JP2012074867A - Traffic monitoring system, traffic monitoring method and network management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a traffic monitoring method capable of promptly detecting excess traffic, while suppressing a processing load of each device in a network.SOLUTION: In the traffic monitoring method for monitoring traffic to an arbitrary communication terminal in the network as monitoring target traffic, a first network device 4 accommodating a communication terminal 3 monitors whether or not the amount of traffic flow to the communication terminal 3 exceeds a first alarm threshold. If the first network device 4 decides that the traffic flow amount to the communication terminal 3 exceeds the first alarm threshold, each of the entire network boundary devices 5-1 to 5-2, located at a boundary between a network 6 and an external network, monitors whether or not each traffic flow amount to the communication terminal 3 exceeds a second alarm threshold. Based on the monitoring result, the network device 4 discriminates whether or not the traffic to the communication terminal 3 becomes excess traffic.

Description

  The present invention relates to a traffic monitoring system, a traffic monitoring method, and a network management system, and can be applied to, for example, monitoring whether the amount of traffic flowing in from an external network destined for the same communication terminal is excessive.

  A so-called general network management system (NMS) is such that traffic information is directly transmitted from a network device such as a router or a switch, and traffic analysis is performed based on the received traffic information (Non-patent Document 1). reference). Today, traffic is multimedia traffic such as data, music, and video, and there is much traffic that is required to be supplied to a communication terminal for streaming, and the traffic volume itself tends to be larger than before. For this reason, the input speed to network devices such as routers and switches is very high, such as several tens of Gbps.

RFC3418

  Today, there are millions to tens of millions of subscribers in large networks operated by megacarriers. When analyzing traffic information of such millions to tens of millions of subscribers, the processing performance of network devices and network management systems that relay traffic is exceeded, and there is a dislike that sufficient analysis cannot be performed. For example, in a network device, monitoring the inflow of the monitoring target traffic instructed from the network management system in a situation where the processing load is large even if the input traffic of several tens of Gbps is relayed, the processing performance of the network device There was a dislike over. In addition, for example, even in a network management system, in a situation where there is a large amount of traffic depending on the type of data and the transfer method as in today, the traffic information instructed to the network device to be transferred is likely to be enormous, exceeding the processing performance and sufficient. There was a dislike that could not be analyzed.

  In order to avoid such an inconvenience, it is also conceivable that the network device samples (samples) traffic, and the network management system analyzes such sampled traffic information.

  However, in this case, as seen in a DDoS attack or the like, it is extremely difficult to detect excessive traffic that flows from a plurality of entrances to the network and eventually goes to one target communication terminal. Even if it can be detected, the point in time is late and the communication terminal is already malfunctioning.

  Therefore, there is a demand for a traffic monitoring system, a traffic monitoring method, and a network management system that can quickly detect excess traffic while reducing processing loads on various devices and network management systems in the network.

  According to a first aspect of the present invention, in the traffic monitoring system that monitors traffic to an arbitrary communication terminal in a network as traffic to be monitored, in the first network device that accommodates the communication terminal, a traffic flow rate to the communication terminal is Monitor whether or not the first alarm threshold is exceeded, and monitor whether or not the traffic flow to the communication terminal exceeds the second alarm threshold in each of one or more second network devices. And determining whether or not the traffic to the communication terminal is excessive traffic.

  According to a second aspect of the present invention, in the traffic monitoring method for monitoring traffic to any communication terminal in the network as traffic to be monitored, the first network device accommodating the communication terminal has a traffic flow rate to the communication terminal. Monitoring whether or not the first alarm threshold is exceeded, and determining that the traffic flow rate to the communication terminal exceeds the first alarm threshold in the first network device; Each of the network boundary devices provided at the boundary with the external network monitors whether the traffic flow rate to the communication terminal exceeds the second alarm threshold, and the traffic to the communication terminal is excessive. It is characterized by determining whether or not it is traffic.

  According to the third aspect of the present invention, in the network management system in the network in which monitoring with traffic to any communication terminal in the network as traffic to be monitored proceeds with initiative, the communication terminal is accommodated in the network management system. One network device monitors whether or not the traffic flow rate to the communication terminal exceeds the first alarm threshold, and the monitoring result of the first network device indicates that the traffic flow rate to the communication terminal is first. The traffic flow rate to the communication terminal for each of the network boundary devices provided at the boundary between the network and the external network is Monitor whether the threshold is exceeded, and the traffic to the communication terminal becomes excessive traffic. Characterized in that to determine dolphin not.

