KR102371060B1 - Design of network topology discovery system based on traffic in-out count analysis - Google Patents

Abstract

A network topology discovery system through network traffic input/output analysis is disclosed. A network topology discovery method according to an embodiment includes: discovering network devices existing within an IP range of a target network; and discovering a network topology based on analysis of network traffic input/output for the discovered network devices.

Description

Network topology discovery system through network traffic input/output analysis {DESIGN OF NETWORK TOPOLOGY DISCOVERY SYSTEM BASED ON TRAFFIC IN-OUT COUNT ANALYSIS}

The description below relates to a method and system for discovering a network topology.

With the rapid development of science and technology and the advent of high-speed networks, today's network environment is getting more complex and growing day by day. In particular, a large amount of traffic is generated due to the advent of various applications, and this trend is expected to further accelerate due to the development of 5G networks and edge computing technologies. Due to the emergence of various applications and the generation of a large amount of traffic, various problems such as network traffic overload, malicious behavior, and network quality deterioration are occurring. These problems cause great damage when they target economic institutions such as banks and stocks, or important institutions within the state and corporations.

In order to solve this problem, the network administrator must continuously monitor the network equipment. Through network monitoring, it is possible to quickly respond not only to abnormal behaviors occurring from the outside, but also to failures such as network traffic overload. Recently, various companies or organizations are using a network management system (NMS) to efficiently manage their networks. The network administrator performs network resource management, network equipment management, and various performance policy settings through NMS. In addition, it performs warning and response functions for events that affect system performance through continuous network equipment status monitoring.

In order to effectively monitor network equipment, an administrator must know exactly the topology of the network equipment. For example, when traffic overload occurs in a specific subnetwork, an appropriate resource management policy can be set for the corresponding subnetwork according to the connection configuration of network equipment.

However, as the number of network devices increases, it is difficult to accurately identify the connections of all devices. In particular, the existing network topology search method is inefficient because it is performed manually, and it takes a lot of time and money. In addition, if the network topology discovery is performed manually, there is a high possibility of misconfiguring the connection of network equipment, and if configured incorrectly, serious damage may occur in an emergency situation. Therefore, it is necessary to proceed with research to efficiently explore the network topology.

It is possible to provide a method and system for automatic network topology discovery based on traffic input/output analysis for efficient network management.

A network topology discovery method includes: discovering network devices existing within an IP range of a target network; and discovering a network topology based on analysis of network traffic input/output for the discovered network devices.

The step of discovering the network devices may include storing MIB information for device types and connection topology discovery of network devices existing within an IP range of the target network.

In the step of discovering the network devices, based on the stored MIB information through a response message that is responded to by broadcasting an SNMP GET message for all IPs within the IP range of the target network, existing within the IP range of the target network. detecting a network device, and determining a network device type of the detected network device.

The step of discovering the network devices may include receiving a network IP range and a community string of the target network as input data.

The step of discovering the network topology includes searching for connection information of a network device based on the MIB information stored for the discovered network devices, and a common IP in the static IP list of the network device and the dynamic IP list of other network devices. If there is, it may include the step of determining that the network equipment is connected.

The step of discovering the network topology may include comparing the traffic input/output including the amount of traffic coming into the port of the network device with the amount of traffic generated from the port of another network device for the discovered network devices, and connecting the ports of the connected network devices. It may include searching for information.

In the searching for the network topology, if the comparison results are similar or identical as the traffic input/output for a specific time is compared for the connected network devices, an index corresponding to each traffic input/output is searched, and the The method may include searching for port information mapped with the searched index through MIB information.

The step of discovering the network topology may include outputting a connection topology result including connection information of the discovered network device and port connection information of the discovered network device in the form of a csv file.

The network topology discovery system includes: a network device discovery unit configured to discover network devices existing within an IP range of a target network; and a connection topology search unit that searches for a network topology based on analysis of network traffic input/output for the discovered network devices.

The network device discovery unit may store MIB information for device type and connection topology discovery of network devices existing within an IP range of the target network.

The network equipment search unit, based on the stored MIB information through a response message that is responded to broadcasting an SNMP GET message for all IPs within the IP range of the target network, network equipment existing within the IP range of the target network and determine the network equipment type of the detected network equipment.

The connection topology search unit searches for connection information of a network device based on the MIB information stored for the discovered network devices, and when a common IP exists in the static IP list of the network device and the dynamic IP list of other network devices , it can be determined that the network devices are connected.

