JP2012074988A - Method, apparatus, and program for estimating the number of address ports in network address translation - Google Patents

Abstract

PROBLEM TO BE SOLVED: To estimate the number of global IPv4 addresses required for an LSN (Large Scale NAT) by using packet trace data.SOLUTION: A packet from a network toward the Internet is captured. A packet group sharing a set of five flow keys {srcIP, dstIP, srcPort, dstPort, Protocol} is extracted as a flow, and stored in flow storage means. In each {srcIP#i, dstIP#j} pair, the number of flows in communication at a time point t is defined as N(t, i, j). The N(t, i, j) is counted from packet trace data stored in the flow storage means, and temporarily, as the number of {global IPv4 address, port number} required for NAT(Network Address Translation) when an ISP(Internet Service Provider) provides Internet access using the NAT, {global IPv4 address, port number} required to be allocated to an internal host i at the time point t is calculated using Nmax(t, i)=maxN(t, i, j).

Description

  The present invention relates to an address / port number estimation method, apparatus, and program in NAT (Network Address Translation), and in particular, ISP (Internet Service Provider) configures a communication network using NAT as a countermeasure for the IPv4 address exhaustion problem. The present invention relates to a method, an apparatus, and a program for estimating the number of addresses and ports in NAT for estimating an IPv4 address necessary for NAT.

  As the IP (Internet Protocol) network is widely used, the usage forms and applications of the IP network are diversified, and the traffic added to the network is also diversified accordingly. On the other hand, traffic has been increasing year by year, and it has become very important to estimate the impact that traffic will have on the network. For example, it has been pointed out that there is an increase in video sharing traffic and traffic due to rich content distribution such as video and TV (for example, see Non-Patent Document 1).

  On the other hand, in addition to the large amount of traffic per communication as described above, it has been pointed out that, for example, in recent applications, one host generates many flows simultaneously (see Non-Patent Document 2). ). Also, anomalous traffic such as SYN flooding and network scanning can generate a large amount of flows. If traffic with such a large number of flows is added to the network, the impact on large scale NAT (LSN) is expected to increase. Here, LSN is a method that is considered as a countermeasure against the IPv4 address exhaustion problem (see, for example, Non-Patent Document 3). As shown in Figure 8- (a), the ISP installs the LSN at the boundary between the internal network and external network, uses a unique address in the internal network, assigns it to the internal host, and accesses the Internet. The LSN converts the unique address of the internal host to a global IPv4 address, enabling communication with hosts on the Internet.

  Three methods called NAT444, dual stack (DS) -lite, and address + port (A + P) methods have been proposed (see, for example, Non-Patent Document 3).

  In NAT 444 in FIG. 8A, the end host 10 in the home transmits a packet to the Customer Premise Equipment (CPE) -NAT 20 using the private IPv4 address X used in the home. In CPE-NAT 20, the address X is converted into a unique address Y used in the ISP. As this unique address, for example, a so-called “ISP shared address” (for example, see Non-Patent Document 4) is used. This is a proposal to specify an unassigned IPv4 address as an address that can be shared between ISPs by the Internet assigned numbers authority (IANA). The packet with the unique address Y is transferred to the LSN 30, where it is converted to a global IPv4 address and then transferred to the Internet.

  In DS-lite in Fig. 8- (b), ISP uses IPv6 internally. As in FIG. 8 (a), the packet from the end host 11 is transferred to the DS-lite home gateway (HGW) 21 with the private address X, and the packet is transferred to the LSN 31 using the IPv4 over an IPv6 tunnel to the LSN 31. Is done. Then, the LSN 31 converts the address of the packet into a global IPv4 address.

  In the A + P method of FIG. 8- (c), the private address X is converted to the global IPv4 address Z in the CPE-NAT 22 which is the edge of the network instead of using the LSN. After that, for example, transfer is performed using an IPv4 over an IPv6 tunnel up to LSN.

  In the above method, when a global IPv4 address is assigned, an IPv4 address and a port number that are free at that time are assigned to one flow, as in normal Network Address Port Translation (NAPT). Then, when one end host performs communication that generates a large number of flows, it is necessary to assign a large number of {global IPv4 address, port number} to that end host. Traffic has a greater impact on LSN. Therefore, it is necessary to evaluate such an impact quantitatively and examine the future network architecture.

  There are reports of Non-Patent Documents 5 to 7 as traffic impact evaluation to LSN. These calculate the average number of generated flows per host and how the distribution is based on the measured data. For example, Non-Patent Document 7 indicates that some hosts generate a large number of flows.

  On the other hand, as a method of reducing the number of necessary global IPv4 addresses, a method of using the address of a host on the Internet as a communication partner as an identifier has been proposed. In this method, for example, when two communications (flows) occur simultaneously between a network internal host and a network external host, the global host address is assigned to the internal host by using the address of the external host as a communication identifier {global IPv4 address , Port number} makes it possible to use the same one. From this technology, the following address allocation method is conceivable.

  For example, the network external host X1 (host on the Internet) 129.60.20.1 communicates with the network internal host Y1 (private address / port number = 192.168.0.1:1000), and the network external host X2 129.60.20.2 and the network internal host Y2 ( 192.168.0.2:1000). In normal NAPT, different {global IPv4 address, port number} are assigned to two internal hosts. For example, 192.168.0.1:1000⇔129.60.227.1:1000, 192.168.0.2:1000⇔129.60.227.1:1001, and so on, for the two private address ports, 129.60.227.1:1000, 129.60.227.1: Two global IPv4: 1001 ports are assigned. On the other hand, in the method of using the address of the communication partner as an identifier, the same global IPv4: port number of 129.60.227.1:1000 is assigned to two communications by holding the following correspondence table.

上記の対応表を管理すれば、もし外部ネットワークから宛先アドレス，ポート＝129.60.227.1:1000のパケットが到着したとき、そのパケットの送信元アドレスをチェックし、それが129.60.20.1であれば、129.60.227.1:1000⇒192.168.0.1:1000に変換すればよい。送信元アドレスが129.60.20.2であれば、129.60.227.1:1000⇒192.168.0.2:1000に変換すればよい。

If the above correspondence table is managed, if a packet of destination address, port = 129.60.227.1: 1000 arrives from the external network, the source address of the packet is checked, and if it is 129.60.20.1, 129.60 Convert from .227.1: 1000 to 192.168.0.1:1000. If the source address is 129.60.20.2, it can be converted from 129.60.227.1:1000 to 192.168.0.2:1000.