  According to the present invention, it is possible to realize a traffic monitoring system, a traffic monitoring method, and a network management system that can quickly detect excess traffic while reducing processing loads on various devices and network management systems in the network.

It is a block diagram which shows the component which concerns on the traffic monitoring system of 1st Embodiment. It is a block diagram which shows the functional structure of the network management system in 1st Embodiment. It is a block diagram which shows the internal structure which concerns on the excess traffic monitoring function of traffic relay apparatuses, such as a network apparatus and a network boundary apparatus in 1st Embodiment. It is a sequence diagram at the time of the monitoring operation of the excess traffic by the traffic monitoring system of 1st Embodiment. It is a sequence diagram at the time of the monitoring operation of the excess traffic by the traffic monitoring system of 2nd Embodiment. It is a block diagram which shows the internal structure which concerns on the excess traffic monitoring function of the network device in 3rd Embodiment. It is a sequence diagram at the time of the monitoring operation of the excess traffic by the traffic monitoring system of 3rd Embodiment.

(A) First Embodiment A traffic monitoring system, a traffic monitoring method, and a network management system according to a first embodiment of the present invention will be described below with reference to the drawings.

(A-1) Configuration of First Embodiment FIG. 1 is a block diagram showing components related to the traffic monitoring system of the first embodiment.

  In FIG. 1, a traffic monitoring system 1 according to the first embodiment includes a network management system (NMS) 2, a network device 4 that accommodates a communication terminal 3, and one or more (see FIG. 1 shows two examples) and network boundary devices 5-1 and 5-2 cooperate to monitor excess traffic.

  The network management system 2 manages the network 6 to which the communication terminal 3 and the network device 4 belong and the network boundary devices 5-1 and 5-2 are arranged at the boundary. The network management system 2 provides traffic information to be monitored and a threshold for alerting to the network device 4 and the network boundary devices 5-1 and 5-2 in monitoring excess traffic. In the case of the first embodiment, as a first stage process, the network management system 2 gives the network device 4 traffic information to be monitored and an alert threshold value to determine whether the traffic is excessive traffic. If it is determined, the process shifts to the second stage process, and the network boundary devices 5-1 and 5-2 are given the monitoring target traffic specifying information and the alert threshold value to determine whether the traffic is excessive traffic.

  The communication terminal 3 is written as the destination terminal of the traffic to be monitored. The communication terminal 3 is an arbitrary type of terminal such as an IP telephone terminal or an information processing terminal having a communication function.

  The network device 4 is written out as a network device containing the communication terminal 3 that finally sends traffic to the communication terminal 3 to the communication terminal 3. The network device 4 corresponds to, for example, a router or a switch, and may be a network boundary device such as a gateway or a gateway router. As described above, the network device 4 determines whether the instructed traffic is excessive traffic under the control of the network management system 2.

  The network boundary devices 5-1 and 5-2 are written as network devices that allow traffic from an external network to flow into the network 6. The network boundary devices 5-1 and 5-2 are, for example, gateways and gateway routers.

  FIG. 2 is a block diagram showing a functional configuration of the network management system 2. The network management system 2 may be constructed as a dedicated device or may be a computer loaded with a program for the network management system. Functionally, the network management system 2 is shown in FIG. Can do.

  The network management system 2 includes a control unit 10 and a database 11. The control unit 10 includes a monitoring target capturing unit 12 that captures information on traffic to be monitored, a first stage monitoring instruction unit 13 that instructs first stage monitoring, and a second stage monitoring instruction unit that instructs second stage monitoring. 14 and a restriction processing unit 15 for instructing traffic restriction. The database 11 stores data on the configuration of the network 6 and data on traffic to be monitored.

  The monitoring target capture unit 12 captures information on the traffic to be monitored input from the keyboard and information on the traffic to be monitored transmitted from the maintenance staff's terminal. The monitoring target acquisition unit 12 stores the traffic information of the monitoring target acquired in the database 11. Here, the traffic information to be monitored is information (for example, an IP address if the network 6 is an IP network) that identifies the communication terminal 3 for which there is a risk of excessive traffic inflow and for which the amount of traffic inflow is to be confirmed. .