The connection topology search unit searches for port connection information of the connected network devices by comparing the traffic input/output including the amount of traffic coming to the port of the network device and the amount of traffic generated from the port of the other network device for the discovered network devices. can do.

The connection topology search unit searches for an index corresponding to each traffic input/output amount when the comparison results are similar or identical as the traffic input/output for a specific time is compared for the connected network devices, and the searched index You can search the port information mapped with the MIB through the MIB information.

The network topology discovery system according to an embodiment may discover connection information of each device more easily and conveniently by using SNMP. The network topology search system uses less MIB information and shortens the search time because it searches the connection topology by comparing the amount of outgoing and incoming traffic for each device port.

The network topology search system according to an embodiment may search for a connection topology regardless of a device type through traffic input/output comparison.

The network topology discovery system according to an embodiment is applicable even without MIB information of BRIDGE-MIB and ipRouteNextHop.

1 is a diagram for explaining an operation of a network topology discovery system according to an embodiment.
2 is a block diagram illustrating a configuration of a network topology discovery system according to an embodiment.
3 is a flowchart illustrating a network topology discovery method in a network topology discovery system according to an embodiment.
4 is a diagram for explaining a device connection discovery method of a network topology discovery system according to an embodiment.
5 is a diagram for explaining a port connection discovery method of a network topology discovery system according to an embodiment.
6 is an example for explaining network traffic input/output in a network topology discovery system according to an embodiment.
7 is a diagram for explaining deriving port connection information based on a traffic amount analysis in a network topology discovery system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining an operation of a network topology discovery system according to an embodiment.

The network topology search system may search the network topology according to the input/output of network traffic. In this case, the network topology may be searched in various network environments including wireless or wired. In the embodiment, the use of SMNP (Single Network Management Protocol) in order to obtain input/output information of network traffic will be described as an example.

The network topology discovery system may receive a target network IP range and a community string as input data ( 110 ). In this case, the target network IP range may mean a network IP range set for network topology discovery. The community string may mean a kind of password that authenticates the (SNMP) daemon and the client before exchanging data.

The network topology discovery system may discover network devices existing within an IP range of a target network ( 120 ). The network topology discovery system may detect the network equipment and determine the network equipment type. The network topology discovery system can store the MIB information of all network devices within the target network IP range. Specifically, the network topology discovery system may store MIB information required for network device discovery and connection topology discovery by using the SNMP GET message of the SNMP protocol to all network devices within the target network IP range. At this time, since the network device that stores MIB information targets the device that supports SNMP, data is not saved in case of IP that does not support SNMP or is invalid. For example, assuming that there are network devices of 10.1.1.6 and 10.1.1.10 within the IP range of 10.1.1.1 to 10.1.1.50, the MIB of 10.1.1.6, 10.1.1.10, which is a device supporting SNMP, within the IP range. Only information can be stored. However, if SNMP is not supported or the IP address is invalid, a Timeout message may be output after waiting for a specific time. In this case, if the network IP range is large, a considerable amount of time may be consumed. Accordingly, the network topology discovery system can proceed in parallel when broadcasting the SNMP GET message.

The network topology discovery system may store network device MIB information as shown in Table 1. In this case, ifInOctet (10 sec) and ifOutOctet (10 sec) may store information of ifInOctet and ifOutOctet, and store the amount of traffic after 10 seconds. Even if multiple network devices are connected to each other, ifInOctet(10 sec) information is stored to compare the amount of traffic generated by the port for a specific time period (for example, 10 seconds) because the traffic input/output may not necessarily be the same. can In other words, the connection can be detected by comparing the amount of traffic generated for a specific time (for example, 10 seconds) for each port of a specific device.

Table 1: Network Equipment MIB Information

The network topology discovery system may determine the type of the network device by using the device type determination information (sysServices) among the stored MIB information. In this case, sysServices, which is the device type determination information, is an integer value expressing the type of the network device in a decimal number. Converts sysServices to a 7-bit string, and each bit corresponds to the OSI 7 layer. For example, if sysServices is 6, it means equipment that supports layers 2 and 3 because it corresponds to 0000110 in binary. The network topology discovery system can determine the IP, MIB information, and device type of a device supporting SNMP through the stored network device MIB information and network device discovery.