Cisco Visual Networking Index: Forecast and Methodology, 2008-2013, http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-481360.pdf S. Miyakawa, "From IPv4 only To v4 / v6 Dual Stack," IETF72 IAB Technical Plenary, Aug. 2008. http://www.kokatsu.jp/blog/ipv4/event/081006_07.pdf T. Nishitani et al., "Common functions of large scale NAT (LSN)," draftnishitani-cgn-02, IETF, May 2009. Y. Shirasaki et al., "NAT444 with ISP shared address," draft-shirasakinat444-isp-shared-addr-03 (work in progress), March 2009. G. Maier et al., "On dominant characteristics of residential broadband Internet traffic," ACM IMC 2009. http://www.janog.gr.jp/meeting/janog24/program/d2p5.html Tsuji, "Evaluation of User Impact by Introducing NAT into ISP," IEICE Journal, Vol. 93, No. 6, pp. 473-478, June 2010.

  As described above, it is expected to reduce the number of {global IPv4 address, port number} required by LSN by using the address information of the network external host. However, there has not been reported so far a method for quantitatively estimating how much address allocation can be performed and how much the number of global IPv4 addresses can be reduced.

  The present invention has been made in view of the above points, and when considering an LSN using address information of a network external host, it is possible to estimate the number of global IPv4 addresses necessary for the LSN using packet trace data. It is an object of the present invention to provide a method, an apparatus, and a program for estimating the number of addresses and ports in a possible NAT.

In order to solve the above-mentioned problems, the present invention (Claim 1) uses NAT to give an ISP a unique address for an internal network such as a private address to a host inside its own network. When a host communicates with a host outside the network (that is, on the Internet), the NAT inside the network exit converts the unique address inside the network to a free global IPv4 address at that time. In a communication network that provides Internet access by effectively utilizing the few global IPv4 addresses,
When the network internal host communicates with multiple network external hosts at the same time (in contrast to normal NAT, each communication has a different {global IPv4 address, port number}), the external network of the communication partner By using the global IPv4 address of the host as an identifier and using the same {global IPv4 address, port number} method for the host inside the network, the required {global IPv4 address, port number} A method for estimating the number of addresses and ports in an apparatus for estimating a number using packet trace data,
Currently, when the ISP provides a communication service using a global IPv4 address to a network internal host,
The packet header analysis means captures the packet going from the network to the Internet, extracts a group of packets having the same flow key {srcIP, dstIP, srcPort, dstPort, Protocol} as a flow, and stores it in the flow storage means. Packet header analysis step to perform,
The flow count counting means defines the number of flows in communication at each time point t in the {srcIP # i, dstIP # j} pair as N (t, i, j), and the packet stored in the flow storage means A flow aggregation step for counting N (t, i, j) from the trace data;
Assuming that the number of {global IPv4 address, port number} required for NAT when the ISP provides Internet access using NAT, Nmax (t, i) = max An address / port number estimation step of calculating {global IPv4 address, port number} that needs to be assigned to the internal host i at time t at _j N (t, i, j) is performed.

Further, according to the present invention (claim 2), the flow management means stores the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort #] extracted in the packet header analysis step in the flow storage means. i, Protocol # i} and the last time the packet arrived Tlast_i
The first packet at the time of the packet trace data is read from the flow storage means, and the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet is stored in the flow storage. If it is new, the flow key of the packet and the arrival time of the packet are registered in Tlast_i. If it is new, Tlast_i is registered in the packet. If the packet is TCP and FIN or RST is flagged, delete the entry from the flow storage means,
Further, the flow registered in the flow storage means is checked at a constant period τ, the current time is compared with the Tlast_i, and if the difference is greater than a predetermined timer value, the condition entry is Delete it from the flow storage means,
In the flow aggregation step,
At the time t, the number of flows entered in the flow storage means for the pair {srcIP # i, dstIP # j} is counted, and this is defined as N (t, i, j).

In the present invention (Claim 3), in the flow counting step,
At the t-th time point (1 <= t <= M, M is the number of measurements, but t = 1 is set to the time after the inactive timer time elapses from the time when the packet trace is started) for each predetermined period τ Find the number of flows Nmax (t, i)
In the address / port number estimation step,
N * (i) = F_t, x (Nmax (t, i)) is a {global IPv4 address, port number} required for the internal host i (provided that the functions F_t, x () A function that returns a percentage value, where x is a predetermined parameter (eg, x = 1 percent)
The N * (i) is sorted in descending order, and N * (i_y) for the top y percent-th (for example, y = 1%) i_y with respect to a predetermined y is obtained and assigned to each host { Calculated as the number of global IPv4 address, port number}.

In the present invention (Claim 4), in the address / port number estimating step,
The total number of flows in communication at time t Ntotal (t) = Σ _i Nmax (t, i), Ntotal * = F_t, x (Ntotal (t)) is calculated, and the value is the measurement point where the packet trace was performed Calculate Z / Y x Ntotal * using the number of hosts Y multiplexed in Z and the number of hosts Z that you want to accommodate using NAT, and calculate that value for the total number of hosts Z that you want to accommodate using NAT. Calculate as the number of {global IPv4 address, port number} required.

In the present invention (Claim 5), in the flow counting step,
For each dstIP # j, count the number of flows Nd (t, j) at time t,
In the address / port number estimation step,
Ndmax (t) = max _j Nd (t, j) is calculated, Ndmax * = F_t, x (Ndmax (t)) is calculated, and the value is multiplexed at the measurement point where the packet trace is performed in the packet analysis step. It is calculated as the number of {global IPv4 address, port number} that is required for accommodating the number of hosts Y using NAT.

Further, the present invention (Claim 6) is a method for comparing a method of using an address of a network external host, which is a communication partner, as an identifier and a method of not using it.
In the address / port number estimation step,
Using the flow number Nmax (t, i) = Σ _j N (t, i, j) obtained in the flow number aggregation step as an input, the N * (i_y) is obtained, and the N * (i_y) is obtained outside the network. Calculate as the number of {global IPv4 address, port number} that needs to be assigned to each host in a method that does not use the host address as an identifier,
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input, and the calculated value of N * (i_y) is assigned to each host in the system using the address of the network external host as an identifier. Is calculated as the number of {global IPv4 address, port number} required
The evaluation means performs a first evaluation step of evaluating the effectiveness of the method using the address of the network external host as an identifier by comparing the two.