  In the above, the case where the maintenance staff inputs the traffic information to be monitored has been described. However, the traffic information to be monitored may be received from the network management system of the external network. 4 or network boundary devices 5-1, 5-2 may automatically determine the traffic information to be monitored. For example, when the network management system of the external network finds abnormal traffic in the processing in the external network and the destination is a communication terminal in the network 6, the network management system 2 of the network 6 notifies that fact. The notified network management system 2 may convert the destination address of the abnormal traffic in the external network into the address in the network 6 to obtain the traffic information to be monitored. Further, for example, when the network device 4 or the network boundary device 5-1, 5-2 detects an abnormal packet whose data part is empty by the sampling inspection, the same abnormal packet (only the transmission source address) is detected within a predetermined time. It is also possible to check whether or not the traffic information to be monitored is obtained by obtaining the destination address of the abnormal packet.

  Based on the data stored in the database 11, the first stage monitoring instruction unit 13 determines the network device 4 that accommodates the communication terminal 3 related to the traffic information to be monitored, and sends the traffic information to be monitored to the network device 4. Give the alert threshold and monitor the traffic. The alert threshold is a threshold for determining whether there is excessive traffic, such as 20 Mbps. The network management system 2 may hold the alert threshold value fixedly. Further, when the maintenance person inputs the traffic information to be monitored, the alert threshold may be determined and input in consideration of the processing capability of the communication terminal 3. Furthermore, when the maintenance staff inputs the traffic information to be monitored, the type identification information such as the model name of the communication terminal 3 is input, and the conversion table from the type identification information built in the network management system 2 to the alert threshold value is stored. The alert threshold may be obtained with reference to FIG.

  When an alert is received from the network device 4, the first stage monitoring instruction unit 13 stores the alert in association with the traffic information to be monitored in the database 11 and activates the second stage monitoring instruction unit 14. The second stage monitoring instruction unit 14 recognizes all the network boundary devices 5-1 and 5-2 of the network 6 based on the data stored in the database 11, and sends all the network boundary devices 5-1 and 5-2 to The traffic is monitored by giving the traffic information to be monitored and an alert threshold.

  The alert threshold value in the second stage is a value obtained by multiplying the alert threshold value in the first stage by the number of network boundary devices and the adjustment coefficient α. For example, if the first-stage alert threshold is 20 Mbps and the number of network boundary devices is 2, the second-stage alert threshold is 20 × α / 2. The adjustment coefficient α may be set to 1 (that is, the adjustment coefficient may not be applied), but the adjustment coefficient α is considered in consideration of the inflow from each network boundary device not being uniform due to a DDoS attack or the like. May be smaller than 1. For each network boundary device, the average inflow amount of traffic is detected regardless of the type of traffic, and the adjustment coefficient α is determined for each network boundary device according to this average inflow amount. Also good.

  If the address of the communication terminal 3 in the traffic flowing into the network boundary devices 5-1 and 5-2 is different from the address of the communication terminal 3 when flowing in the network 6, the second stage The monitoring instruction unit 14 performs address conversion (for example, conversion from a local address to a global address), and then gives traffic information to be monitored to all the network boundary devices 5-1 and 5-2. In the address conversion, communication with an address resolution device may be performed to obtain a conversion destination address. Further, the address conversion may be realized by processing on the network boundary device 5-1, 5-2 side.

  When an alert is raised from any one of the network boundary devices 5-1 and 5-2, the second stage monitoring instruction unit 14 stores this in association with the traffic information to be monitored in the database 11. The second stage monitoring instruction unit 14 activates the restriction processing unit 15 as appropriate. For example, the second-stage monitoring instruction unit 14 may activate the restriction processing unit 15 when any one of the network boundary devices raises an alert, and a predetermined number of network boundary devices raise the alert. The restriction processing unit 15 may be activated when it has been received, and furthermore, the restriction processing unit 15 may be activated when all network boundary devices have raised an alert. The predetermined number here may be an absolute number or a number obtained by converting a predetermined ratio of the number of network boundary devices into an integer. For example, if the adjustment coefficient α is a value close to 1, an alert from one network boundary device is sufficient as a start condition, and if the adjustment coefficient α is a value considerably smaller than 1, a plurality of network boundaries It is preferable to use an alert from the device as the activation condition.

