JP5185862B2 - Traffic observation and control system - Google Patents

Description

  The present invention relates to a traffic observation / control system, and relates to a traffic observation / control system for observing and controlling traffic flowing in a network.

  Various communications are performed on the Internet. During communication, there is a possibility of inconvenience others, such as normal traffic such as browsing the WEB, file transfer by FTP, infection activity due to computer virus, DoS attack against specific server from virus infected PC Is mixed with traffic.

  For this reason, ISPs and corporate network management departments may analyze the traffic flowing through the network and perform processing to limit some traffic communications that are determined to be undesirable. Specifically, when traffic generated by file exchange software such as P2P software is pressing on the bandwidth of the network, the bandwidth of the traffic may be limited.

  In the traffic analysis, it is necessary to input the traffic to be analyzed into the analyzer by some method. Japanese Patent Application Laid-Open No. 2004-151867 is a system for observing and analyzing network traffic, a method of copying traffic to be analyzed by a traffic observation device to a dedicated line and transferring it to an analysis device, and a copying method to a shared line and an analysis device A method of transferring to is disclosed.

JP 2007-184799 A

When observing and controlling traffic on the Internet, if all of the traffic is to be observed, the amount of processing that accompanies the observation is usually enormous.
In the method described in Patent Document 1, no consideration is given to a method of transferring the traffic to be analyzed using the same line as other normal traffic. For this reason, when the traffic to be analyzed is transferred using the same line as other normal traffic, the possibility of affecting the normal traffic cannot be excluded.

  The above-described problems are a mark adding device for adding a mark for identifying a packet included in the session according to a condition derived from a packet flowing in the network, and a traffic analyzing device for copying the packet to which the mark is attached. A traffic duplicating device that forwards to the network, a bandwidth control device that performs bandwidth control on the traffic of the instructed session, a traffic analysis device that analyzes the content of the packet with the transferred mark and outputs the analysis result, and This can be solved by a traffic observation / control system comprising a control instruction device that outputs a command to the bandwidth control device in accordance with the output from the traffic analysis device.

  According to the present invention, in communication flowing on a network, the traffic to be analyzed does not affect other traffic beyond a certain level. Therefore, it can be transferred to the traffic analyzer via the same network as other traffic. Therefore, it is possible to transfer the analysis target traffic to an arbitrary analysis device connected to a normal network, and it becomes possible to observe and analyze the traffic between remote bases.

1 is a block diagram of a network including a device for observing and controlling traffic. It is a hardware block diagram of a communication terminal. It is a hardware block diagram of a traffic control device. It is a hardware block diagram of a mark provision apparatus. It is a figure explaining session management data. It is a figure explaining packet management data. It is a flowchart explaining the process of a mark provision apparatus. It is a hardware block diagram of a traffic duplication device. It is a flowchart explaining the process of a traffic duplication apparatus. It is a hardware block diagram of a band control device. It is a figure explaining transfer rate conversion data. It is a figure explaining control policy data. It is a flowchart explaining the process of a bandwidth control apparatus. It is a hardware block diagram of a traffic analyzer. It is a figure explaining traffic analysis data. It is a hardware block diagram of a control instruction device. It is a figure explaining controlled object conversion data. It is a figure explaining control level conversion data. It is a figure explaining control instruction data. It is a flowchart explaining the process of a control instruction | indication apparatus. It is a sequence diagram between a communication terminal and a traffic observation / control system. FIG. 6 is a block diagram of another network including a device that performs traffic observation and control.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings using examples. Note that the same reference numerals are assigned to substantially the same parts, and the description will not be repeated.

  In FIG. 1, a communication system 1000 includes a network 100, two traffic control devices 300 connected to the network 100, a control instruction device 700, a bandwidth control device 500, and two devices connected to the traffic control device 300-1. Communication terminal 200, traffic analysis apparatus 600, two communication terminals 200 connected to traffic control apparatus 300-2, traffic duplication apparatus 800 connected to band control apparatus 500, and traffic duplication apparatus 800. The mark providing device 400 and two communication terminals 200 connected to the mark applying device 400 are configured. The traffic analysis device 600 is also directly connected to the control instruction device 700.

  The communication terminal 200 is a terminal that performs network communication. The network communication described here specifically refers to communication using a TCP / IP protocol. The same applies to terms such as communication and network communication described below in this embodiment. These communication terminals 200 indicate a PC on which communication software such as a WEB browser and an FTP client is installed, and a server machine on which server software such as a WEB server and an FTP server is installed.