Further, the present invention (Claim 7) is a method for comparing a method of using an address of a network external host, which is a communication partner, as an identifier and a method of not using it.
In the address / port number estimation step,
The Nmax (t, i) = Σ _j N (t, i, j) is used as an input to determine the Ntotal *, and the Ntotal * is required in a scheme that does not use the address of a network external host as an identifier {global IPv4 address, Port number} as a number,
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input to calculate the value of Ntotal *, which is necessary in a scheme that uses the address of a network external host as an identifier {global IPv4 address, Port number} as a number,
The evaluation means performs a second evaluation step of evaluating the effectiveness of the system that uses the address of the network external host as an identifier by comparing the two.

  As described above, according to the present invention, when an ISP configures a communication network using NAT, it is possible to estimate the number of global IPv4 addresses necessary for LSN using packet trace data. It is possible to estimate how much the number of global IPv4 addresses can be reduced.

It is a figure for demonstrating the concept of this invention. It is an example of the number of addresses and ports required for operation implementation by NAT. It is a system block diagram in the 8th Embodiment of this invention. It is a block diagram of the address and port number estimation apparatus in the 8th Embodiment of this invention. It is a flowchart of the operation | movement in 1st Example of this invention. It is a block diagram of the address and port number estimation apparatus in the 4th Example of this invention. This is the distribution of the required addresses and ports per host with and without external host addresses. It is explanatory drawing of Large scale NAT used as object in this invention.

  Embodiments of the present invention will be described below with reference to the drawings.

  First, the basic concept in the present invention will be described.

  FIG. 1 is a diagram for explaining the concept of the present invention.

  FIG. 1B is a diagram for explaining an address conversion method when an address of a network external host handled in the present invention is used. For comparison, FIG. 1A shows a case where the address of the network external host handled in the present invention is not used.

  Here, a case where the host A accommodated by the ISP communicates with an external host via the LSN is taken as an example. Specifically, host A is trying to communicate with two external hosts x and y simultaneously. At this time, in FIG. 1A, the host A uses the unique address 192.168.0.1 in the ISP and transmits a packet toward dstIP x with srcIP: srcPort = 192.168.0.1: 1024. In the LSN, the srcIPsrcPort of the packet is converted to 129.0.0.1:1000 which is a global IPv4 address. Similarly, for a packet from srcIP: srcPort = 192.168.0.1: 1025 to dstIP y, srcIPsrcPort is converted to the global IPv4 address 129.0.0.1:1001.

  On the other hand, in the case of FIG. 1B using the address of the network external host that is the communication partner (in this example, dstIP x and dstIP y), srcIP: srcPort = 192.168.0.1: 1024 to dstIP x When the packet is transmitted to LSN, it is converted to the global IPv4 address 129.0.01: 1000 in the LSN, and the address dstIP x that is the communication partner is stored. Similarly, when a packet is sent from srcIP: srcPort = 192.168.0.1: 1025 to dstIP y, it is converted to the global IPv4 address 129.0.01: 1000 in the LSN, and the address dstIP y that is the communication partner is stored. deep. By doing this, when a packet with dstIP: dstPort = 129.0.0.1: 1000 is received from outside the network, the srcIP of the packet is read, and if srcIP is x, dstIP: dstPort = 192.168.0.1: 1024 Convert and transfer to the inside of the network. If srcIP is y, convert to dstIP: dstPort = 192.168.0.1: 1025 and transfer to the inside of the network. In this case, only one global IPv4 address and port number of 129.0.0.1:1000 are required for two communications.

  With the assumption of the address conversion as described above, how much address and the number of ports necessary for what kind of communication can be reduced will be described with reference to the example of FIG.

  In the case A of FIG. 2, the host (srcIP A) inside the network has three flows with the host dstIP 1 outside the network. In this case, it is necessary to assign three {global IPv4 address, port number} to srcIP A whether or not dstIP 1 which is the address of the external host is used.

On the other hand, in case B, srcIP A communicates with the three network external hosts dstIP1, 2, and 3, and each has one flow. In this case, when using dstIP of an external host, one {global IPv4 address, port number} can be assigned to three flows. On the other hand, when not using dstIP, it is necessary to assign three {global IPv4 address, port number} to three flows. (Here, it is assumed that the srcPort of the three flows is different.)
In case C, dstIP 1 has 4 flows, and dstIP 2 has 1 flow. In this case, if the method does not use dstIP, it is necessary to allocate five {global IPv4 address, port number} to a total of five flows. On the other hand, in the method using dstIP, if four flows for dstIP 1 and one flow for dstIP 2 are assigned, the maximum of four global IPv4 addresses and port numbers} are assigned. It will be good.

In summary, the number of {global IPv4 address, port} required for each case is shown in the table below. The second column is the number of flows of each srcIP, which is the number of {global IPv4 address, port} required in a method that does not use dstIP. The third column calculates the flow number N (j) of dstIP j, and its maximum value max _j N (j), which is the number of {global IPv4 address, port} required for the method using dstIP. .

つまり、dstIP毎のフロー数の最大値を求めることで、通信相手である外部ホストのアドレスdstIPを利用する方式で必要となる{グローバルIPv4アドレス，ポート}の数を見積もることが可能となる。以下でその具体的な方法を列挙する。

That is, by obtaining the maximum value of the number of flows for each dstIP, it is possible to estimate the number of {global IPv4 address, port} required in the method using the address dstIP of the external host that is the communication partner. The specific methods are listed below.

[First Embodiment]
In the present embodiment, first, the ISP is currently providing a communication service using a global IPv4 address to a network internal host, and captures a packet from the network to the Internet. A packet group having the same set of five sets of {srcIP, dstIP, srcPort, dstPort, Protocol} is defined as a flow. In each {srcIP # i, dstIP # j} pair, the number of flows in communication at time t is N ( t, i, j) and N (t, i, j) is counted from the packet trace data. If this ISP provides Internet access using NAT, the number of {global IPv4 address, port number} required for NAT is Nmax (t, i) = max _j N (t, i , J) at time t, the number of {global IPv4 address, port number} that needs to be assigned to the internal host i is calculated.

The value of Nmax (t, i) in the example of Table 2 is Nmax (t, A) = max {N (t, A, 1)} = max {3} = 3, Nmax (t, B) = max {N (t, B, 2), N (t, B, 2), N (t, B, 3)} = max {1, 1, 1 } = 1, Nmax (t, C) = max {N (t, C, 1), N (t, C, 2)} = max {4, 1} = 4.

[Second Embodiment]
In the present embodiment, the number of flows N (t, i, j) in communication at a certain time t in the first embodiment described above is obtained. The procedure is as follows.