  The restriction processing unit 15 analyzes the traffic to the communication terminal 3 related to the traffic information to be monitored, and restricts the traffic to the communication terminal 3 if necessary according to the analysis result. In monitoring excess traffic to the communication terminal 3, as will be described later, only the packet destination and the packet length are problems, and the transmission source and contents of the packet are not seen. However, in the analysis by the restriction processing unit 15, the same transmission source is identified. Whether the content is the same, similar, or the presence of content is determined to determine whether or not it is a DDoS attack. Examples of a method for restricting traffic to the communication terminal 3 include discarding by the network boundary devices 5-1 and 5-2.

  For example, SNMP is used for communication between the network management system 2 and the network device 4 and communication between the network management system 2 and the network boundary devices 5-1 and 5-2.

  FIG. 3 is a block diagram showing an internal configuration relating to an excess traffic monitoring function of the traffic relay device 20 such as the network device 4 and the network boundary devices 5-1, 5-2. The network device 4 and the network boundary devices 5-1 and 5-2 correspond to routers, switches, gateways, and the like, and details of processing related to relay differ depending on the type of the device. The internal configuration related to the monitoring function is the same.

  In FIG. 3, the traffic relay device 20 includes a header extraction unit 21, a monitoring target storage unit 22, a monitoring target determination unit 23, a flow rate measurement unit 24, and a monitoring result report unit 25.

  The header extraction unit 21 extracts a header of a packet that has flowed into the traffic relay device 20.

  The monitoring target storage unit 22 stores the monitoring target traffic information and the alert threshold given from the network management system 2. Although only one communication terminal 3 is shown in FIG. 1, there may be a plurality of communication terminals 3 related to the monitoring target of excess traffic. Traffic information and alert thresholds are stored.

  The monitoring target determination unit 23 determines whether the destination address of the header extracted by the header extraction unit 21 matches the monitoring target traffic information (address of the communication terminal 3) stored in the monitoring target storage unit 22. Is to discriminate. Only the destination address is discriminated, and packets having the same destination address are processed in the same manner even if the source address is different. For example, in the case of a DDoS attack, even if the destination address of the packet is the same, the source address is often different.

  If the current incoming packet is the traffic to be monitored, the flow rate measuring unit 24 adds the packet length of the extracted header (for example, the unit is bytes) to the integrated value of the packet length so far ( Add). When there are a plurality of monitoring targets, the flow rate measurement unit 24 also counts the integrated value for each monitoring target.

  The traffic relay device 20 monitors traffic for a predetermined time (monitoring time) determined in advance from when the traffic information to be monitored and the alert threshold value are given from the network management system 2. The monitoring time may be different between the network device 4 and the network boundary devices 5-1 and 5-2. For example, the monitoring time of the network boundary devices 5-1 and 5-2 may be longer than the monitoring time of the network device 4. The network management system 2 may also indicate the monitoring time.

  The monitoring result reporting unit 25 generates a monitoring result based on the packet length integrated value and the alert threshold when a predetermined time for monitoring ends, and reports it to the network management system 2. For example, if the traffic monitoring time is 1 second, a value obtained by replacing the packet length integrated value (unit: bytes) with the number of bits is a value representing the traffic flow rate. Also, for example, if the traffic monitoring time is 5 seconds, the packet length integrated value is divided by 5 to obtain the packet length integrated value per second, and the obtained packet length integrated value per second is replaced with the number of bits. A value obtained by dividing the packet length integrated value by the number of bits by 5 is a value representing the traffic flow rate. The monitoring result reporting unit 25 compares the obtained traffic flow rate with the alert threshold value stored in the monitoring target storage unit 22, and generates a monitoring result called alert when the traffic flow rate is equal to or higher than the alert threshold value. When the flow rate is smaller than the alert threshold value, a monitoring result indicating normality is generated.

(A-2) Operation of the Second Embodiment Next, the excessive traffic monitoring operation (traffic monitoring method) of the traffic monitoring system 1 according to the first embodiment will be described.

  The operation of the traffic monitoring system 1 is determined in consideration of the traffic flow of the DDoS attack. As shown in FIG. 1, the DDoS traffic to the communication terminal 3 is distributed to a plurality of network boundary devices 5-1 and 5-2 and flows into the network 6, and the distributed DDoS traffic is transferred to the network boundary. Even if a plurality of relay devices are interposed between the devices 5-1 and 5-2 and the network device 4, they merge at the network device 4 housing the communication terminal 3 and become a large amount of traffic. Attack 3 Considering such a flow, the operation of the traffic monitoring system 1 is determined.