  The traffic control device 300 is a device that transfers packets in network communication. Examples of the device corresponding to the traffic control device 300 include a router and a switch. The traffic analysis device 600 analyzes the content of traffic transferred from the traffic control device 300. The traffic analysis device 600 generates traffic control information from the analysis result. The traffic analysis device 600 transfers the generated traffic control information to the control instruction device 700.

  The control instruction device 700 selects an appropriate bandwidth control device 500 based on the traffic control information (only one is shown in FIG. 1). The control instruction device 700 executes a control command for the selected bandwidth control device 500.

  The bandwidth control device 500 controls the bandwidth of traffic that passes therethrough. The bandwidth control device 500 may be implemented as a device in which a bandwidth control function is added to devices such as routers and switches similar to the traffic control device 300.

  The traffic duplicating device 800 duplicates a part or all of the traffic passing therethrough. The traffic duplicating device 800 transfers the duplicated traffic to the traffic analyzing device 600. The traffic duplication device 800 may be implemented as a device in which a traffic duplication function is added to devices such as routers and switches similar to the traffic control device 300.

  The mark imparting device 400 imparts a mark to a part of the traffic that passes therethrough. The mark assignment device 400 may be implemented as a device in which a mark addition function is added to devices such as routers and switches similar to the traffic control device 300.

The hardware configuration of the communication terminal will be described with reference to FIG. In FIG. 2, a communication terminal 200 is a terminal that is connected to a network such as the Internet and has a built-in program for communication. The communication terminal 200 includes a CPU 202, an input / output device 203, an interface (IF) 204 for performing communication, and a memory 210, which are connected via a data bus 206. The interface 204 is connected to the communication path 205. The memory 210 stores a communication program 211. The communication program 211 describes a process for communicating with other devices via the interface 204 and the communication path 205. The communication program 211 is a web browser, a web server mail client, a mail server, or the like. Note that each communication terminal 200 described in FIG. 1 may include a program for realizing a different function.

  The hardware configuration of the traffic control device will be described with reference to FIG. In FIG. 3, a traffic control device 300 is connected to a network such as the Internet and transfers a packet exchanged on the network to an appropriate route. The traffic control device 300 includes a CPU 314, an input / output device 304, a packet transfer interface 302, a control interface 306, a memory 313, and a packet processing device 303. The traffic control device 300 is connected to these devices via data buses 310 and 308. The control interface 306 is connected to an external network via the communication path 305. The control interface 306 is an interface for controlling the traffic control device 300 mainly from the outside of the device.

  The packet processing device 303 has two interfaces 302 connected via a data bus 308. The interface 302 is connected to the communication path 307. An interface 302 that connects the packet processing device 303 to an external network receives a packet from the external network. The packet processing device 303 selects an appropriate interface 302 that outputs a packet. The packet processing device 303 transmits a packet from the selected interface 302.

  The traffic control device 300 normally includes a plurality of interfaces connected to such an external network. The configuration of the traffic control device 300 is not necessarily limited to the configuration shown in FIG. 3 as long as the device has a function of transferring packets, such as the above-described router and switch.

  With reference to FIG. 4, the hardware configuration of the mark assigning apparatus will be described. In FIG. 4, a mark assigning device 400 includes a CPU 405, a memory 420, an input / output device 404, a packet processing device 403, a control interface 407, and two packet transfer interfaces 402 connected by data buses 409 and 410, respectively. The configuration of the mark imparting device 400 is the same as that of the traffic control device 300. The memory 420 stores a mark assigning program 421, session management data 422, and packet management data 423. The control interface 407 is connected to the communication path 406. The two packet transfer interfaces 402 are connected to the communication path 408, respectively.

  With reference to FIG. 5, the details of the session management data held by the mark assigning apparatus will be described. In FIG. 5, the session management data 422 holds a plurality of records in which the source IP address 11, source port number 12, destination IP address 13, destination port number 14, protocol 15, and packet transfer rate 16 are recorded. In the session management data 422, the source IP address 11, the source port number 12, the destination IP address 13, the destination port number 14, and the protocol 15 specify a session (set of a series of packets) from communication flowing through the network. It is data for. The packet transfer rate 16 records the rate at which packets included in the session pass through the mark assigning device 400.