The network topology search system may search the network topology based on the analysis of network traffic input/output for the discovered network devices ( 130 ). The network topology discovery system may discover connection information of each device. The network topology discovery system may discover connections between network devices and discover connected ports based on the discovered connections between network devices. The network topology discovery system can discover the connection between network devices by using the stored MIB information of ipNetToMediaTable. ipNetToMediaTable is MIB information corresponding to the ARP table, and the physical address, IP address, type, etc. of the connected network equipment can be known.

The network topology search system may search the network topology based on the analysis of network traffic input/output for the discovered network devices ( 130 ). The network topology discovery system may discover connection information of each device. The network topology discovery system may discover a connection between network devices and discover a connected port based on the discovered connection.

The network topology discovery system can use the traffic input/output for each port of the interface MIB Object. In this case, ifInOctet and ifOutOctet may be used as MIB information used. ifInOctet is the amount of incoming traffic for each port of the network device, and ifOutOctet is the amount of outgoing (generated) traffic for each port of the network device. The network topology discovery system can acquire a connection topology for each device by comparing two pieces of MIB information including ifInOctet and ifOutOctet.

The network topology discovery system may acquire connection topology information of each device. In this case, the connection topology information may include port connection information as well as connections between devices. Connection topology information is saved as a csv file, and the IP, type, and connection port of the device can be stored.

4 is a diagram for explaining a device connection discovery method of a network topology discovery system according to an embodiment.

The network topology discovery system may discover a connection between network devices based on the stored MIB information. When a connection between devices is discovered, the network topology discovery system may discover which port the connected network device is connected to through the port connection discovery algorithm of FIG. 5 . 4 shows a device connection discovery algorithm. The device connection discovery algorithm can use the lower MIB information of ipNetToMediaTable in Table 1. In this case, ipNetToMediaTable means including ipNetToMediaAddress and ipNetToMediaType.

First, a pair connected between network devices will be described as A and B. The network topology discovery system can check whether there is any stored connection information. If there is no connection between network devices, check the ipNetToMediaTable MIB information of the two devices. Obtain an IP list in which A's ipNetToMediaType corresponds to static and an IP list in which B's ipNetToMediaType corresponds to dynamic. If there is an IP included in common among the two IP lists, it is defined that the two network devices are connected. Here, since the network topology discovery system searches all connections between network devices, it can be defined that they are connected even if they are not directly connected. For example, assuming that among network devices A, B, C, and D, A, B, and C are connected in series, and D is not connected to any device, AB, AC, Connections in BC can be explored. In this case, A-C are not directly connected, but may be included as a defined connection.

5 is a diagram for explaining a port connection discovery method of a network topology discovery system according to an embodiment.

The network topology discovery system may select devices directly connected to the network through a port connection discovery algorithm. 5 shows a port connection discovery algorithm. The network topology discovery system may discover port connection information of directly connected network devices among connection information between network devices defined according to traffic input/output of a plurality of network devices.

Referring to FIG. 7 , the network topology discovery system may analyze the amount of traffic generated from each port for a specific time (eg, 10 seconds). For example, it is assumed that device A is connected to port 1 and device B is connected to port 2. The amount of traffic generated from port 1 of A for 10 seconds and the amount of traffic coming from port 2 of port B for 10 seconds may be similar or the same. In other words, the network topology discovery system can define that the two devices are connected when the amount of traffic generated by device A and the amount of traffic coming to device B are similar or identical. Alternatively, the amount of traffic coming from port 1 of A for 10 seconds and the amount of traffic coming from port 2 of B may be similar or the same. In other words, the network topology discovery system can define that the two devices are connected when the amount of traffic coming into port 1 of device A and the amount of traffic generated from device B are similar or identical. Alternatively, the network topology discovery system may derive port connection information between network devices according to a ratio range occupied by the amount of traffic of device B to the amount of traffic of device A.

In addition, in the network topology discovery system, the network ifInOuctet and ifOutOctet are stored for the same time in order to compare the input/output of network traffic. However, the network topology discovery system can compare the amount of traffic generated for a specific time (for 10 seconds) because the number of network devices is large or the stored time may be different depending on a specific situation. In other words, since the network topology discovery system may have different amounts of traffic depending on the response speed or execution time between devices, the amount of traffic generated during a specific time may be compared, and the network period between each device may be set differently.

In addition, the network topology discovery system can identify the interface connection information between network devices because it can know which port the traffic is generated and received with the same amount. Referring to FIG. 6 , it is an example of MIB information of ifOutOuctet. In FIG. 6 , traffic is generated at indices 14, 21, and 28, respectively, and if it matches the ifInOuctet of another network device, a port mapped to the index can be found. To find a mapped port, you can search for a port by using the ifName MIB information in Table 1.