  FIG. 4 is a sequence diagram of the traffic monitoring system 1 according to the first embodiment during the excessive traffic monitoring operation.

  When the network management system 2 fetches the traffic information to be monitored (step S1), the network management system 2 determines the network device 4 that accommodates the communication terminal 3 related to the traffic information to be monitored, and the traffic information to be monitored and the alert threshold value. To request the monitoring of the occurrence of excessive traffic (presence of the possibility of excessive traffic) (step S2).

  The network device 4 measures the flow rate of the instructed traffic destined for the communication terminal 3 for a predetermined time, compares the measured traffic flow rate per unit time with the alert threshold value (step S3), and obtains it. The monitoring result is returned to the network management system 2 (step S4).

  The network management system 2 determines whether or not the monitoring result from the network device 4 is an alert (step S5). If the alert is not an alert, the network management system 2 ends the monitoring of the traffic to be monitored (step S6). On the other hand, when the monitoring result from the network device 4 is an alert, the network management system 2 sends the traffic information to be monitored to each of all the network boundary devices 5-1 and 5-2. An alert threshold value is given, and a request is made to monitor the presence or absence of excess traffic (presence of excess traffic) (steps S7-1 and S7-2).

  Each of the network boundary devices 5-1 and 5-2 measures the flow rate of the instructed traffic destined for the communication terminal 3 for a predetermined time, and determines the flow rate per unit time of the measured traffic flow rate as an alert threshold value. (Steps S8-1 and S8-2), and the obtained monitoring results are returned to the network management system 2 (steps S9-1 and S9-2).

  Although omitted in FIG. 4, the network management system 2 determines whether or not measures for the traffic to be monitored are necessary when the monitoring results of all the network boundary devices 5-1 and 5-2 are returned. To do. For example, when a predetermined number of alert monitoring results are obtained, the network management system 2 analyzes in detail the traffic destined for the communication terminal 3, and if necessary, all the network boundary devices 5-1, 5-2. Is to be discarded.

(A-3) Effect of the first embodiment According to the first embodiment, the network device accommodating the communication terminal monitors only for a predetermined time in order to monitor excess traffic, and if necessary, all Since the network boundary device monitors for a predetermined time, it is not always monitored, and only a part of the network needs to be monitored. The processing load of the network device, network boundary device, and network management system Can be kept small. As a whole, the monitoring load is reduced.

  In addition, excess traffic can be detected with a total time of the monitoring time at the network device and the monitoring time at the network boundary device. That is, excess traffic can be detected quickly.

  In addition, according to the first embodiment, excess traffic is determined based only on the destination of the traffic, so even if the cause of excess traffic (second generation P2P such as DDoS attack, Winny, etc.) is unknown, it is excessive. Traffic can be detected.

(B) Second Embodiment Next, a traffic monitoring system, a traffic monitoring method, and a network management system according to a second embodiment of the present invention will be described with reference to the drawings.

  In the first embodiment, the network boundary devices 5-1 and 5-2 determine the presence or absence of excess traffic in the second stage of monitoring. In the second embodiment, the network management system 2 determines whether or not there is excess traffic in the second stage of monitoring. Hereinafter, a description will be given focusing on differences from the first embodiment.

  The arrangement of each component in the traffic monitoring system 1 of the second embodiment can also be expressed in FIG. 1 described above. Further, the functional configuration of the network monitoring system 2 of the second embodiment can also be expressed in FIG. 2 described above. Furthermore, the internal configuration of the traffic monitoring surface in the traffic relay device 20 of the second embodiment can also be represented in FIG. 3 described above. However, each component has the following differences.

  The second stage monitoring instruction unit 14 in the network monitoring system 2 according to the second embodiment gives traffic information to be monitored to all the network boundary devices 5-1 and 5-2 to monitor the traffic.

  In the case of the second embodiment, in response to such a monitoring instruction, each of the network boundary devices 5-1 and 5-2 monitors the instructed traffic, and the monitoring result is not the presence or absence of an alert, Send the detected traffic flow. That is, the monitoring result reporting unit 25 in the traffic relay device 20 (5-1, 5-2) uses the flow rate of the monitoring target traffic measured by the flow rate measuring unit 24 for a predetermined time as a monitoring result to the network management system. Report. The information included in the monitoring result may be not the traffic flow itself but the traffic flow per unit time obtained therefrom.