  The former data is information used when transmitting / receiving a packet on a TCP / IP network, and is used for specifying a session. Packets having the same value for these five items are defined as belonging to the same session. The packet passing speed 16 indicates how fast a packet belonging to the session specified by the source 1P address 11 to the protocol 15 passes through the mark adding device. Here, the packet passing speed 16 is defined as packets / second, but may be bytes / second or the like.

  With reference to FIG. 6, the details of the packet management data held by the mark assigning apparatus will be described. The packet management data 423 is a table for holding the passage time of packets passing through the mark assigning device 400 for each session. The packet management data 423 holds a plurality of records in which a source IP address 21, a source port number 22, a destination IP address 23, a destination port number 24, a protocol 25, and a packet passage time holding area 26 are recorded. The source IP address 21, the source port number 22, the destination IP address 23, the destination port number 24, and the protocol 25 are used to define a session on the TCP / IP network, similarly to the item having the same name in FIG. Information. The packet passage time holding area 26 is a packet of a session specified by the values of the transmission source 1P address 21 to the protocol 25, and records a certain number from the latest passage time of the packet that has passed through the mark assigning device 400 to the past. Has been. Specifically, the passage time of the latest 100 packets that have passed through the mark assigning device 400 is recorded.

  With reference to FIG. 7, the operation of the mark applying process of the mark applying apparatus will be described. This process is performed every time the packet passes through the mark assigning device 400. In FIG. 7, when receiving a packet, the mark assigning device 400 searches for session information to which the packet belongs from the header information of the packet. The mark assigning device 400 records the passage time of the packet in the packet passage time holding area 26. The mark assigning device 400 calculates the number of passing packets per unit time of the session (S11). For this purpose, the mark assigning device 400 refers to the packet transit time holding area 26 of the session that is the target of the packet management data 423, and the mark assigning device 400 determines the number of recorded packets as the oldest time and the newest time. The number of passing packets per fixed time is calculated by dividing by the difference. The mark assigning device 400 records the packet passing speed 16 of the corresponding session in the session management data 422. More specifically, when 100 packets are held in the packet passage time holding area and the difference between the oldest passage time and the latest passage time of these packets is 10 seconds, the packet passage speed of the session is 10 Packets / second.

The mark assigning device 400 refers to the value of the packet passing speed 16 in the session management data 422, and determines whether the calculated packet passing speed exceeds this value (S12). If the value exceeds a certain value (YES), the mark assigning device 400 sets a flag at a specific position in the header of the packet (S13) and ends. When step 12 is NO, the mark assigning device 400 ends as it is.
A field for setting a flag is arbitrary as long as it does not affect normal TCP / IP communication, but here, a CoS (Class of Service) field is used.

The hardware configuration of the traffic duplicating apparatus will be described with reference to FIG. In FIG. 8, a traffic duplicating apparatus 800 includes a CPU 805, a memory 820 , an input / output device 804, a packet processing device 803, a control interface 807, and two packet transfer interfaces 802 connected by data buses 809 and 810, respectively. A communication path 806 is connected to the control interface 807. A communication path 808 is connected to each of the two packet transfer interfaces 802. The configuration of the traffic duplicating device 800 is the same as that of the traffic control device 300. The memory 820 stores a traffic replication program 821.

  With reference to FIG. 9, the traffic duplicating operation of the traffic duplicating apparatus will be described. This process is executed each time a packet is input from the packet transfer interface 802-1 or 802-2.

  In FIG. 9, the traffic duplicating device 800 checks whether or not a flag is set in the CoS field of the packet header (S21). The traffic duplicating device 800 determines whether the flag is marked (S22). If YES, the traffic duplicating device 800 copies the packet and transfers the copy to the bandwidth control device (S23). The traffic duplicating device 800 deletes the original mark, transfers it to the bandwidth control device (S24), and ends. If NO in step 22, the traffic duplicating device 800 ends as it is.

In step 23, the destination IP address of the copy packet remains the original destination IP address, but the traffic duplicating device 800 controls the copy to be finally transferred to the traffic analysis device 600. In step 24, the original is transferred to the destination IP address of the packet.

  With reference to FIG. 10, the hardware configuration of the bandwidth control apparatus will be described. In FIG. 10, a bandwidth control device 500 includes a CPU 505, a memory 520, an input / output device 504, a packet processing device 503, a control interface 507, and two packet transfer interfaces 502 connected by data buses 509 and 510, respectively. A communication path 506 is connected to the control interface 507. A communication path 508 is connected to each of the two packet transfer interfaces 502. The configuration of the bandwidth control device 800 is the same as that of the traffic control device 300. The memory 520 stores a bandwidth control program 521, transfer rate conversion data 522, and control policy data 523. An example of such a device is a packet shaper.

