position where Pa3 is entered) of the number of packets in the second row of the merge host table in FIG.

FIG. 6 shows a merge image of the matrix table. In the matrix table, basically the same control as the merge processing of the host table is performed, but the direction of the IP address (direction between the source and destination)
Need to be considered. If the address (A → B) is detected on the transmission line Tx, it is detected as an address (B → A) on the reception line Rx. There is a need.

In FIG. 6, the packet Pab of A1 → B1 in the first row of the matrix table on the Tx (master) side is associated with in in the first row and out in the second row of the connection destination registration table, and the Rx (slave) side In the second row of the matrix table
Stored as Pba from B1 to A1.

FIG. 7 shows a merge statistical table (merged matrix table). 7, the packets A1 → B1 merged in FIG. 6 are stored as Pba and Pab in Src → Dst and Dst → Src in the first row of the merged matrix table. The merge statistics table integrates data according to the above rules.

[007]

According to the first aspect of the present invention, an IP (Internet)
Protocol) A plurality of line monitor modules for monitoring data of a one-way communication line in a network and creating a statistical value table for each IP address, and collecting and collecting a plurality of statistical value tables for each of the IP addresses. By configuring the traffic monitor device with the integration processing module, it is possible to perform the integration (merging) of the statistical information of a plurality of physical ports.

Further, in the invention according to claim 2, the line monitor module includes an interface processing unit that performs interface conversion of data acquired from the one-way communication line, and an IP processing unit that converts the interface-converted data into IP data. A statistical processing unit for each address that extracts a packet and creates a statistical value table for each IP address;
An in-module address management unit that retrieves the statistic table for each IP address at a constant cycle, and temporarily stores the statistic table for each IP address that is retrieved at a constant cycle from the in-module address management unit, By configuring with a statistics storage memory forming an interface with the integrated processing module, data can be managed in both directions without relying on an administrator.

[0029] In the invention according to claim 3, in the traffic monitor device, the integrated processing module includes:
An address registration information management unit that extracts a newly added IP address from the statistics table for each IP address collected from a plurality of line monitor modules and creates a connection destination registration table that associates the plurality of statistics tables; By having the statistical table integration processing unit that creates the integration table in the registration order of the registration table, the processing can be speeded up.

[0030] In the invention according to claim 4, the number of packets and the number of octets are set as statistical values for each IP address collected by the line monitor module.
The use state of the network can be easily managed.

In the invention according to claim 5, the statistical value for each IP address collected by the line monitor module is:
Furthermore, by adding the traffic distribution by priority and the traffic distribution by protocol, more detailed management of the network use state can be performed.

Therefore, instead of the conventional two-way traffic monitoring relying on the administrator, it is possible to provide a statistical table in which the traffic in the two directions is fixed by the traffic monitor device alone. Also, instead of merging only the transmission line Tx and the reception line Rx, in statistics using multiple lines,
Data can be integrated using a similar technique.
Even if the number of addresses to be managed increases, there is no need to change the method, so this method can be used for general purposes.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a traffic monitor device.

FIG. 2 is a table showing statistical results processed by the traffic monitor device.

FIG. 3 is a diagram showing a structure of a connection destination registration table.

FIG. 4 is a diagram showing a relationship between Tx (master) and Rx (slave) and a connection destination registration table.

FIG. 5 is a diagram showing a structure of a merge host table.

FIG. 6 is a diagram showing a relationship between a matrix table of Tx (master) and Rx (slave) and a connection destination registration table.

FIG. 7 is a diagram showing a structure of a merged matrix table.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Traffic monitor device 101a, 101b Line monitor module 102 Integrated processing module 11 Interface processing unit 12 Address processing unit 13 Address management unit in module 14 Statistical value storage memory (DPRAM) 15 Address registration information management unit 16 Statistical table integration processing Department

Claims (5)

[Claims] 1. A plurality of line monitor modules for monitoring data of a one-way communication line in an IP (Internet Protocol) network and creating a statistical value table for each IP address, and a plurality of statistical value tables for each of the IP addresses And an integrated processing module that collects data and performs integrated processing. 2. The traffic monitor device according to claim 1, wherein the line monitor module converts an interface of data acquired from the one-way communication line into an interface, and converts an IP packet from the interface-converted data. A statistical processing unit for each address that extracts and creates a statistical value table for each IP address; an internal address management unit that extracts the statistical value table for each IP address at a constant cycle; A statistical value storage memory for temporarily storing the statistical value table for each IP address extracted periodically, and forming an interface with the integrated processing module. 3. The traffic monitoring device according to claim 1, wherein the integrated processing module extracts a newly added IP address from a statistical value table for each of the IP addresses collected from a plurality of line monitor modules, A traffic monitor, comprising: an address registration information management unit that creates a connection destination registration table that associates a plurality of the statistical value tables; and a statistics table integration processing unit that creates an integration table in the order of registration of the connection destination registration table. apparatus. 4. The traffic monitoring device according to claim 1, wherein the statistical value for each IP address collected by the line monitor module includes at least the number of packets and the number of octets. Traffic monitoring equipment. 5. The traffic monitor according to claim 4, wherein the statistical value for each IP address collected by the line monitor module further includes a traffic distribution by priority and a traffic distribution by protocol. Traffic monitoring device.