KR20220125965A - Apparatus for Realtime Monitoring Performance Degradation of Network System - Google Patents

Abstract

The present invention relates to a network performance degradation monitoring device for detecting network failures and external attacks in real time by mirroring and receiving packets transmitted and received from a server-side in a network system in which a plurality of client devices and a plurality of server devices are connected. The network performance degradation monitoring device comprises: a packet analysis module extracting information about a session, information about a server connected to the session, information about a client connected to the session, and the type of the mirrored packet from the mirrored packet; a structure management module managing a session structure, a server structure, and a client structure based on the information analyzed by the packet analysis module; a risk management module calculating and managing a performance degradation risk as a ratio of standby flows to all flows performed in the network system from information stored in the session structure, the server structure, and the client structure; a plurality of session structures formed for each session of all sessions performed in the network system; a plurality of server structures formed for each server of all servers forming all the sessions; and a plurality of client structures formed for each client of all clients forming all the sessions. According to the present invention, network quality, failure, and security are diagnosed quickly by classifying, storing, and searching network packet information transmitted and received to and from the network system at high speed.

Description

Realtime Monitoring Performance Degradation of Network System

The present invention relates to a device for monitoring the performance degradation of a network system, and more particularly, to a device for rapidly analyzing a packet of a network TCP protocol to detect a network failure and an external attack in real time.

Transmission Control Protocol (TCP) is a transport layer protocol that supports connection-type services on top of the IP protocol, and is basically used in the Internet environment. TCP protocol types include FTP, SSH, Telent, SMPT, DNS, DHCP, HTTP, HTTPS, POP3, SNMP, and SSL.

In order to guarantee data loss-free communication on the Internet, which is an unreliable public network, the TCP protocol proceeds with a procedure to check whether data packets are normally ready for transmission and reception. This is called 3-way handshaking, and is done as follows.

First, the client system sends a message that it wants to communicate to the server system with which it wants to communicate to establish a TCP connection (transmitting a packet with the SYN flag set).

When the server system receives the SYN signal, it changes to the SYN-RECEIVED state, and responds by sending a message that sets the SYN-ACK flag to the client system as a response and a message that I am ready to communicate.

When the client system receives this SYN-ACK signal, it changes to the ESTABLISHED state and responds by sending an ACK signal to the server system. When the server system that has received the client's ACK signal changes to the ESTABLISHED state, the connection between the server system and the client system is successfully completed.

Thereafter, since it is necessary to distinguish between the existing communication and the new communication, a transaction is performed by putting a flag value in the header, and a session is created for each application service.

A transaction between a client system and a server system consists of a procedure in which the client system transmits a transaction request message and the server system responds to the transaction request message while a session between the client system and the server system is created. Each transaction may consist of one packet or a plurality of packets. That is, in order for the server system and the client system to efficiently allocate a route (routing) for sending data through the Internet, the amount of data that can be sent at one time is limited based on the transmission protocol. Therefore, when there is a large amount of data in one transaction, it is divided into several pieces and transmitted, and these pieces are called packets.

Traditional network systems include a client device used by a user and various server devices associated with a web site. In general, in order to use a web site, a client device makes a connection request to a server having a specific IP address and accesses it after a waiting time. In this case, when a plurality of client devices are crowded by a plurality of users at a specific point in time and attempt to access the server or request a transaction, the performance of the network system associated with the server may be deteriorated due to a bottleneck. It is necessary to quickly identify the cause of such performance degradation, and respond to it as quickly as possible.

As a prior art for identifying the cause of the performance degradation of such a network system, there is Korean Patent Laid-Open No. 2020-0033090 "Method for Network Security Monitoring, Network Security Monitoring Device and System".

The above-described prior art includes a first entity (server), a second entity (client terminal), a switching device provided between the first entity and the second entity, and a network security monitoring device connected to the switching device. The security technique includes the steps of, based on a network security monitoring device mirroring from a switching device, for at least one packet transmitted/received between a first entity and a second entity, acquiring at least one mirrored packet; and determining, by the network security monitoring apparatus, whether a security problem occurs with respect to a network associated with the first entity and the second entity based on at least a portion of information included in at least one mirrored packet.

In this prior art, the step of determining whether a security problem occurs based on packet information includes determining that the number of connections in a section from a predetermined first source IP to a first destination IP is greater than or equal to a predetermined threshold, a predetermined first URL It is determined that the request for the . Determining that the threshold is greater than or equal to the predetermined number of synchronization signal (SYN) packets from the third source IP is greater than or equal to the predetermined threshold, and the predetermined fourth source IP is simultaneously connected to the number of server IPs greater than or equal to the predetermined threshold. Determines whether or not a security problem occurs based on at least one of the decisions to try.