  The restriction processing unit 15 in the network monitoring system 2 of the second embodiment calculates the total traffic flow of the traffic flow reported from all the network boundary devices 5-1, 5-2, and then divides by the monitoring time. The total traffic flow per unit time is obtained, and the total traffic flow per unit time is compared with the alert threshold value to determine whether or not there is excessive traffic.

  FIG. 5 is a sequence diagram at the time of the excessive traffic monitoring operation by the traffic monitoring system 1 according to the second embodiment.

  The network management system 2 determines whether or not the monitoring result from the network device 4 is an alert (step S5). If the alert is not an alert, the network management system 2 finishes monitoring the traffic to be monitored. The processing up to (step S6) is the same as in the first embodiment.

  In the case of the second embodiment, when the monitoring result from the network device 4 is an alert, the network management system 2 performs monitoring for each of all the network boundary devices 5-1 and 5-2. Give traffic information and request to measure traffic flow (steps S7A-1 and S7A-2).

  Each of the network boundary devices 5-1 and 5-2 measures the flow rate of the instructed traffic destined for the communication terminal 3 for a predetermined time (steps S8A-1 and S8A-2), and calculates the measured traffic flow rate. The monitoring result is returned to the network management system 2 (steps S9A-1 and S9A-2).

  The network monitoring system 2 calculates the total traffic flow of the traffic flow reported from all the network boundary devices 5-1, 5-2, and then divides by the monitoring time to obtain the total traffic flow per unit time. The total traffic flow per unit time is compared with the alert threshold to determine whether there is excessive traffic (step S10). The response after determining excessive traffic is the same as in the first embodiment.

  According to the second embodiment, the same effect as that of the first embodiment can be obtained. That is, it is possible to quickly detect excess traffic while reducing the processing load on the network device, the network boundary device, and the network management system.

(C) Third Embodiment Next, a traffic monitoring system, a traffic monitoring method, and a network management system according to a third embodiment of the present invention will be described with reference to the drawings.

  In the first and second embodiments, the network management system 2 takes the initiative to monitor excess traffic. In the third embodiment, the network device 4 that accommodates the communication terminal 3 takes the initiative to monitor excess traffic. Hereinafter, a description will be given focusing on differences from the first embodiment.

  The arrangement of each component in the traffic monitoring system 1 of the third embodiment can also be represented in FIG. 1 described above.

  In the case of the third embodiment, the network management system 1 performs only the function of passing information on the network boundary devices 5-1 and 5-2 to the network device 4 in response to a request from the network device 4. The functional configuration is not shown.

  FIG. 6 is a block diagram illustrating an internal configuration relating to an excess traffic monitoring function of the network device 4 according to the third embodiment.

  In FIG. 6, the network device 4 includes a header extraction unit 31, a monitoring target capture unit 32, a monitoring target determination unit 33, a flow rate measurement unit 34, and a second stage monitoring instruction unit 35.

  Here, the header extraction unit 31, the monitoring target determination unit 33, and the flow rate measurement unit 34 are the same as those shown in FIG.

  The monitoring target capturing unit 32 captures and holds monitoring target traffic information input from the keyboard and monitoring target traffic information transmitted from the communication terminal 3 or the maintenance staff terminal. That is, in the case of the third embodiment, the traffic information to be monitored is input to the network device 4 that accommodates the communication terminal 3 that is the destination terminal of the traffic to be monitored. Here, the threshold value for alerting necessary for monitoring may be stored in the network device 4 in advance, or may be input together with the input of traffic information to be monitored, The network device 4 may request the network management system 2 to obtain it from the network management system 2.

  The monitoring target determination unit 33 according to the third embodiment is configured so that the destination address of the header extracted by the header extraction unit 31 is the traffic information (the communication terminal 3 of the communication terminal 3) that the monitoring target acquisition unit 32 acquires and holds. Address) is determined.

  The second stage monitoring instructing unit 35 compares the packet length integrated value by the flow rate measuring unit 34 with the alert threshold when the predetermined time for monitoring ends, and the alert and result that the packet length integrated value is larger than the alert threshold. Is obtained from the network management system 2 for all the network boundary devices 5-1 and 5-2 of the network 6, and the traffic to be monitored is transmitted to all the network boundary devices 5-1 and 5-2. Information and an alert threshold value are given to monitor traffic.