  First, a flow management table for managing the state for each flow is prepared in the storage means in advance. In the flow management table, two of the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} and the time Tlast_i at which the last packet arrived are stored.

  Next, the first packet at the time of the packet trace data is read, and the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet is already entered in the flow management table Check if it is. If it is new, the flow key of the packet and the arrival time of the packet are entered in Tlast_i in the flow management table. If it is a packet from an existing flow, Tlast_i is updated to the arrival time of the packet. If the packet is TCP and FIN or RST is flagged, the entry is deleted from the flow management table.

  On the other hand, the flow entered in the above flow management table is checked at regular intervals τ. At this time, the current time is compared with Tlast_i, and if the difference is larger than a predetermined timer value inactive_timer, the current time is deleted from the flow management table.

  With the above preparation, the number of flows entered in the flow management table for the pair {srcIP # i, dstIP # j} at the time t is counted, and this is defined as N (t, i, j).

[Third Embodiment]
In the present embodiment, the t-th time point (1 <= t <= M, M is the number of measurements, and t = 1 is after the inactive timer time has elapsed from the time when the packet trace is started, for each predetermined period τ. Nmax (t, i) at the time of () is set, and N * (i) = F_t, x (Nmax (t, i)) is set to {global IPv4 address, port number} required for host i To do. Note that the function F_t, x () is a function that returns an upper x percent value with respect to t, and x is a predetermined parameter (for example, x = 1 percent).

  Next, N * (i) is sorted in descending order, and N * (i_y) is calculated for the top y percent-th i_y with respect to a predetermined y (for example, y = 1%), which must be assigned to each host It is calculated as the number of {global IPv4 address, port number}.

  This third embodiment will be supplemented.

  First, the reason for not using the information on the number of flows until the inactive timer time elapses is that the number of in-communication flows calculated from the packet trace data until the inactive timer time elapses is the number of flows being communicated before the start of packet trace measurement. This is because it may not be included. For example, if a packet is transmitted until immediately before the start of packet trace measurement and there is a flow that has not transmitted a packet since the start of measurement, the flow cannot be detected from the packet trace data. However, if the flow is in communication, packets should be sent before the inactive timer time elapses, so a warm-up time called inactive timer time is provided to count the flow before the start of packet trace measurement. Can do.

  Next, the function F_t, x in N * (i) = F_t, x (Nmax (t, i)) will be supplemented. For example, if τ = 1ms and M = 360000 (that is, 1 hour), the number of flows Nmax (t, i) changes every moment during that hour, but x is the upper 1/360000 × 100% As a value, the maximum value of Nmax (t, i) over one hour is N * (i). If you prepare the number of {global IPv4 address, port} of N * (i), any value The necessary addresses and ports can be covered at that time.

  It is supplemented about "determining N * (i_y) for i_y of the top y percent (eg y = 1 percent) and calculating it as the number of {global IPv4 address, port number} that needs to be assigned to each host" . For example, if y = 1% is set, the number of necessary {global IPv4 address, port number} is assigned to each host in this procedure, and the required address and number of ports are assigned to 99% of hosts. become.

  The address and port number assignment method here assumes a method of allocating {global IPv4 address, port number} to each host at the edge of the network, as in the A + P method described in FIG. In addition, when {Global IPv4 address, port number} is assigned by multiplexing hosts with LSN as in NAT444 or DS-lite system in Fig. 1, {Global IPv4 address, port number} that can be used for each host When operating with a fixed range of allocation, the number of {global IPv4 address, port number} required per host can be set to the value estimated in this embodiment.

[Fourth Embodiment]
In the present embodiment, a flow number counting process is performed.

The number of flows is Ntotal (t) = Σ _i Nmax (t, i), Ntotal * = F_t, x (Ntotal (t)) is calculated, and the value is the measurement point (address / node between nodes). Z / Y x Ntotal * is calculated using the number of hosts Y multiplexed at the installation point of the port number estimation device) and the number of hosts Z to be accommodated using NAT, and the value is accommodated using NAT. This is characterized in that it is calculated as the number of {global IPv4 address, port number} required for the entire number of hosts Z to be obtained.

  Here, when multiple hosts are multiplexed and address translation is performed using LSN, as in NAT444 or DS-lite system in Fig. 1, how many {global IPv4 address, port number} pairs are prepared in total In addition, as in the third embodiment, instead of assigning a fixed range of addresses and ports to a single host as in the third embodiment, communication is performed using addresses and ports that are available at that time. Estimating the number of {global IPv4 address, port number} required for the entire host, assuming a method of dynamically allocating to the requested host.

[Fifth Embodiment]
In this embodiment, for each dstIP # j, the number of flows Nd (t, j) at time t is counted, Ndmax (t) = max _j Nd (t, j) is obtained, and Ndmax * = F_t , X (Ndmax (t)), and the value is required when accommodating the number of hosts Y multiplexed at the measurement point where the packet trace is performed using NAT {global IPv4 address , Port number}.

  This method assigns the same {global IPv4 address, port number} without distinguishing between the same srcIP and another srcIP if you are communicating with different external hosts (that is, different dstIP) Estimating the {global IPv4 address, port number} required when the system is assumed. In the fourth embodiment, only when a certain srcIP is communicating with a different dstIP, the case where the same {global IPv4 address, port number} is assigned is targeted.

As an extension of the fifth embodiment, if the packet trace data is the number Y of measurement location hosts, the host number Y ′ (<Y) is simulated by decimating srcIP randomly with that data, By calculating Ndmax * and applying the change in Ndmax * when the number of hosts Y changes to the function, we estimate how Ndmax * will be when the number of hosts becomes Z (> Y), and use NAT This is calculated as the number of {global IPv4 address, port number} required for the entire number of hosts Z that you want to accommodate. As a specific example, if Ndmax * when the number of hosts is Y is written as Ndmax * (Y), the number of hosts becomes Z
Ndmax * (Z) = {Ndmax * (Y) -Ndmax * (Y ')} / (Y-Y') × (ZY) + Ndmax * (Y)
Estimated by

[Sixth Embodiment]
In the present embodiment, a system that uses the address of a network external host as a communication partner as an identifier is compared with a system that does not use it.

First, Nmax (t, i) = Σ _j N (t, i, j) is used as an input, N * (i_y) is obtained in the same procedure as in the third embodiment, and the N * (i_y) Is calculated as the number of {global IPv4 address, port number} that needs to be assigned to each host in a method that does not use the address of the network external host as an identifier. On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input, and a value obtained by calculating N * (i_y) by the procedure as described in the third embodiment is used as a network external host. This is calculated as the number of {global IPv4 address, port number} that needs to be assigned to each host in the method of using the address of as an identifier. Then, by comparing the two, the effectiveness of the method of using the address of the network external host as an identifier is evaluated.

