JP2013179678A - Router device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a router device capable of suppressing traffic congestion in a class even when a plurality of services are categorized in the same class.SOLUTION: The router device includes: QoS transfer control means for transferring packets to be transferred between two networks by categorizing into a plurality of classes having different priorities and bandwidths on the basis of the attributes of the packets, to transfer the packet on the basis of a priority and a bandwidth according to each class; monitoring means for monitoring a communication amount from a plurality of clients connected to one network to another network, on a flow-by-flow basis of each client in at least one class; in any one monitored class, when the communication amount of either one client exceeds a predetermined value, communication restriction means for restricting communication of the client, by changing the category of a packet in a flow of the client having the exceeded communication amount into a class having a lower priority or a narrower bandwidth.

Description

  The present invention relates to a router device for connecting networks having different bandwidths.

  A router device is a layer 3 device that connects different networks, but when connecting from a LAN to a WAN line such as the Internet, a limited WAN band is shared by a plurality of client PCs existing in the same segment of the LAN. You will communicate. In general, because the WAN line bandwidth is narrower than the LAN line, each client PC scrambles for the WAN band, and if one client occupies the band, other clients cannot communicate satisfactorily. Can happen.

  The router accumulates the packets sent from each client on the LAN side in a queue and sends them to the WAN in a predetermined order. However, if the WAN bandwidth is narrower than the LAN bandwidth, it is constant. Packets that could not be transmitted within the time are discarded.

  However, when a packet is discarded, a problem such as an extremely slow response occurs. Therefore, a specific type of network service such as VoIP that transmits a voice signal discards the packet in order to maintain a normal service. It is necessary to secure traffic that will not be done.

  Therefore, a technology called QoS (Quality of Service) that ensures the quality of service by preferentially processing communication packets of a specific service even if the WAN bandwidth is limited (for example, non-patented) Reference 1). There are a bandwidth control method and a priority control method as representative packet control methods of QoS.

  The bandwidth control method is a method of classifying a plurality of services using a network and assigning an upper limit bandwidth that can be used for each class. Then, for the packet flowing on the network, the source IP address, the destination IP address, the port number for each application, etc., identify which service the packet belongs to, and within the range of bandwidth allocated to the class Process the packet. According to this method, since each service can use only the bandwidth allocated to the class to which the service belongs, even if a plurality of services are used at the same time, the services of other classes are not affected.

  By using this method, classifying services such as VoIP that are not allowed to be discarded into a specific class (class 1) and classifying them with other service classes (class 2). Even if it occurs, it does not affect VoIP communication in class 1.

“What is QoS ?: Yamaha routers that use QoS functions”, [online], Yamaha Corporation, [searched September 4, 2006], Internet <URL: http://netvolante.jp/solution/advanced/ qos / about.html>

  In this way, classifying a specific service into another class frees you from the tightness of traffic in different classes, but if multiple services are classified in the same class, other services in the same class If the bandwidth is occupied, there is still a problem that traffic congestion occurs.

  In other words, as shown in FIG. 5, class 1 VoIP can always perform stable communication, but in class 2 where many services are classified, client PCs and viruses running file exchange software are classified. If an abnormal client 102 such as a client PC that has been infected and sent a large amount of spam mail occupies the communication band assigned to class 2, other general clients 101 cannot perform normal communication. There was a problem that it was.

  In addition, in the above example, this traffic tightness is a problem that may occur even when other services are classified into class 1 in addition to VoIP.

  On the other hand, it may be possible to classify each service into a separate class so that traffic congestion does not occur due to other services, but there are so many services that communicate over the network. If the bandwidth is allocated in a fixed manner, the bandwidth is wasted and the communication efficiency is lowered.

  An object of the present invention is to provide a router device capable of suppressing the tightness of traffic of a class even when a plurality of services are classified into the same class.

