KR20050104106A - Apparatus of test access port for optical network having the function of partitioning mirroing data - Google Patents

Abstract

The present invention relates to a TAP device for an optical network capable of distributing mirroring data.

The TAP apparatus according to the present invention is a 2 * 4 optical splitter, an optical splitter that receives optical traffic received from a first network and optical traffic received from a second network, respectively and outputs each optical traffic as two identical optical signals. The signal converting unit converts the mirrored optical signal into an electrical signal among the optical signals output from the control unit, a controller for dividing the mirrored signal converted by the signal converting unit into a plurality of signals, and outputting each of the signals; It is characterized in that it is configured to include a connection port for transmitting to each other device. At this time, one preferred embodiment of dividing the mirroring signal is to divide according to the protocol.

Using the present invention, traffic can be mirrored without loss of traffic flowing between optical networks. In particular, since the mirrored high-speed data can be divided into a plurality of signals and delivered to individual management devices, high-speed traffic can be distributedly monitored and more precisely centralized management of specific types of data can be achieved.

Description

TAP device for optical network which can distribute processing of mirroring data {Apparatus of Test Access Port for optical network having the function of partitioning mirroing data}

The present invention relates to a TAP device for an optical network capable of distributing mirroring data, and in particular, divides a mirrored high-speed signal into a plurality of signals after mirroring without loss of optical traffic flowing between the optical networks. The present invention relates to a TAP device that can be delivered to individual management devices.

With the development of internet and network technology, it brings much convenience to real life. However, there are various side effects, such as hacking a specific device or an excessive traffic generation attack by an unspecified number. Accordingly, network security has emerged as a very important problem, and a firewall or an intrusion detection system (IDS) is used for network security.

Referring to FIG. 1, the monitoring device 30 such as IDS port-mirrors traffic on a communication path through a TAP device 20 located on a communication path between a first network 11 and a second network 12. Monitor traffic conditions. Here, the first network 11 and the second network 12 means any network (for example, an internet network and an intranet network) connected to each other. Port mirroring is a traffic forwarding technology mainly used in a switch, and is a method of exporting a specific port on a switch to a monitoring port.

On the other hand, the speed of the traffic flowing through the optical network is very high and contains various data of different protocols and types. However, the conventional TAP device has a problem that it is difficult to effectively monitor a variety of high-speed data because it can only pass traffic flowing on the optical network to the monitoring equipment as it is.

Accordingly, the present invention has been proposed to solve the above problems, so that the mirrored high-speed data can be divided into a plurality of data after being mirrored without loss of traffic flowing between the optical networks so that each can be delivered to a separate management device. The purpose is to provide a TAP device for an optical network.

In order to achieve the above object, the optical network TAP apparatus capable of distributed processing of the mirroring data according to the present invention by mirroring the traffic flowing through the optical communication path between the first network and the second network traffic on the optical communication path It plays a role in monitoring the data. In particular, a 2 * 4 optical splitter for receiving the optical traffic received from the first network and the optical traffic received from the second network, respectively, and outputs each optical traffic as two identical optical signals; A signal converting unit converting a mirrored optical signal among the optical signals output from the optical splitter into an electrical signal; A controller for dividing the mirroring signal converted by the signal converter into a plurality of signals and outputting the divided signals; And it characterized in that it comprises a connection port for transmitting each of the plurality of signals output from the control unit to another device.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 2, the optical traffic T1-1 received through the optical port 41 in the first network 11 is distributed into the same two optical signals through the optical splitter 43-1. One optical signal T1-2 of the divided optical signals is transmitted to the second network 12 through the optical port 42, and the other optical signal T1-3 is used for traffic monitoring as a mirroring signal. do.

In addition, the optical traffic T2-1 received through the optical port 42 in the second network 12 is distributed through the optical splitter 42 into two identical optical signals. One optical signal T2-2 of the two optical signals distributed is transmitted to the first network 11 through the optical port 41 and the other optical signal T2-3 is used for network monitoring as a mirroring signal. do.

That is, the optical signals received from the first network 11 and the second network 12 are each divided into two identical optical signals, which should not cause loss of the original optical traffic flowing between the networks during distribution. To this end, it is preferable to use a 2 * 4 optical splitter that receives two optical signals and outputs the same two optical signals.