[Seventh Embodiment]
In the present embodiment, a method that uses the address of a network external host, which is a communication partner, as an identifier is compared with a method that does not use it in a method different from the sixth embodiment.

First, Nmax (t, i) = Σ _j N (t, i, j) is used as an input, Ntotal * is obtained in the same procedure as in the fourth embodiment, and Ntotal * is the address of the network external host. This is calculated as the number of {global IPv4 address, port number} required in a method that does not use as an identifier.

On the other hand, using Nmax (t, i) = max _j N (t, i, j) as input, the value calculated for Ntotal * in the same procedure as in the fourth embodiment uses the address of the network external host as the identifier. This is calculated as the number of {global IPv4 address, port number} required for the method to be used. Then, by comparing the two, the effectiveness of the method of using the address of the network external host as an identifier is evaluated.

[Eighth Embodiment]
In this Embodiment, the estimation apparatus for implement | achieving the method shown in said 1st-7th is shown.

  FIG. 3 shows a system configuration according to the eighth embodiment of the present invention.

  As shown in the figure, an address / port number estimation apparatus 100 in NAT is used in a form of being inserted into a link between nodes 200A and 200B. Alternatively, in a node (switch or router), the packet may be mirrored to a port, and the address / port number estimation device 100 may be installed at the end of the port. Alternatively, the packet may be once captured with the configuration shown in FIG. 3, and the packet may be read from the head in post-processing, and processing described later may be performed.

  FIG. 4 shows an apparatus configuration according to the eighth embodiment of the present invention.

  The address / port number estimation apparatus 100 shown in FIG. 1 includes a packet header analysis unit 110, a flow management unit 120, a flow number totaling unit 130, and an address / port number estimation unit 140.

  The packet header analysis unit 110 extracts a flow key from the arrived packet.

  The flow management unit 120 has a flow management table 121 in an internal memory or a connected storage medium, and manages the flow key and packet arrival time extracted by the packet header analysis unit 110.

  The flow count totaling unit 130 calculates the number of flows in communication at the time t from the packet trace data by the method described in the second embodiment or the fifth embodiment.

  The address / port number estimation unit 140 estimates the number of addresses / ports by one of the following methods.

Calculate {global IPv4 address, port number} that needs to be assigned to the internal host at a specific time t (method of the first embodiment);
Calculate {global IPv4 address, port number} required for the internal host at an arbitrary time (the method of the third embodiment);
Calculate {global IPv4 address, port number} required for the entire NAT (method of the fourth or fifth embodiment);
A means for obtaining {global IPv4 address, port number} that is required when the address of the network external host is used as an identifier and when it is not used as an identifier (for the fourth and fifth embodiments described later) Output to (evaluation unit) (method of the sixth or seventh embodiment):

  Embodiments of the present invention will be described below with reference to the drawings.

[First embodiment]
The following embodiment will be described based on the configuration of the address / port number estimation apparatus shown in FIG.

  In this example, the flow during communication at the time point t is calculated by the method of the second embodiment described above, and allocation to the internal host is required at the specific time point t by the method of the first embodiment. An example of calculating {global IPv4 address, port number} will be described.

  FIG. 5 is a flowchart of the operation of the first embodiment of the present invention.

  The operation of each component of the address / port number estimation apparatus 100 will be described below with reference to the flowchart of FIG.

  When a packet arrives from the preceding node, the packet header analysis unit 110 reads out the flow key = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet, and the flow management unit 120 Notify the flow key. Thereafter, the packet is transferred to the subsequent node (S1 in FIG. 5).

  The flow management unit 120 prepares a flow management table 121 in a storage medium such as an internal memory or a disk device, and the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i is stored in the table 121. , Protocol # i} and the last packet arrival time Tlast_i are stored. The flow management unit 120 checks whether the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet has already been entered in the flow management table 121 (FIG. 5, S2). If it is new (FIG. 5, S2, no), the flow key of the packet and the arrival time Tonow of the packet are entered in Tlast_i in the flow management table 121 (FIG. 5, S3). If it is a packet from an existing flow (FIG. 5, S2, yes), Tlast_i in the flow management table is read and updated to the arrival time of the packet (FIG. 5, S5). If the packet is TCP and the flag is set in FIN or RST (FIG. 5, S4), the entry is deleted from the flow management table (FIG. 5, S6).

  On the other hand, the flow management unit 120 checks the flows entered in the flow management table 121 at regular intervals τ (FIG. 5, S7). At that time, the current time is compared with Tlast_i (FIG. 5, S8), and if the difference is larger than a predetermined timer value inactive_timer (FIG. 5, S8, yes), it is deleted from the flow management table (FIG. 5). , S9).

  The flow count totaling unit 130 refers to the flow management table for every fixed period τ, and counts the number of flows entered in the flow management table 121 for each pair of {srcIP # i, dstIP # j} at the current time t. And N (t, i, j) (FIG. 5, S10). The value is notified to the address / port number estimation unit 140.

The address / port number estimation unit 140 sets Nmax (t, i) = max _j N (t, i, j) as the number of {global IPv4 address, port number} that needs to be assigned to the internal host i at time t. calculate. The value of Nmax (t, i) is accumulated in a memory (not shown), and the time after the inactive timer time elapses from the time when packet measurement is started is defined as t = 1st time, t = Mth (M Is stored in the memory (not shown) until N * (i) = F_t, x (Nmax (t, i)) is set for the host i {global IPv4 address, Port number}. The function F_t, x () is a function that returns an upper x percent value with respect to t, and x is a predetermined parameter (for example, x = 1 percent). Next, N * (i) is sorted in descending order, and N * (i_y) is calculated for the top y percent-th i_y with respect to a predetermined y (for example, y = 1%), and it is necessary to assign it to each host. Calculated as {global IPv4 address, port number}.

[Second Embodiment]
This example shows the operation of the address / port number estimation unit 140 corresponding to the method of the fourth embodiment described above.

The address / port number estimation unit 140 sets Ntotal (t) = Σ _i Nmax (t, i) as the total number of flows in communication at time t,
Ntotal * = F_t, x (Ntotal (t))
Using the number of hosts Y multiplexed at the measurement point where the packet trace was performed and the number of hosts Z to be accommodated using NAT,
Z / Y × Ntotal *
And the value is calculated as the number of {global IPv4 address, port number} required for the entire number of hosts Z to be accommodated using NAT.