  The transfer rate conversion data of the bandwidth control device will be described with reference to FIG. In FIG. 11, transfer rate conversion data 522 describes what control policy the bandwidth control program 521 applies to which session. The transfer rate conversion data 522 is composed of a plurality of records including a transmission source IP address 31, a transmission source port number 32, a destination IP address 33, a destination port number 34, a protocol 35, and a control level 36. Here, the source IP address 31, the source port number 32, the destination IP address 33, the destination port number 34, and the protocol 35 are information used for defining a session on the TCP / IP network. On the other hand, the control level 36 is data that specifies what type of control is performed on the session data determined by the source IP address 31 to the protocol 35.

  The control policy data of the bandwidth control device will be described with reference to FIG. In FIG. 12, the control policy data 523 is composed of a plurality of records configured with a control level 41 and a maximum transfer rate 42. The control level 41 is an identifier indicating the type of control corresponding to the control level 36 in FIG. The maximum transfer rate 42 is the maximum value of the traffic transfer rate permitted at the corresponding control level.

  With reference to FIG. 13, the bandwidth control processing of the bandwidth control device will be described. The bandwidth control process is a process that is executed every time a packet is input to the packet processing device 503 of the bandwidth control device 500.

  The bandwidth control device 500 acquires the header information of the packet input to the packet input device 503 (S31). The bandwidth control device 500 determines whether a flag is set (marked) in the CoS field of the packet header (S32). If YES, the bandwidth control device 500 performs bandwidth control on the marked packet (S33). Specifically, for the packet, the bandwidth control device 500 limits the upper limit of the packet transfer rate. The bandwidth control device 500 transfers the packet to the traffic analysis device 600 via the network 100 and the traffic control device 300-1 without affecting other traffic. Here, the upper limit of the packet transfer rate is a value separately designated from the outside and held in the memory. Note that such bandwidth control is realized as one function of the packet shaper.

When NO is determined in step 32, the bandwidth control device 500 refers to the transfer rate conversion data 522 shown in FIG. 11 and determines whether the session information is the control target (S34). If it is a session to be controlled (YES), the bandwidth control device 500 executes normal traffic control (S35) and ends. Specifically, the bandwidth control device 500 acquires from the control level 36 the type of control performed on the target session from the control information conversion data. Further, the bandwidth control device 500 acquires the maximum transfer rate corresponding to the control level from the control policy data 523. Furthermore, the bandwidth control device 500 performs bandwidth control for the target session. Bandwidth control is performed by designating an upper limit of the transfer rate for the traffic of the target session.
If NO in step 34, the bandwidth control device 500 ends as it is.

  With reference to FIG. 14, the hardware configuration of the traffic analysis apparatus will be described. In FIG. 14, a traffic analysis device 600 is connected to a CPU 604, a memory 610, an input / output device 603, and a communication interface 602 via a data bus 606. A communication path 605 is connected to the communication interface 602. The configuration of the traffic analysis device 600 is the same as that of the communication terminal 200. The memory 610 stores a traffic analysis program 611 and traffic analysis data 612. The traffic analysis device 600 transmits traffic analysis data 612 that is an analysis result to the control instruction device 700.

  The traffic analysis program 611 analyzes the content of the analysis target traffic input from the communication interface 602 and identifies the type of application used for communication. Specifically, the traffic analysis program 611 checks the content of the packet of the analysis target traffic. Processing such as “when a packet included in a session includes a character string unique to communication using Winny, it is determined that Winny communication is being performed in that session” is performed. Whether or not the traffic input from the communication interface 602 is the analysis target traffic is determined by looking at the header information of the packet included in the traffic. For example, in the packet input to the traffic analysis device 600, the traffic whose destination IP address is not the traffic analysis device 600 is analyzed as the traffic to be analyzed. Here, the traffic whose destination IP address is not the traffic analysis device 600 is a packet copied by the traffic duplicating device 800.

  The traffic analysis data will be described with reference to FIG. In FIG. 15, the traffic analysis data 612 includes a plurality of records including a transmission source IP address 51, a transmission source port number 52, a destination IP address 53, a destination port number 54, a protocol 55, and an application type 56. The source IP address 51, source port number 52, destination IP address 53, destination port number 54, and protocol 55 are information used to define a session on the TCP / IP network. The application type 56 is a type of application used in the session specified by the source IP address 51 to the protocol 55. The application type 56 is determined and written by the traffic analysis program 611.