Referring to the device port connection algorithm of FIG. 5 , an IP of a device supporting SNMP and stored MIB information may be input as input data. A connected device pair is defined as A and B, and ifInOuctet, ifOutOuctet, ifInOuctet(10 sec), ifOutOuctet(10 sec) for two network devices can be loaded. In this case, ifInOuctet (10 sec) and ifOutOuctet (10 sec) may mean the amount of traffic generated for 10 seconds. Next, the difference between ifInOuctet and ifInOuctet (10 sec) of the loaded network device A and the difference between ifOutOuctet and ifOutOuctet (10 sec) of the network device B are calculated, and each difference may be stored in a list. Stored difference values may be compared with each other. If the difference values are the same or similar, indices corresponding to ifInOuctet and ifOutOuctet, respectively, may be searched for two network devices. In this case, in the case of a connection between devices that are not directly connected found in the device connection algorithm of FIG. 4 , since the traffic input/output between the two devices is different, it may be excluded from the comparison process. Then, port information mapped with each index may be searched through ifName MIB information, and the discovered connection port information may be stored.

The network topology discovery system may finally output the connection topology as a result. The connection topology information consists of the IP of the device, the connection port, and the type information, and can be saved as a csv file. For example, the result output to the CSV file can be configured in the form of [device name/connection port/device IP], and connection information between two devices can be checked through one line. The saved csv file can represent the topology between devices in the network as a user interface (UI) by utilizing the database.

Furthermore, since all connection information in the target network is output as a result of the network topology discovery system, the csv file can be stored in the database, and more systematic and efficient network management can be performed through interworking between the database and the network monitoring system.

The network topology search system according to an embodiment may reduce the execution time through optimization and simplification of algorithms performed during equipment discovery.

The network topology discovery system according to an embodiment may discover connection information more easily and conveniently by using SNMP. Since the network topology discovery system only compares the amount of outgoing and incoming traffic for each device port, it takes less MIB information and less time.

The network topology discovery system according to an embodiment is applicable regardless of the type of equipment. Regardless of the type of network equipment such as L2 switch, L3 switch, or router, only the amount of traffic needs to be compared, so the same algorithm can be equally applied to various types of equipment.

The network topology discovery system according to an embodiment is applicable even without MIB information of BRIDGE-MIB and ipRouteNextHop. The network topology discovery system can discover the connection configuration through traffic analysis without using BRDIGE-MIB and ipRouteTable information.

FIG. 2 is a block diagram illustrating a configuration of a network topology discovery system according to an embodiment, and FIG. 3 is a flowchart illustrating a network topology discovery method in the network topology discovery system according to an embodiment.

The network topology search system 100 may include a network equipment search unit 210 and a connection topology search unit 220 . The components of the network topology search system 100 may be representations of different functions performed by the processor according to instructions provided by program code stored in the topology search system. The topology discovery system 100 and components of the topology discovery system 100 may control the network topology discovery system to perform steps 310 to 320 included in the network topology discovery method of FIG. 3 . In this case, the network topology search system 100 and the components of the network topology search system 100 may be implemented to execute instructions according to the code of the operating system included in the memory and the code of at least one program.

The processor may load the program code stored in the file of the program for the network topology search method into the memory. For example, when a program is executed in the network topology search system, the processor may control the network topology search system to load the program code from the program file into the memory according to the control of the operating system. At this time, the network topology search system 100 and the network equipment search unit 210 and the connection topology search unit 220 included in the network topology search system 100 each receive a command of a corresponding part of the program code loaded in the memory. may be different functional representations of the network topology discovery system 100 for executing the subsequent steps 310 to 320 .

In step 310 , the network device discovery unit 210 may search for network devices existing within the IP range of the target network. The network equipment search unit 210 may receive a network IP range and a community string of a target network as input data. The network device discovery unit 210 may store MIB information for device type and connection topology discovery of network devices existing within an IP range of a target network. The network device discovery unit 210 detects network devices existing within the IP range of the target network based on the stored MIB information through a response message that is responded to by broadcasting the SNMP GET message for all IPs within the IP range of the target network. and a network device type of the detected network device may be determined.