  Since the operations other than the address / port number estimation unit 140 are the same as those in the first embodiment, description thereof will be omitted.

[Third embodiment]
In this example, the operations of the flow number totaling unit 130 and the address / port number estimating unit 140 corresponding to the method of the fifth embodiment described above are shown.

  The number-of-flows counting unit 130 counts the number of flows Nd (t, j) at the time t for each external host dstIP # j and outputs it to the address / port number estimation unit.

The address / port number estimation unit 140 calculates the maximum number of flows in communication at time t.
Ndmax (t) = max _j Nd (t, j)
Seeking
Ndmax * = F_t, x (Ndmax (t))
And the value is calculated as the number of {global IPv4 address, port number} required when accommodating using NAT with respect to the number of hosts Y multiplexed at the measurement point where the packet trace is performed. .

  Since the operations other than the flow number totalization unit 130 and the address / port number estimation unit 140 are the same as those in the first embodiment, description thereof will be omitted.

[Fourth embodiment]
FIG. 6 shows the configuration of an address / port number estimation apparatus according to the fourth embodiment of the present invention.

  The configuration shown in FIG. 4 is obtained by adding an evaluation unit 150 to the configuration of FIG. 4 for evaluating the effectiveness of a system that uses the address of a network external host as an identifier by comparing the two.

The address / port number estimation unit 140 compares the number of flows in communication at time t as N (t, i , j), the maximum value of the number of flows in communication at time t is Nmax (t, i) = Σ _j N (t, i, j), which is the same as in the first embodiment. N * (i_y) is calculated in the procedure, and N * (i_y) is calculated as the number of {global IPv4 address, port number} that needs to be assigned to each host in a method that does not use the address of the network external host as an identifier. Output to the unit 150. On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input, and the value calculated for N * (i_y) in the procedure of the first embodiment is used as the identifier of the network external host address. Is calculated as the number of {global IPv4 address, port number} that needs to be allocated to each host in the system used as

  The evaluation unit 150 acquires the number of {global IPv4 address, port number} for both the method using the address of the network external host input from the address / port number estimation unit 140 as the identifier and the method not using the identifier. Perform an evaluation. As a specific example, the value A calculated as {global IPv4 address, port number} in the method using the address of the network external host as an identifier and the {global IPv4 address, port in the method not using the address of the network external host as an identifier (BA) / A is calculated as the degree of reduction in the number of addresses / ports by using the address of the external host as an identifier, using the value B calculated as the number}.

  Since the operations other than the address / port number estimation unit 140 and the evaluation unit 150 are the same as those in the first embodiment, description thereof will be omitted.

[Fifth embodiment]
In this example, an example corresponding to the seventh embodiment will be described.

Nmax (t, i) = Σ _j N (t, i, j) is used as a method to compare the method that uses the address of the network external host that is the communication partner as an identifier and the method that does not use it as an identifier. The number of {global IPv4 address, port number} required in a method in which Ntotal * is obtained as an input to the port number estimation unit 140 in the same procedure as in the second embodiment, and the Ntotal * is not used as an identifier of the network external host address And output to the evaluation unit 150. On the other hand, in a method of using Nmax (t, i) = max _j N (t, i, j) as an input and calculating the value of Ntotal * in the procedure of the second embodiment using the address of the network external host as an identifier The number of necessary {global IPv4 address, port number} is calculated and output to the evaluation unit 150.

  The evaluation unit 150 evaluates the number of {global IPv4 address, port number} in both the method using the host address outside the network as an identifier and the method not using it. As a specific example, the value A calculated as {global IPv4 address, port number} in the method using the address of the network external host as an identifier and the {global IPv4 address, port in the method not using the address of the network external host as an identifier (BA) / A is calculated as the degree of reduction in the number of addresses / ports by using the address of the external host as an identifier, using the value B calculated as the number}.

  Since the operations other than the address / port number estimation unit 140 are the same as those in the first embodiment, description thereof will be omitted.

[Sixth embodiment]
In the first embodiment described above, the flow management unit 120 deletes a flow from the flow management table 121 at regular intervals τ. However, even if N (t, i, j) is obtained by the following procedure. Good.

  In the flow management unit 120, the flow management table 121 stores the flow key i, the time Tfirst_i when the first packet arrives, and the time Tlast_i when the last packet arrives.

  When the packet arrives, the flow management unit 120 refers to the flow management table 121 to check whether the flow has already been entered. If the flow has not been entered, the flow management unit 120 sets the arrival time Tonow of the packet as Tfirst_i and Tlast_i. Set to. If Tlast_i + inactive timer <Tnow in the entered flow, after setting Tlast_i ← Tlast_i + inactive timer, the flow information is additionally output to a flow information output file (not shown) prepared in advance. Otherwise, Tlast_i ← Tnow is updated and stored in the flow management table 121.

  If the arrival packet is TCP and the FIN or RST flag is set, Tlast_i ← Tnow is set, and then the flow information is additionally output to a flow information output file (not shown).

  After performing the above for a certain period, the flow remaining in the flow management table 121 is set to Tlast_i ← Tnow, and then the flow information is additionally output to a flow information output file (not shown).

  The flow count totaling unit 130 uses the flow information output file created in the above-described procedure, for each pair of {srcIP # i, dstIP # j}, a flow in communication at time t (that is, Tfirst_i <t <Tlast_i Counts the number of flows that satisfy (N) (t, i, j).

  Since the subsequent processing is the same as that of the first embodiment, the description thereof is omitted.

  As described in the above embodiments and examples, according to the present invention, when considering an LSN using address information of a network external host, a global IPv4 address necessary for the LSN is obtained using packet trace data. To provide a method and apparatus for estimating a number.

  When this example 4 is applied to one hour of internet access traffic data, x = 1/360000 × 100%, y = 1%, inactive timer = 15 seconds, and the number of flows in 1ms cycle When the number of {global IPv4 address, port number} that needs to be allocated per host is estimated, the required address is used when compared to the case where the address of the network external host is not used. , It has been confirmed that the number of ports can be reduced by 35.5%. As a reference, FIG. 7 shows the distribution of the required number of addresses and ports per host when an external host address is used and when it is not used. Shows the percentage of hosts where the X-axis requires addresses and the number of ports and the Y-axis requires addresses and the number of ports is x or more. In this figure, the value of X when the curve with and without external address intersects Y = 0.01 means the number of addresses and ports required when address is used and not. Assuming that these are A and B, respectively, (B−A) ÷ A = 0.355, which is calculated as the reduction degree of the number of addresses and ports.