The hardware configuration of the control instruction device will be described with reference to FIG. In FIG. 16, a control instruction device 700 is connected to a CPU 704, a memory 710, an input / output device 703, and a communication interface 702 via a data bus 706. The communication interface 702 is connected to the communication path 705. The configuration of the control instruction device 700 is the same as that of the communication terminal 200. The memory 710 stores a control instruction program 711, control target conversion data 712, control level conversion data 713, and control instruction data 714.

  The control target conversion data will be described with reference to FIG. In FIG. 17, the control target conversion data 712 stores correspondence between the IP address 61 of the terminal that actually performs communication and the IP address 62 of the control device that controls the network including the terminal in a plurality of records. Yes. The terminal IP address 61 is an IP address of a terminal that actually connects to the network.

  In the network 1000 of FIG. 1, communication terminals 200-5, 200-6, etc. correspond to this. The terminal IP address can be specified by a subnet range. The control device IP address 62 is an IP address of the bandwidth control device 500, and controls the bandwidth of communication performed by a communication terminal connected to the bandwidth control device by controlling the bandwidth control device.

  Returning to FIG. 1, the communication terminals 200-5 and 200-6 are connected to the network 100 via the bandwidth control device 500. Therefore, the control instruction device 700 can control the bandwidth of communication performed by the communication terminals 200-5 and 200-6 by instructing the bandwidth control device 500 to perform control.

  The control level conversion data will be described with reference to FIG. In FIG. 18, control level conversion data 713 is a table for specifying which type of control is performed in accordance with the type of application output by the traffic analysis apparatus 600. The control level conversion data 713 holds a plurality of records that record the application type 71 and the control level 72. The application type 71 is an application type used for communication flowing through the network. The application type 71 covers application types output by the traffic analysis device 600. The control level 71 is an identifier indicating which level of control is performed for the corresponding type of application.

  The control instruction data will be described with reference to FIG. 19, the control instruction data 714 includes a plurality of source IP addresses 81, a source port number 82, a destination IP address 83, a destination port number 84, a protocol 85, a control device IP address 86, and a control level 87. Hold records. The source IP address 81, source port number 82, destination IP address 83, destination port number 84, and protocol 85 are information used to define a session on the TCP / IP network. The control device IP address 86 indicates the IP address of the control device that transmits a control command in order to control the session specified by the information of the source IP address 81 to the protocol 85. The control level 87 is an identifier indicating what type of control is performed for the session specified by the information of the source IP address 81 to the protocol 85.

  With reference to FIG. 20, the control instruction process of the control instruction apparatus will be described. In FIG. 20, the control instruction device 700 transmits control information to an appropriate bandwidth control device from the session information output from the traffic analysis device 600 and the application information used in the session.

  The control instruction device 700 acquires the traffic analysis result input from the communication interface 702 (S41). Specifically, step 41 is a process of writing the session information to the source IP address 81 to the protocol 85 of the control instruction data 714. The traffic analysis result is input in a format including each item of the traffic analysis data 612 described with reference to FIG.

  Based on the session information included in the traffic analysis result acquired in step 41, the control instruction device 700 refers to the control target conversion data 712 and identifies a bandwidth control device that issues a control command (S42). This step is a process of writing in the item of the control device IP address 86 corresponding to the session information. The control instruction device 700 acquires the control device IP address corresponding to the transmission source IP address of the traffic analysis result from the control target conversion data 712. In addition to this, a control device IP address corresponding to the destination IP address can also be acquired. Furthermore, it is possible to acquire a control device IP address corresponding to each of the transmission source IP address and the destination IP address.

  The control instruction device 700 specifies the control level with reference to the control instruction data 714 from the application type included in the traffic analysis result acquired in step 41 (S43). Step 43 is a process of acquiring the control level corresponding to the session information from the control level conversion data 713 and writing it in the item of the control level 87.

  The control instruction device 700 transmits a control execution command based on the table of the control instruction data 714 (S44) and ends. Specifically, a command is issued to control device IP address 86 so as to control the traffic of the session specified by source IP address 81 to protocol 85 with the value of control level 87.