  A router device according to a first aspect of the present invention is a router device that transfers communication packets between two networks, and includes a QoS transfer control unit, a monitoring unit, and a communication limiting unit. The QoS transfer control means classifies packets transferred between two networks into a plurality of classes having different priorities or bandwidths based on the attributes of the packets, and priorities or bandwidths corresponding to the respective classes. To forward the packet. The monitoring means monitors the communication amount with the other network by a plurality of clients connected to the one network for each client flow in at least one class. When the traffic volume of any client exceeds a predetermined value in any of the monitored classes, the communication limiting means determines that the low priority class or bandwidth Limiting this client's communication by changing the classification to a narrow class.

  A class with a narrow bandwidth may be set to a variable bandwidth by dynamic traffic control with the monitored class.

  The router device according to the second aspect of the present invention is a router device that transfers communication packets between two networks, and includes a QoS transfer control means, a monitoring means, and a communication restriction means. The QoS transfer control means classifies packets transferred between two networks into a plurality of classes having different priorities or bandwidths based on the attributes of the packets, and priorities or bandwidths corresponding to the respective classes. To forward the packet. The monitoring means monitors the communication amount with the other network by a plurality of clients connected to the one network for each client flow in at least one class. When the traffic volume of any client exceeds a predetermined value in any of the monitored classes, the communication limiting means blocks this client flow packet communication by exceeding this traffic volume. Restrict communication.

  The communication restriction unit may set a specific client as an excluded client, and may not restrict communication even when the communication amount of the excluded client in any of the monitored classes exceeds a predetermined value.

  The communication restriction unit may be settable for at least one item of a transmission source or destination IP address and a transmission source or destination port number.

  The monitoring means monitors the traffic volume of one or both of the transmission packets transmitted by each client to the other network and the reception packets received by each client from the other network, and the communication limiting means transmits the transmission of one of the clients. When the communication amount of a packet or a reception packet exceeds a predetermined value, communication restriction may be performed on a packet on the side of the transmission packet / reception packet whose communication amount exceeds a predetermined value.

  The monitoring means monitors the traffic volume of one or both of the transmission packets transmitted by each client to the other network and the reception packets received by each client from the other network, and the communication limiting means transmits the transmission of one of the clients. When the communication amount of the packet or the reception packet exceeds a predetermined value, the communication may be limited for both the transmission packet and the reception packet.

  The communication restriction unit may be able to set a packet to be monitored or a packet to be restricted among the transmission packet and the reception packet.

  The two networks are a wired local area network and a wide area network, and the QoS transfer control means, the monitoring means, and the communication restriction means are described above for packets transferred from the wired local area network to the wide area network. The process may be performed.

  The communication restriction unit may release the communication restriction after a certain time has elapsed from the start of the restriction.

  A router device according to a third aspect of the present invention includes QoS transfer control means, monitoring means, communication restriction means, and setting means. The QoS transfer control means classifies packets transferred between two networks into a plurality of classes having different priorities or bandwidths based on the attributes of the packets, and uses the priorities or bandwidths corresponding to the respective classes. Forward the packet. The monitoring means monitors the traffic of the plurality of clients connected to one network with the other network for each client in at least one class. When the traffic volume of any client exceeds a predetermined value in any of the monitored classes, the communication limiting means transmits at least a packet transmitted or received in this class by the client whose traffic volume has exceeded. This client's communication is restricted by changing the classification to a lower class or a restricted class with lower bandwidth. The setting means sets the number of restriction classes and their priority or bandwidth.

  According to the present invention, when the traffic of a specific flow exceeds a certain threshold, the flow is expected to be occupied by a specific service function, and the flow is prevented in order to prevent traffic congestion. Restrict communication. Thereby, it is possible to effectively suppress the tightness while effectively using the bandwidth.

Block diagram of a router device according to an embodiment of the present invention The figure which shows the rule setting table of QoS and DCC memorize | stored in the flash memory of the router apparatus Flow chart showing the operation of the router device The figure explaining the traffic condition at the time of the said QoS and DCC being applied The figure explaining the traffic condition at the time of applying only the said QoS

  Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram of a router device according to an embodiment of the present invention.