  In addition, the second stage monitoring instruction unit 35 indicates that the monitoring target traffic is excessive traffic when a monitoring result called alert is raised from any or a predetermined number or all of the network boundary devices 5-1 and 5-2. And the network monitoring system 2 is notified. At this time, the network management system 2 executes the function described as the function of the restriction processing unit 15 in the first embodiment.

  In the case of this third embodiment, the instruction source (in other words, the monitoring result report destination) for monitoring excess traffic for the network boundary devices 5-1 and 5-2 is sent from the network management system 2 in the first embodiment. Except for this point, the network boundary devices 5-1 and 5-2 are the same as those in the first embodiment. That is, the internal configuration of each of the network boundary devices 5-1 and 5-2 can be represented by the above-described FIG. 3, and the description thereof is omitted.

  FIG. 7 is a sequence diagram at the time of an excessive traffic monitoring operation by the traffic monitoring system 1 according to the third embodiment.

  When the network device 4 captures the traffic information to be monitored (step S50), the network device 4 measures the flow rate of the instructed traffic destined for the communication terminal 3 for a predetermined time, and calculates the flow rate per unit time of the measured traffic flow rate. Compared with the threshold for alert, it is determined whether the alert state is present (step S51). If the network device 4 is not in the alert state, the monitoring of the traffic to be monitored ends (step S52). On the other hand, when the network device 4 is in the alert state, the network device 4 gives the traffic information to be monitored and the alert threshold value to each of the network boundary devices 5-1 and 5-2, A request is made to monitor the presence or absence of excess traffic (presence or absence of fear of excessive traffic) (steps S53-1, S53-2).

  Each of the network boundary devices 5-1 and 5-2 measures the flow rate of the instructed traffic destined for the communication terminal 3 for a predetermined time, and determines the flow rate per unit time of the measured traffic flow rate as an alert threshold value. (Steps S54-1, S54-2), and the obtained monitoring results are returned to the network device 4 (steps S55-1, S55-2).

  The network device 4 determines whether or not the traffic is excessive based on the monitoring results returned from all the network boundary devices 5-1 and 5-2 (step S56). When determining that the traffic is not excessive traffic, the network device 4 ends the monitoring of the traffic to be monitored (step S57). On the other hand, if the network device 4 determines that the traffic is excessive, it notifies the network monitoring system 2 (step S58).

  Although illustration is omitted, at this time, the network management system 2 analyzes the traffic destined for the communication terminal 3 in detail, and if necessary, for all the network boundary devices 5-1, 5-2. Direct disposal.

  According to the third embodiment, the same effect as that of the first embodiment can be obtained. That is, it is possible to quickly detect excess traffic while reducing the processing load on the network device, the network boundary device, and the network management system.

  According to the third embodiment, the processing load of the network device is slightly increased as compared with the first embodiment, but the processing load of the network management system can be reduced correspondingly.

(D) Other Embodiments In the description of each of the above embodiments, various modified embodiments have been referred to. However, modified embodiments exemplified below can be cited.

  In each of the embodiments described above, the second stage monitoring is performed by the network boundary devices 5-1, 5-2. However, the network device 4 accommodating the communication terminal 3 can communicate with one hop. All the network devices may be second stage monitoring execution devices.

  In each of the above embodiments, the monitoring in the network device 4 and the monitoring in the network boundary devices 5-1 and 5-2 are performed in time sequence. However, both monitoring operations may be performed in parallel. good. In such a case, for example, if the monitoring result of the network device 4 is not an alert, the network management system 2 ignores the monitoring result of the network boundary devices 5-1 to 5-2, and the monitoring result of the network device 4 is an alert. The monitoring results of the network boundary devices 5-1 to 5-2 may be referred to only when

  In each of the above embodiments, the traffic flow rate is grasped by the number of bits in a predetermined time (for example, [Mbps]), but other parameters such as the number of packets may be used.

  In each of the embodiments described above, the traffic to be monitored is specified by the address of the communication terminal 3, but may be specified by other methods. For example, the communication terminal 3 address and the port number in the network device 4 may be specified.