With reference to FIG. 21, what kind of traffic control is performed in each apparatus described above as the entire traffic observation / control system will be described.
Here, it is assumed that the communication terminal 200-5 transmits a large amount of data to the communication terminal 200-3. This data transmission session can be specified by the IP addresses, port numbers, and protocols used by the communication terminals 200-5 and 200-3. Now, this communication application is P2P_Winny (Winny of P2P communication software), and this communication is performed at a transfer speed (which is subject to mark application by the mark application device 400) of a certain level or higher. P2P_Winny is an application of control level A, and the maximum transfer rate of control level A in the bandwidth control apparatus is 128 kbit / s. The control device that controls the traffic of the communication terminal 200-5 is the bandwidth control device 500, and the information is described in the control target conversion data 712.

  First, the communication terminal 200-5 starts a large amount of data transmission to the communication terminal 200-3 (S51). Here, the communication session is indicated by a single arrow from the communication terminal 200-5 to the communication terminal 200-3, but is actually transferred by each intermediate device. Also, the transfer timing is not in the order shown. This is because the description will be given focusing on mirror traffic. For the communication of this session, the mark assigning device 400 assigns a mark to the packet included in the session (S52).

  The traffic duplicating device 800 creates a duplicate for the packet with the mark (S53). The traffic duplicating device 800 transmits the duplication to the bandwidth control device 500 (S54). The traffic duplicating device 800 deletes the original mark (S56) and transmits it to the bandwidth control device 500. The bandwidth control device 500 performs bandwidth control for the mirror traffic (S57). The bandwidth control device 500 transfers the mirror traffic to the traffic analysis device 600 (S58).

  The traffic analyzer 600 analyzes the transferred traffic (S59). The traffic analysis device 600 specifies that the content of this communication is P2P_Winny. The traffic analysis device 600 transfers the analysis result to the control instruction device 700 (S61).

  The control instruction device 700 evaluates the analysis result (S62). The control instruction device 700 issues a control command for performing control at the control level A to the bandwidth control device 500 in order to limit the traffic of the communication terminal 200-5 (S63).

  The bandwidth control device 500 receives the control command of the control level A for the target session, and performs data transmission of the communication terminals 200-5 and 200-3 so as to perform communication at the control level A, that is, the maximum transfer rate 128 kbit / s. The session is controlled (S64).

  According to the above-described embodiment, the mark applying device has a single configuration. However, it is good also as a communication system provided with a some mark provision apparatus by changing this. The communication system configuration in this case will be described with reference to FIG. In FIG. 22, the communication system 1000 </ b> A includes a network 100, a bandwidth control device 500, a traffic duplicating device 800, two mark assigning devices 400, and four communication terminals 200. In FIG. 22, the illustration of the traffic control device 300, the traffic analysis device 600, and the control instruction device 700 on the opposite side connected to the network 100 is omitted.

  The network 100 directly connects the bandwidth control device 500. The bandwidth control device 500 connects the traffic duplicating device 800. The traffic duplicating device 800 connects two mark assigning devices 400. A sub-network consisting of communication terminals 200-7 and 200-8 is connected to the mark assigning device 400-1. A sub-network consisting of communication terminals 200-9 and 200-10 is connected to the mark assigning device 400-2.

  Packets to which marks are attached by the mark assigning devices 400-1 and 400-2 are transferred to a traffic analysis device 600 (not shown) connected to the network 100 via the traffic duplicating device 800 and the bandwidth control device 500. Here, the functions of the traffic duplicating device 800 and the bandwidth control device 500 are the same as those described in the above embodiment.

  According to this embodiment, the flexibility of the installation location of the mark applying device is increased, and a flexible system in which the number of the mark applying devices 400 is increased without further loading the traffic duplicating device 800 and the bandwidth control device 500. Can be configured.

  According to the above-described embodiment, in the communication flowing on the network, the traffic to be analyzed is transferred to the traffic analysis device via the same network as the other traffic without affecting the other traffic more than a certain level. can do. This makes it possible to observe and analyze traffic between remote sites.

Further, the embodiment described above can be implemented as follows with a part thereof being changed.
(1) According to the embodiment, the bandwidth control device 500, the traffic duplicating device 800, and the mark assigning device 400 are physically implemented as separate devices, but these are changed to physically change these functions. It may be mounted in one device.
According to this modified embodiment, it is possible to reduce the number of devices, reduce the cost of hardware, and construct a system with a simple configuration.