  As described above, according to the present invention, when considering an LSN using address information of a network external host, a method and apparatus for estimating the number of global IPv4 addresses required in the LSN using packet trace data Is to provide.

  The operation of each component of the address / port number estimation apparatus shown in FIGS. 4 and 6 is constructed as a program and installed in a computer used as the address / port number estimation apparatus to be executed, or via a network. Can be distributed.

  Further, the constructed program can be stored in a portable storage medium such as a hard disk, a flexible disk, or a CD-ROM, and can be installed or distributed in a computer.

  The present invention is not limited to the above-described embodiments and examples, and various modifications and applications can be made within the scope of the claims.

100 Address / Port Number Estimation Device 110 Packet Header Analysis Unit 120 Flow Management Unit 121 Flow Management Table 130 Flow Number Counting Unit 140 Address / Port Number Estimation Unit 150 Evaluation Unit

Claims (15)

Using NAT (Network Address Translation), an ISP gives a host inside its network a unique address for the internal network, such as a private address, and the host inside the network is outside the network (that is, on the Internet). When communicating with a host, the NAT installed at the exit of the network converts the unique address inside the network into a global IPv4 address that is free at that time, thereby effectively using the few global IPv4 addresses to access the Internet. In a communication network that provides
When the network internal host communicates with multiple network external hosts at the same time (in contrast to normal NAT, each communication has a different {global IPv4 address, port number}), the external network of the communication partner By using the global IPv4 address of the host as an identifier and using the same {global IPv4 address, port number} method for the host inside the network, the required {global IPv4 address, port number} A method for estimating the number of addresses and ports in an apparatus for estimating a number using packet trace data,
Currently, when the ISP provides a communication service using a global IPv4 address to a network internal host,
The packet header analysis means captures the packet going from the network to the Internet, extracts a group of packets having the same flow key {srcIP, dstIP, srcPort, dstPort, Protocol} as a flow, and stores it in the flow storage means. Packet header analysis step to perform,
The flow count counting means defines the number of flows in communication at each time point t in the {srcIP # i, dstIP # j} pair as N (t, i, j), and the packet stored in the flow storage means A flow aggregation step for counting N (t, i, j) from the trace data;
Assuming that the address / port number estimation means provides the Internet access by using the NAT, the number of {global IPv4 address, port number} required for NAT is Nmax (t, i) = max _j N (t, i, j) is an address and port number estimation step for calculating {global IPv4 address, port number} that need to be assigned to internal host i at time t;
A method for estimating the number of addresses and ports in NAT, characterized by: The flow management means stores in the flow storage means the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} extracted in the packet header analysis step and finally the packet. Memorize two arrival times Tlast_i,
The first packet at the time of the packet trace data is read from the flow storage means, and the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet is stored in the flow storage. If it is new, the flow key of the packet and the arrival time of the packet are registered in Tlast_i. If it is new, Tlast_i is registered in the packet. If the packet is TCP and FIN or RST is flagged, delete the entry from the flow storage means,
Further, the flow registered in the flow storage means is checked at a constant period τ, the current time is compared with the Tlast_i, and if the difference is greater than a predetermined timer value, the condition entry is Delete it from the flow storage means,
In the flow aggregation step,
The address number in NAT according to claim 1, wherein the number of flows entered in the flow storage means for the pair {srcIP # i, dstIP # j} at the time t is counted, and is defined as N (t, i, j). Port number estimation method. In the flow number counting step,
Number of flows at the t-th time point (1 ≦ t ≦ M, M is the number of measurements, where t = 1 is set to the time after the inactive timer time elapses from the time when packet tracing is started) for each predetermined period τ Find Nmax (t, i)
In the address / port number estimation step,
N * (i) = F_t, x (Nmax (t, i)) is a {global IPv4 address, port number} required for the internal host i (provided that the functions F_t, x () A function that returns a percentage value, where x is a predetermined parameter (eg, x = 1 percent)
The N * (i) is sorted in descending order, and N * (i_y) for the top y percent-th (for example, y = 1%) i_y with respect to a predetermined y is obtained and assigned to each host { 2. The method for estimating the number of addresses and ports in NAT according to claim 1, wherein the number is calculated as the number of global IPv4 address, port number}. In the address / port number estimation step,
The total number of flows in communication at time t Ntotal (t) = Σ _i Nmax (t, i), Ntotal * = F_t, x (Ntotal (t)) is calculated, and the value is the measurement point where the packet trace was performed Calculate Z / Y x Ntotal * using the number of hosts Y multiplexed in Z and the number of hosts Z that you want to accommodate using NAT, and calculate that value for the total number of hosts Z that you want to accommodate using NAT. The method for estimating the number of addresses and ports in NAT according to claim 1, wherein the number is calculated as the number of {global IPv4 address, port number} required. In the flow number counting step,
For each dstIP # j, count the number of flows Nd (t, j) at time t,
In the address / port number estimation step,
Ndmax (t) = max _j Nd (t, j) is calculated, Ndmax * = F_t, x (Ndmax (t)) is calculated, and the value is multiplexed at the measurement point where the packet trace is performed in the packet analysis step. The method for estimating the number of addresses and ports in NAT according to claim 1, wherein the number of hosts Y is calculated as the number of {global IPv4 address, port number} required when accommodating using NAT. As a method of comparing the method that uses the address of the network external host that is the communication partner as an identifier and the method that does not use it as an identifier,
In the address / port number estimation step,
Using the flow number Nmax (t, i) = Σ _j N (t, i, j) obtained in the flow number aggregation step as an input, the N * (i_y) is obtained, and the N * (i_y) is obtained outside the network. Calculate as the number of {global IPv4 address, port number} that needs to be assigned to each host in a method that does not use the host address as an identifier,
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input and the value calculated for N * (i_y) is assigned to each host in the system using the address of the network external host as an identifier. Is calculated as the number of {global IPv4 address, port number} required
4. The method for estimating the number of addresses and ports in NAT according to claim 3, wherein the evaluation means performs an evaluation step of evaluating the effectiveness of a method of using the address of a network external host as an identifier by comparing the two. As a method of comparing the method that uses the address of the network external host that is the communication partner as an identifier and the method that does not use it as an identifier,
In the address and port number estimation step,
The Nmax (t, i) = Σ _j N (t, i, j) is used as an input to determine the Ntotal *, and the Ntotal * is required in a scheme that does not use the address of a network external host as an identifier {global IPv4 address, Port number} as a number,