  In each of the above-described embodiments, an example in which excess traffic is detected by two-stage monitoring has been described, but it may be detected by three-stage or more monitoring. For example, the first stage of monitoring is performed by the network device 4 that accommodates the communication terminal 3, and the second stage of monitoring can be performed in one hop to the network device 4 that accommodates the communication terminal 3. The network device may perform the third-stage monitoring, and the network boundary devices 5-1 and 5-2 may perform the monitoring. Further, for example, the first stage monitoring is performed by the network device 4 that accommodates the communication terminal 3, the second stage monitoring is performed by the network boundary devices 5-1 and 5-2, and the third stage monitoring is performed. The network boundary device in the adjacent network of the network 6 may be used. The monitoring at the network boundary device in the adjacent network may be performed only when the condition that all the inflows of traffic to the network 6 are from the same adjacent network is satisfied. When monitoring with a network boundary device in the adjacent network, the network management system 2 of the network 6 notifies the network management system of the adjacent network, and the monitoring is executed under the management of the network management system of the adjacent network. good.

  Further, the measures when it is determined that the traffic is excessive by monitoring the network boundary devices 5-1 and 5-2 may be reflected in the adjacent network. That is, information on excess traffic may be notified to the network management system of the adjacent network, and a response such as discarding of traffic may be performed at the entrance to the adjacent network.

  In the third embodiment, the monitoring target capturing unit 32 is provided in the network device 4 to capture the traffic information of the monitoring target. However, the monitoring target capturing unit is provided in the network management system 2 to be monitored. The network device 4 may be fetched and notified to the network device 4 and thereafter, the network device 4 may take the initiative to monitor whether there is excessive traffic.

  Although the case where the network device and the network boundary device in each of the above embodiments is a router, a switch, a gateway, or the like has been described, such a device may be a session border controller. In this case, after the session is established, traffic flows in a two-stage process called communication, so the traffic flow rate may be monitored by the number of calls destined for the communication terminal 3 (for example, the number of INVITE messages in SIP).

  DESCRIPTION OF SYMBOLS 1 ... Traffic monitoring system, 2 ... Network management system (NMS), 3 ... Communication terminal, 4 ... Network equipment, 5-1, 5-2 ... Network boundary equipment, 6 ... Network, 10 ... Control part, 11 ... Database, DESCRIPTION OF SYMBOLS 12 ... Monitoring object take-in part, 13 ... 1st step monitoring instruction | indication part, 14 ... 2nd step monitoring instruction | indication part, 15 ... Restriction processing part, 20 ... Traffic relay apparatus, 21 ... Header extraction part, 22 ... Monitoring object memory | storage part , 23... Monitoring target determination unit, 24... Flow rate measurement unit, 25... Monitoring result report unit, 31... Header extraction unit, 32. Second stage monitoring instruction unit.

Claims (6)

In a traffic monitoring system that monitors traffic to any communication terminal in the network as monitored traffic,
In the first network device accommodating the communication terminal, monitoring whether or not the traffic flow rate to the communication terminal exceeds the first alarm threshold,
In each of the one or more second network devices, monitoring whether the traffic flow rate to the communication terminal exceeds a second alarm threshold,
A traffic monitoring system for determining whether or not the traffic to the communication terminal is excessive traffic.   The traffic monitoring system according to claim 1, wherein the one or more second network devices are all network boundary devices provided at a boundary between the network and an external network.   The monitoring operation of each of the second network devices is started when it is determined in the first network device that the traffic flow rate to the communication terminal exceeds the first alarm threshold value. The traffic monitoring system according to claim 1 or 2.   The network management system for managing the network requests monitoring in the first network device and monitoring in each of the second network devices, and takes in a monitoring result. The described traffic monitoring system. In a traffic monitoring method for monitoring traffic to any communication terminal in a network as traffic to be monitored,
The first network device that accommodates the communication terminal monitors whether the traffic flow rate to the communication terminal exceeds a first alarm threshold,
In the first network device, when it is determined that the traffic flow rate to the communication terminal exceeds the first alarm threshold, all the network boundary devices provided at the boundary between the network and the external network Each monitors whether the traffic flow to the communication terminal exceeds a second alarm threshold,
A traffic monitoring method characterized by determining whether or not the traffic to the communication terminal is excessive traffic. In the network management system in the network in which monitoring with traffic to any communication terminal in the network as the monitoring target traffic proceeds with initiative,
Causing the first network device that accommodates the communication terminal to monitor whether the traffic flow rate to the communication terminal exceeds a first alarm threshold;
When the monitoring result of the first network device indicates that the traffic flow rate to the communication terminal has exceeded the first alarm threshold value, all provided at the boundary between the network and the external network Each of the network boundary devices monitors whether the traffic flow to the communication terminal exceeds the second alarm threshold value,
A network management system for determining whether or not traffic to the communication terminal is excessive.

Images