  A router device is a device that connects two networks. In this embodiment, a broadband router which is a general router device will be described. The broadband router functions as a device that always connects a WAN such as the Internet and a LAN.

  In FIG. 1, the router device 1 includes four LAN side ports 14 and one WAN side port 16. The WAN side port 16 is connected to an ISP or the like that provides Internet services. The WAN side port 16 is connected to the CPU 10 via the PHY chip 15.

  A client device (not shown) is connected to each of the four LAN ports 14. These LAN side ports 14 are connected to the layer 2 switch chip 13. The layer 2 switch chip 13 controls communication between a plurality of client devices connected to the LAN side port 14. The layer 2 switch chip 13 is also connected to the CPU 10. The CPU 10 controls communication between the WAN side port 16 and the LAN side port 14.

  In this embodiment, the CPU 10 is used as a control unit that controls communication between the WAN and the LAN. However, a dedicated LSI called a network processor may be used.

  A flash memory 11 and a RAM 12 are connected to the CPU 10. The flash memory 11 stores an operation program and various setting tables for realizing the function of the router device, and also includes a class setting table and a DCC (described later) function for realizing the QoS function as shown in FIG. It stores a rule setting table for realization. The RAM 12 stores communication status and the like.

  The CPU 10 performs routing, address / port conversion, etc. on the input packet. For routing, if the destination IP address of the packet input from the LAN side port 14 points to a subnet existing on the LAN side, it is returned to the LAN side, otherwise it is forwarded to the WAN side port 16. This is a function for transmitting a packet to an appropriate interface based on a predetermined routing control rule. The address / port conversion is a function of delivering after rewriting the IP address or port number field included in the packet in order to realize NAT or IP masquerading.

  Further, the router device 1 has a QoS (Quality of Service) function. The QoS function is a technique for preventing a specific communication packet from being discarded even in a communication line with an insufficient communication band by classifying and processing communication packets into a plurality of classes (class 1 and class 2). This QoS function is particularly effective in communication from a wide bandwidth network (LAN) to a narrow bandwidth network (WAN). The number of classes to be set is not limited to two and may be three or more.

The packet transfer by class using the QoS function is generally performed in the following procedure.
(1) The received packets are classified based on attributes such as a source / destination IP address, a source / destination port number (application), and an input interface.
(2) Marking for identifying the belonging class is performed on the classified packet based on a preset classification condition.
(3) Referring to the marking, each packet is registered in the queue of its class.
(4) The packet registered in each class queue is transferred based on a predetermined bandwidth control method or priority control method.

  The bandwidth control method is a method in which a bandwidth is allocated (reserved) in advance for each class. Each class of communication can only be used up to a pre-assigned bandwidth, so even if class 2 traffic is tight, it does not affect the class 1 communication.

  In the priority control method, a rule is set so that a class 1 communication packet is preferentially processed with respect to a class 2 communication packet. Even if transmission packets accumulate in the class 2 queue, the class 1 queue This is a method for preferentially processing packets registered in. In this system, class 1 packets do not stay even in a situation where network traffic is tight.

  In the following embodiment, an example in which communication packets are classified into two classes as shown in FIG. 2A will be described in order to simplify the description.

  The classification rules set in the class setting table in FIG. 2A are as follows. The application (application layer protocol) is classified as a condition, VoIP is classified into class 1, and all other applications (http, ftp, smtp, etc.) are classified into class 2. The class setting table in FIG. 2A is registered in the flash memory 11. This registration is performed from a PC logged in to the router device 1 via a network or a PC connected by USB or the like.