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input to calculate the value of Ntotal *, which is necessary in a scheme that uses the address of a network external host as an identifier {global IPv4 address, Port number} as a number,
5. The method for estimating the number of addresses and ports in NAT according to claim 4, wherein the evaluation means performs an evaluation step of evaluating the effectiveness of a method of using an address of a network external host as an identifier by comparing the two. Using NAT (Network Address Translation), an ISP gives a host inside its network a unique address for the internal network, such as a private address, and the host inside the network is outside the network (that is, on the Internet). When communicating with a host, the NAT installed at the exit of the network converts the unique address inside the network into a global IPv4 address that is free at that time, thereby effectively using the few global IPv4 addresses to access the Internet. In a communication network that provides
When the network internal host communicates with multiple network external hosts at the same time (in contrast to normal NAT, each communication has a different {global IPv4 address, port number}), the external network of the communication partner By using the global IPv4 address of the host as an identifier and using the same {global IPv4 address, port number} method for the host inside the network, the required {global IPv4 address, port number} An address / port number estimation device for estimating the number using packet trace data,
Currently, when the ISP provides a communication service using a global IPv4 address to a network internal host,
A packet header analyzing unit that captures a packet from the network to the Internet, extracts a packet group having the same flow key {srcIP, dstIP, srcPort, dstPort, Protocol} as a flow, and stores the packet group in a flow storage unit; ,
In each {srcIP # i, dstIP # j} pair, the number of flows in communication at the time t is defined as N (t, i, j), and the packet trace data stored in the flow storage means N (t , I, j), a flow counting means for counting,
Assuming that the ISP provides Internet access using NAT, the number of {global IPv4 address, port number} required for NAT is Nmax (t, i) = max _j N (t, i, j ) At time t, the address / port number estimation means for calculating {global IPv4 address, port number} that needs to be assigned to the internal host i,
An apparatus for estimating the number of addresses and ports in NAT, characterized by comprising: The flow memory stores the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} extracted at the packet header analysis step and the last time the packet arrived Tlast_i. Means for storing in the means;
The first packet at the time of the packet trace data is read from the flow storage means, and the flow key i = {srcIP # i, dstIP # i, srcPort # i, dstPort # i, Protocol # i} of the packet is stored in the flow storage. If it is new, the flow key of the packet and the arrival time of the packet are registered in Tlast_i. If it is new, Tlast_i is registered in the packet. And when the packet is TCP and FIN or RST is flagged, means for deleting the entry from the flow storage means;
The flow registered in the flow storage means is checked at regular intervals τ, the current time is compared with the Tlast_i, and if the difference is greater than a predetermined timer value, the condition entry is stored in the flow storage. Means for deleting from the means;
A flow management means having
The flow aggregation means includes
The NAT according to claim 8, further comprising means for counting the number of flows entered in the flow storage means for the pair {srcIP # i, dstIP # j} at time t and setting it as N (t, i, j). For estimating the number of addresses and ports. The flow number counting means includes:
Number of flows at the t-th time point (1 ≦ t ≦ M, M is the number of measurements, where t = 1 is set to the time after the inactive timer time elapses from the time when packet tracing is started) for each predetermined period τ Including means for determining Nmax (t, i);
The address / port number estimating means includes:
N * (i) = F_t, x (Nmax (t, i)) is a {global IPv4 address, port number} required for the internal host i (provided that the functions F_t, x () A function that returns a percentage value, where x is a predetermined parameter (eg, x = 1 percent), and the N * (i) is sorted in descending order, and the top y percent of the predetermined y (eg, y = 1 percent) The address / port number estimation apparatus in NAT according to claim 8, further comprising means for calculating N * (i_y) for i_y and calculating it as a {global IPv4 address, port number} number that needs to be assigned to each host. The address / port number estimating means includes:
The total number of flows in communication at time t Ntotal (t) = Σ _i Nmax (t, i), Ntotal * = F_t, x (Ntotal (t)) is calculated, and the value is the measurement point where the packet trace was performed Calculate Z / Y x Ntotal * using the number of hosts Y multiplexed in Z and the number of hosts Z that you want to accommodate using NAT, and calculate that value for the total number of hosts Z that you want to accommodate using NAT. 9. The address / port number estimation apparatus in NAT according to claim 8, further comprising means for calculating the required number of {global IPv4 address, port number}. The flow number counting means includes:
For each dstIP # j, including means for counting the number of flows Nd (t, j) at time t,
The address / port number estimating means includes:
Ndmax (t) = max _j Nd (t, j) is calculated, Ndmax * = F_t, x (Ndmax (t)) is calculated, and the value is multiplexed at the measurement point where the packet trace is performed in the packet analysis step. 9. The address / port number estimation device in NAT according to claim 8, comprising means for calculating {global IPv4 address, port number} number required for accommodating the host number Y using NAT. The address / port number estimating means includes:
Using the flow number Nmax (t, i) = Σ _j N (t, i, j) obtained by the flow number counting means as an input, the N * (i_y) is obtained, and the N * (i_y) is obtained outside the network. First estimating means for calculating the number of {global IPv4 address, port number} that needs to be allocated to each host in a method that does not use the address of the host as an identifier;
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input and the value calculated for N * (i_y) is assigned to each host in the system using the address of the network external host as an identifier. A second estimating means for calculating the number of {global IPv4 address, port number} required,
Evaluation means for evaluating the effectiveness of a system that uses the address of a network external host as an identifier by comparing the number of {global IPv4 address, port number} calculated by the first estimation means and the second estimation means. The address / port number estimation apparatus in NAT according to claim 10. The address / port number estimating means includes:
The Nmax (t, i) = Σ _j N (t, i, j) is used as an input to determine the Ntotal *, and the Ntotal * is required in a scheme that does not use the address of a network external host as an identifier {global IPv4 address, Port number} third estimation means for calculating the number,
On the other hand, Nmax (t, i) = max _j N (t, i, j) is used as an input to calculate the value of Ntotal *, which is necessary in a scheme that uses the address of a network external host as an identifier {global IPv4 address, Port number} a fourth estimating means for calculating the number,
Evaluation means for evaluating the effectiveness of the system using the address of the network external host as an identifier by comparing the number of {global IPv4 address, port number} calculated by the third estimation means and the fourth estimation means. The address / port number estimation apparatus in NAT according to claim 11.   15. An address / port number estimation program for causing a computer to function as each means constituting the address / port number estimation apparatus according to claim 8.

Images