In operation 320 , the connection topology search unit 220 may search the network topology based on the analysis of network traffic input/output for the discovered network devices. The connection topology search unit 220 searches for connection information of a network device based on MIB information stored for the discovered network devices, and a common IP exists in the static IP list of the network device and the dynamic IP list of other network devices. In this case, it may be determined that the network devices are connected. The connection topology search unit 220 compares the traffic input/output including the amount of traffic coming into the port of the network device and the amount of traffic generated from the port of the other network device for the discovered network devices, and finds the port connection information of the connected network device. can explore. The connection topology search unit 220 compares the traffic input/output for the connected network devices for a specific time. If the comparison result is similar or identical, the connection topology search unit 220 searches for an index corresponding to each traffic input/output amount, and the searched index You can search the port information mapped with the MIB through the MIB information. The connection topology search unit 220 may output a connection topology result including connection information of the discovered network device and port connection information of the discovered network device in the form of a csv file.

Since the network topology search system can easily and conveniently know about the connection configuration of network equipment, it is possible to reduce the administrator's burden and management time and reduce the management burden. In addition, the network topology discovery system can be applied in various network environments using SNMP. In addition, the network topology discovery system can develop advanced technology through interworking with a system that manages network equipment in an integrated manner.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

Software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or apparatus, to be interpreted by or to provide instructions or data to the processing device. may be embodied in The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in an order different from the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (14)

A network topology discovery method comprising:
discovering network devices existing within an IP range of a target network; and
discovering a network topology based on the analysis of network traffic input/output for the discovered network devices.
including,
The step of discovering the network topology comprises:
Searching for port connection information of the connected network devices by comparing the traffic input/output including the amount of traffic coming into the port of the network device and the amount of traffic generated from the port of another network device with respect to the discovered network devices.
A network topology discovery method, including According to claim 1,
The step of discovering the network devices,
Storing MIB information for device type and connection topology discovery of network devices existing within the IP range of the target network
A network topology discovery method, including 3. The method of claim 2,
The step of discovering the network devices,
Detects network equipment existing within the IP range of the target network based on the stored MIB information through a response message that is responded to by broadcasting an SNMP GET message for all IPs within the IP range of the target network, and the detected Determining the network equipment type of the network equipment
A network topology discovery method, including According to claim 1,
The step of discovering the network devices,
receiving the network IP range and community string of the target network as input data
A network topology discovery method, including 3. The method of claim 2,
The step of discovering the network devices,
Searching for connection information of the network equipment based on the stored MIB information, and determining that the network equipment is connected when a common IP exists in the static IP list of the network equipment and the dynamic IP list of other network equipment
A network topology discovery method, including delete According to claim 1,
The step of discovering the network topology comprises:
As the traffic input/output for the connected network devices is compared for a specific time, if the comparison result is similar or identical, an index corresponding to each traffic input/output is searched, and port information mapped to the searched index is retrieved. Steps to search through MIB information
A network topology discovery method, including 8. The method of claim 7,
The step of discovering the network topology comprises:
outputting a connection topology result including connection information of the discovered network device and port connection information of the discovered network device in the form of a csv file
A network topology discovery method, including A network topology discovery system, comprising:
a network device discovery unit for discovering network devices existing within an IP range of a target network; and
A connection topology search unit that searches for a network topology based on the analysis of network traffic input/output for the discovered network devices.
including,
The connection topology search unit,
For the discovered network devices, the port connection information of the connected network device is searched by comparing the traffic input/output including the amount of traffic coming into the port of the network device and the amount of traffic generated from the port of another network device.
Network topology discovery system. 10. The method of claim 9,
The network equipment search unit,
Storing MIB information for device type and connection topology discovery of network devices existing within the IP range of the target network
Network topology discovery system, characterized in that. 11. The method of claim 10,
The network equipment search unit,
Detects network equipment existing within the IP range of the target network based on the stored MIB information through a response message that is responded to by broadcasting an SNMP GET message for all IPs within the IP range of the target network, and the detected Determining the network equipment type of network equipment
Network topology discovery system, characterized in that. 11. The method of claim 10,
The network equipment search unit,
Searching for connection information of network equipment based on the stored MIB information, and determining that network equipment is connected when a common IP exists in the static IP list of the network equipment and the dynamic IP list of other network equipment
Network topology discovery system, characterized in that. delete 10. The method of claim 9,
The connection topology search unit,
As the traffic input/output for the connected network devices is compared for a specific time, if the comparison result is similar or identical, an index corresponding to each traffic input/output is searched, and port information mapped to the searched index is retrieved. Searching through MIB information
Network topology discovery system, characterized in that.

Images