  Furthermore, the router device 1 has a DCC (Dynamic Class Control) function in order to cope with the tight communication in each class. DCC is a technology for maintaining stable traffic in each class by limiting the communication of this client when the bandwidth occupancy rate of WAN-LAN communication of a specific client exceeds a certain value within a certain class. is there. As a method for restricting client communication, in addition to a method for blocking this client communication for a certain period of time, a packet transmitted and / or received by this client (a packet in which the IP address of this client is a source / destination IP address) ) To a class with a low priority or a class with a low bandwidth for a certain period or indefinitely (not released until the clerk performs a release operation). In this way, the class of a packet transmitted / received by the client is dynamically moved based on the communication bandwidth occupancy rate of the client, so that it is called DCC (Dynamic Class Control).

A rule for applying this DCC function to each client is as shown in FIG.
The DCC application rule includes the following items. There may be one rule or a plurality of rules.

  "Class" Specify the class to be monitored. In the example of the embodiment, class 2 is designated.

  "Client" Specify the client to be monitored. In general, all clients that perform this class of communication may be specified. However, for example, the server apparatus may be excluded from application because the bandwidth occupation rate is allowed to increase. Moreover, it is good also as a rule applied only to some clients, such as applying only to the client PC which an unspecified person uses.

Specify the packet to be monitored for “Send / Receive”. One or both of a transmission packet (source IP address) and a reception packet (destination IP address) are designated.
"Bandwidth" Specify the threshold for bandwidth occupancy. For example, it is set to a numerical value such as 60% at 80%. When the bandwidth occupancy rate of the client to be monitored exceeds a predetermined numerical value for a predetermined time or more, the communication restriction specified in this rule is applied.

  "Operation" Specifies the communication restriction method.

  “Period” Specifies the application time of the above communication restriction. The application time may be indefinite. In the case of an indefinite period, the router 1 continues to restrict communication until a staff member (network administrator) performs an operation for releasing the restriction on the router 1.

  The communication restriction set in the “operation” includes the following methods, for example.

  (1) Block communication between WAN and LAN of the corresponding client.

  (2) The packet transmitted / received by the corresponding client is moved to a class with a lower priority or a class with a lower bandwidth.

  Here, in the class setting shown in FIG. 2A, there is no class having a lower priority than class 2 or a class having a narrow bandwidth. However, when the DCC technology is applied, a dedicated class for communication restriction is used. A class with a low priority or a class with a narrow bandwidth (class 3) is set in advance. Allocation of bandwidth to classes that are not normally used in advance results in wasted bandwidth, but by applying DTC (Dynamic Traffic Control) technology and sharing bandwidth between class 2 and class 3, communication restrictions are imposed. When there is no client to be performed, the class 3 allocated bandwidth can be set to 0 to eliminate bandwidth waste.

  In addition, when the bandwidth occupancy rate of the transmission packet (the packet whose transmission source IP address is the IP address of the client) exceeds the threshold, the communication restriction is applied only to the transmission packet, or not only the transmission packet but also the reception packet Whether or not the communication restriction is applied to (a packet whose destination IP address is the IP address of the client) can be set on the rule. The same applies when the bandwidth occupancy rate of the received packet exceeds the threshold value.

  As described above, in the DCC, the bandwidth occupancy rate is monitored by segmenting traffic in units of clients. By monitoring the bandwidth occupancy rate of the client PC, it is possible to monitor and suppress specific programs such as file exchange software and virus software that occupy the communication bandwidth and tighten traffic without analyzing the communication contents. It becomes possible.

  FIG. 3 is a flowchart for explaining the operation of the router device. FIG. 2A shows a main routine for packet processing. When a packet is received (S1), the received packet is classified based on the attribute (S2) and registered in the queue of that class. Then, this packet is transmitted with the bandwidth or priority defined for the class (S3). The above is the normal processing of the router device that executes QoS.

  While performing this process, the traffic (flow) for each client in the class (class 2) monitored by the DCC is monitored (S4). When the bandwidth occupancy of any client flow exceeds the bandwidth occupancy defined in the DCC rules (see FIG. 2B) (S5), the communication restriction defined in the DCC is applied to this client. (S6).