Referring to FIG. 3, a preferred embodiment of the configuration of the TAP device 40 for an optical network according to the present invention will be described in detail.

The 2 * 4 optical splitter 43 receives optical traffic T1-1 received from the first network 11 and optical traffic T2-1 received from the second network 12, respectively. Output traffic as two identical optical signals. That is, the 2 * 4 optical splitter 43 distributes the optical traffic T1-1 to the same optical signals T1-2 and T1-3, and the optical traffic T2-1 to the same optical signals T2-2 and T2-3. .

At this time, of the optical signals output from the 2 * 4 optical splitter 43, T1-2 is transmitted to the second network 12, and T2-2 is transmitted to the first network 11 so that traffic between the networks can be It is delivered to the other network as it is. Then, the traffic between the networks is monitored by using the mirrored optical signals T1-3 and T2-3. Since the mirrored signal is the same signal as the traffic, it is the same high-speed signal as the traffic.

The mirroring signals T1-3 and T2-3 are optical signals distributed by the 2 * 4 optical splitter 43, and the signal converter 44 converts the mirroring signals T1-3 and T2-3 in the form of optical signals. Convert to electrical signal form. The converted signal is input to the controller and processed.

Meanwhile, the controller 45 divides the mirroring signal converted by the signal converter 44 into a plurality of signals at a lower speed than the optical traffic speed, and outputs the divided signals. As an example, a signal input from the signal converter 44 to the controller 45 is a high speed signal in Gigabyte units, and the high speed signal is divided into a plurality of Mega unit signals.

The controller 45 may divide the mirroring signal in various ways. As an example, the signal input from the signal converter 44 may be simply divided by sections. However, it is preferable to analyze the data included in the mirroring signal and divide the data according to the same protocol or type of data.

The connection port unit 46 is a component connected to another device, and transmits a plurality of signals dividedly output from the control unit 45 to the other management device 50, respectively. That is, each management device 50 is connected to the corresponding port of the connection port 46 is able to receive and analyze only a specific type of mirroring signal.

A detailed process of operating the TAP apparatus according to the present invention will be described with reference to FIG. 4.

First, high-speed optical traffic in Gigabyte units is mirrored using a 2 * 4 optical splitter so as not to cause loss of traffic between networks (S61), and the mirrored optical signal is converted into an electrical signal through a signal converter ( S62). The controller divides the high speed mirroring signal into a plurality of signals having a lower speed (S63), and outputs each of the divided signals through a separate port (S64).

Then, the management device connected to each port can only inspect the traffic input to it. For example, if a management device is connected to a specific port and the control unit outputs mirroring data using protocol A only through the specific port, the manager of the management device concentrates only data using the corresponding protocol A of the traffic flowing through the network. It will be managed.

The present invention is not limited to the above-described embodiments and can be variously modified and implemented by those skilled in the art without departing from the technical spirit of the present invention.

Using the present invention, traffic can be mirrored without loss of traffic flowing between optical networks. In particular, since the mirrored high-speed data can be divided into a plurality of signals and delivered to individual management devices, high-speed traffic can be distributedly monitored and more precisely centralized management of specific types of data can be achieved.

1 is an overview of a structure of use of a TAP device;

2 is an overview of an optical traffic movement path in a TAP device;

3 is an embodiment of a configuration of a TAP device according to the present invention;

4 is an embodiment of an operation process of a TAP device according to the present invention.

* Explanation of symbols for main parts of the drawings

11,12: network 20,40: TAP device

41,42: optical ports 43,43-1,43-2: optical splitter

44: signal conversion unit 45: control unit

46: connection port 50: management device

Claims (2)

A test access port (TAP) device for monitoring traffic on an optical communication path by mirroring traffic flowing through an optical communication path between a first network and a second network, A 2 * 4 optical splitter which receives optical traffic received from the first network and optical traffic received from the second network, respectively and outputs each optical traffic as two identical optical signals; A signal converting unit converting a mirrored optical signal among the optical signals output from the optical splitter into an electrical signal; A controller for dividing the mirroring signal converted by the signal converter into a plurality of signals and outputting the divided signals; And And a connection port unit for transferring a plurality of signals output from the control unit to other devices, respectively. The method of claim 1, And the control unit is configured to divide the mirroring signal according to a protocol.