  (2) In the mark assigning program 421, the method for assigning a mark to a packet does not necessarily need to be based on the number of packets passing through the apparatus per unit time. Any method may be used as long as the packet is added according to the method.

As conditions other than those described above, it is possible to change that a mark is added to a packet under the condition that “the destination port number is a specific port (for example, port 80)”. Further, a condition that “a specific character string (for example, a character string unique to P2P software) is included in the payload of the packet” can be set.
According to this modified embodiment, it is possible to construct a system that can deal with incidents having various characteristics by making the format for setting the condition for providing a mark flexible.

(3) Instead of performing packet mirroring in the traffic duplicating device 700, information calculated from a packet with a mark may be transmitted to the traffic analyzing device 600. Specifically, a certain number of upper IP addresses of hosts (packets with a mark) having a high packet passing speed are transmitted to the traffic analysis device 600. The traffic analyzer may be configured to perform a possible analysis using these IP addresses.
According to this modified embodiment, it is possible to reduce the load on the traffic analyzer by causing the traffic duplicator to perform part of the calculations performed by the traffic analyzer.

  (4) Band control in the band control device 500 may be performed by blocking the relevant traffic or changing the route. In this case, the control policy data may be changed and provided so as to include data indicating the type of control (band limitation, blocking, route change) and parameters necessary for performing control of that type.

In the case of a route change, this parameter is data of an IP address indicating a device to which the corresponding traffic is transferred next. In the route change, the traffic to be controlled is transferred to a device different from the normal traffic, so that the detailed analysis of the corresponding traffic, the storage of the packets included in the traffic, or simply the storage of those packets. It is conceivable to perform processing such as discarding. Note that no special additional parameters are required for shutoff.
According to this modified embodiment, more flexible traffic control can be performed.

(5) Band control in the band control device 500 may be implemented by first cutting off all traffic and changing it so as to pass only traffic permitted by the control instruction device 700.
According to this modified embodiment, it is possible to construct a more robust network by passing only traffic that is found to be safe as a result of analysis.

  DESCRIPTION OF SYMBOLS 100 ... Network, 200 ... Communication terminal, 300 ... Traffic control apparatus, 400 ... Mark assignment apparatus, 500 ... Band control apparatus, 600 ... Traffic analysis apparatus, 700 ... Control instruction | indication apparatus, 800 ... Traffic duplication apparatus, 1000 ... Communication system.

Claims (9)

A mark assigning device for assigning a mark for identifying a packet included in the session according to a condition derived from a packet flowing through the network;
A traffic duplicating device that copies the packet with the mark and forwards it to the traffic analyzing device;
A bandwidth control device that performs bandwidth control for traffic between the session that has received the instruction and the copy ;
Analyzing the contents of the packet with the transferred mark and outputting the analysis result; and
A traffic observation / control system comprising a control instruction device that outputs a command to the bandwidth control device in accordance with an output from the traffic analysis device. The traffic observation / control system according to claim 1,
The traffic observing / controlling system characterized in that the condition derived from a packet flowing through the network is a condition that an amount of traffic passing through the mark assigning device per unit time is larger than a predetermined amount. The traffic observation / control system according to claim 1 or 2,
In the bandwidth control, a traffic observation and control system is characterized in that an upper limit value of a traffic amount passing through a bandwidth control device per unit time is determined, and traffic is controlled so as not to exceed the upper limit value. The traffic observation / control system according to any one of claims 1 to 3,
The traffic analysis apparatus estimates the software generating the traffic from the transferred traffic and includes the information of the software in the analysis result. The traffic observation / control system according to any one of claims 1 to 4,
Functions of two devices selected from the mark adding device, the traffic duplicating device, the bandwidth control device, the traffic analysis device, or the control instruction device are mounted in the physically same device. Traffic observation and control system characterized by The traffic observation / control system according to any one of claims 1 to 4,
A traffic observation / control system comprising a plurality of the mark applying devices. The traffic observation / control system according to any one of claims 1 to 4,
The band control device is a traffic observation / control system characterized by blocking traffic or changing a route. The traffic observation / control system according to any one of claims 1 to 4,
The band control device blocks all traffic and allows only traffic permitted in accordance with an instruction from the control instruction device to pass therethrough. The traffic observation / control system according to any one of claims 1 to 4,
One or more functions of the mark adding device, the traffic duplicating device, the bandwidth control device, the traffic analysis device, or the control instruction device are implemented as a software program. system.

Images