  FIG. 5B is a flowchart showing communication restriction management processing when a client to which communication restriction is applied occurs. In the DCC rule shown in FIG. 2B, a period for applying communication restriction is determined. If this period is unlimited, this process is not necessary, but if a finite time is applied, measure the communication restriction time in this communication restriction management process, and after the application period elapses, Release the restriction and restore the communication status of the client. In S10, the time during which communication is restricted is measured to determine whether the application period has elapsed. If the application period has not elapsed, nothing is done. When the application period has elapsed, the communication restriction applied in S6 is canceled and the communication state of the client is returned to the original state (S11). Here, to return to the original state, when the communication of the client PC is cut off, the operation of releasing the cut-off, the client PC (communication packet) is changed to a class with a low priority or a class with a low bandwidth. When moved, this is an operation to return the client PC (communication packet) to the original class.

  By performing the DCC processing as described above, the traffic in the class is monitored in units of flows of each client, and when a client that occupies the band abnormally occurs, the communication of the client is restricted, thereby classifying the class. The traffic stability within can be maintained.

  In other words, by applying QoS, the VoIP communication 100 classified as class 1 is always performed normally. However, with QoS alone, a client PC (file that occupies a band abnormally in class 2 as shown in FIG. 5). The class 2 bandwidth is occupied by the PC 102 on which the exchange software is operating, the PC infected with the virus, etc.) 102, and communication of the general client PC 101 cannot be performed normally. In this situation, by applying DCC, as shown in FIG. 4, communication of the abnormal client PC 102 is classified into class 3 and restricted as indicated by a thin line arrow in FIG. In class 2, it will be performed normally as indicated by the thick arrow in the figure.

  In addition, when classifying packets using QoS in this way, as a criterion for classification, as described above, services such as VoIP that do not allow packet discard are classified into different classes, and temporarily for legitimate reasons. This legitimate service may be classified into another class so that a service occupying a large bandwidth is not suppressed by DCC.

  In the above-described embodiment, the case where the DCC is applied to a specific class when the packet is classified using the QoS technology has been described. However, even when the QoS technology is not applied and the classification is not performed, all packets are classified. May be applied. In this case, the communication restriction is only the interruption of communication.

<< Effects of Embodiment >>
As described above, according to the router device described in this embodiment, the following effects can be obtained.

  It is possible to dynamically change the transmission priority / reception priority or transmission band / reception band according to the bandwidth occupancy rate of the flow for each client, or limit communication such as blocking transmission / reception .

  The time for applying the communication restriction can be arbitrarily set.

  Transmission / reception bandwidth thresholds that trigger communication restrictions can be set arbitrarily from the perspective of both the transmission source client and the transmission destination client. Either the upstream bandwidth or downstream bandwidth, or both at the same time Can manage traffic.

  Even in an environment where NAT or VPN is used, flow control in units of clients is possible.

  If there is a device such as a server device that is allowed to occupy the transmission / reception bandwidth, it is possible to exclude those devices from the monitoring target of the transmission / reception bandwidth.

  Only the client that occupies the bandwidth is limited, and other clients are not affected at all.

  A communication blocking mechanism for a general P2P application must detect a communication packet by specifying a target application, and needs to be individually handled each time a new type of P2P application becomes popular. In the DCC, communication of a P2P application can be regarded as abnormal traffic and communication can be cut off because of general-purpose characteristics, so the target application does not matter. This is also effective for a large amount of traffic generated from a PC infected with a virus, and it is possible to prevent secondary infection due to security damage.

  In an environment that cannot be differentiated for each user, such as inhabitants of a condominium or an Internet cafe, it is regarded as a problem to allocate a bandwidth for each user in advance, so according to the traffic flow for each user as in the present invention. A dynamic control mechanism is effective.

  There is no restriction that DHCP must be used as disclosed in Japanese Patent Laid-Open No. 2002-271359, and the network environment is not restricted. Further, unlike the “Japanese Patent Laid-Open No. 2002-271359”, the transmission / reception bandwidth is monitored only for clients that are actually communicating without wastefully using address resources. As in “2002-271359 gazette”, the bandwidth is not wasted, and the bandwidth can be effectively used.

1 Router device 10 CPU
11 Flash memory 12 RAM
13 Layer 2 switch chip 14 LAN side port 15 PHY chip 16 WAN side port 20 WAN
21 LAN
C1 class 1
C2 class 2
C3 class 3
100 Client performing VoIP communication 101 General client 102 Client with abnormal traffic

Claims (11)

A router device that transfers communication packets between two networks,
Packets transferred between the two networks are classified into a plurality of classes having different priorities or bandwidths based on the attributes of the packets, and the packets are transferred with priorities or bandwidths corresponding to the respective classes. QoS transfer control means for
Monitoring means for monitoring the amount of communication with the other network by a plurality of clients connected to the one network for each client flow in at least one class;
When the traffic volume of any client in any of the monitored classes exceeds a predetermined value, the packets of the flow of the client whose traffic volume has exceeded are classified into a class with a low priority or a class with a low bandwidth. Communication restriction means for restricting communication of the client by changing
Router device equipped with.   The router device according to claim 1, wherein the class with the narrow bandwidth is set to a variable bandwidth by dynamic traffic control with the monitored class. A router device that transfers communication packets between two networks in one or more classes,
Monitoring means for monitoring the amount of communication with the other network by a plurality of clients connected to the one network for each client flow in at least one class;
When the traffic volume of any client in a monitored class exceeds a predetermined value, the communication of the client of the flow exceeding the traffic volume is blocked, thereby restricting the communication of the client. Communication restriction means to
Router device equipped with.   The communication restriction unit sets a specific client as an excluded client, and does not restrict the communication even if the amount of communication in any of the monitored classes of the excluded client exceeds the predetermined value. The router device according to claim 3.   5. The router device according to claim 1, wherein the communication restriction unit can set at least one of a source or destination IP address and a source or destination port number. The monitoring means monitors the traffic of one or both of a transmission packet transmitted to the other network and a reception packet received from the other network by each client,
When the communication amount of the transmission packet or the reception packet of any client exceeds a predetermined value, the communication restriction unit, for the packet on the side where the communication amount exceeds the predetermined value among the transmission packet and the reception packet, The router device according to claim 1, wherein the communication is restricted. The monitoring means monitors the traffic of one or both of a transmission packet transmitted to the other network and a reception packet received from the other network by each client,
6. The communication restriction unit restricts the communication for both the transmission packet and the reception packet when the communication amount of a transmission packet or reception packet of any client exceeds a predetermined value. The router apparatus in any one of.   The router device according to claim 6 or 7, wherein the communication restriction unit can freely set a packet to be monitored or a packet to be restricted among transmission packets and reception packets. The two networks are a wired local area network and a wide area network;
The QoS transfer control means, the monitoring means, and the communication restriction means perform the above processing on a packet transferred from the wired local area network to the wide area network (hereinafter referred to as WAN). The router device according to claim 5.   The router apparatus according to claim 1, wherein the communication restriction unit releases the restriction of communication after a predetermined time has elapsed from the start of restriction. A router device that transfers communication packets between two networks,
Packets transferred between the two networks are classified into a plurality of classes having different priorities or bandwidths based on the attributes of the packets, and the packets are transferred with priorities or bandwidths corresponding to the respective classes. QoS transfer control means;
Monitoring means for monitoring the traffic of the plurality of clients connected to one network with the other network for each client in at least one class;
When the traffic volume of any client in any of the monitored classes exceeds a predetermined value, a class or bandwidth with a low priority is set to at least packets transmitted or received by the client whose traffic volume has exceeded in that class. Communication restriction means for restricting communication of the client by changing the classification into a narrow restriction class;
Setting means for setting the number of the restriction classes and the priority or bandwidth thereof;
Router device equipped with.

Images