In this prior art, as described above, the number of connections, the number of requests, the number of BPS, PPS, the number of synchronization signal packets, the number of simultaneous connections to the server IP, etc. are compared with the respective threshold values to determine whether or not a security problem occurs. .

DETAILED DESCRIPTION OF THE PRIOR ART In paragraphs [0085] to [0187], functions and operations of a packet analysis module for analyzing packets transmitted and received between a server and a client terminal are described. The packet analysis module of the prior art has a problem in that it is difficult to process in real time because it analyzes packets and calculates various performance indicators to determine whether or not a security problem occurs.

Republic of Korea Patent Publication No. 2020-0033090 Republic of Korea Patent Publication No. 2019-0088342 Republic of Korea Patent Publication No. 2019-0088343

It is an object of the present invention to provide an apparatus for rapidly classifying, storing, and searching network packet information transmitted and received to and from a network system, thereby rapidly diagnosing network quality, failure and security, and monitoring network performance degradation in real time.

Network performance degradation real-time monitoring apparatus according to the present invention for achieving the above object,

In a network system in which a plurality of client devices and a plurality of server devices are connected, in the network performance degradation monitoring device provided by mirroring packets transmitted and received at the server end,

a packet analysis module for extracting session information, information about a server connected to the session, information about a client connected to the session, and a type of the mirrored packet from the mirrored packet; information analyzed by the packet analysis module a structure management module for managing a session structure, a server structure, and a client structure based on ; A risk management module for calculating and managing a performance degradation risk as a ratio of standby flows to all flows made in the network system from the information stored in the session structure, the server structure, and the client structure, and for all sessions made in the network system A plurality of session structures formed for each session, a plurality of server structures formed for each server for all servers forming all the sessions, and a plurality of client structures formed for each client for all clients forming all sessions including;

Each of the session structures includes information about the corresponding session, a server structure pointer for connecting to a server structure corresponding to a server connected to the corresponding session, and a client structure pointer for connecting to a client structure corresponding to a client connected to the corresponding session. do;

Each of the server structures includes information about the corresponding server, a session structure management table for managing session structure pointers corresponding to all sessions to which the server is connected, and client IP addresses corresponding to all clients connected to the server. a client information management table;

Each of the client structures includes a session structure management table that manages information about the corresponding client, session structure pointers corresponding to all sessions to which the client is connected, and server IP addresses corresponding to all servers connected to the client. It is characterized in that it includes a server information management table.

According to the present invention, network packet information transmitted and received to and from the network system is classified by session, server, client, application, and region, stored in a structure, and managed by linking with a link, thereby quickly determining whether or not the performance of the network system is degraded and the cause. There is a benefit that can be detected.

1 is a diagram illustrating a network environment to which the present invention is applied.
2 is a block diagram of a network performance degradation monitoring apparatus according to the present invention.
3 is an exemplary diagram of a session connection between a server and a client in a network system.
FIG. 4 is a structure configuration and connection diagram generated in the exemplary network system diagram of FIG. 3 .
5 is a block diagram of a session structure according to the present invention.
6 is a block diagram of a server structure according to the present invention.
7 is a block diagram of a client structure according to the present invention.
8 is a block diagram of an application structure according to the present invention.
9 is a block diagram of a local structure according to the present invention.
10 is an operation flowchart illustrating a process of creating and updating a structure according to the present invention.
11 is an operation flowchart illustrating a risk management process of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and will be described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

In describing each figure, like reference numerals are used for like elements. Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component. The term “and/or” includes a combination of a plurality of related listed items or any of a plurality of related listed items.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with the meanings in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. shouldn't

As described above, communication between the server and the client device consists of 3-way handshaking, session connection, and transaction request and response processes. When a large number of client devices are clustered by multiple users at a specific point in time to access the server or make a transaction request, 3-way handshaking SYN signals and transaction requests are accumulated in a specific server, waiting for a response to the corresponding SYN signal The time or waiting time for a response to a transaction request increases. In other words, SYN wait flows and transaction wait flows increase among all flows including 3-way handshaking and transactions. This invention proposes a method for managing performance degradation risk based on the ratio of SYN waiting flows and transaction waiting flows among all flows.

1 is a diagram illustrating a network environment to which the present invention is applied.

A network environment to which the present invention is applied includes a plurality of client devices 111, 112, and 113, a network 120, a router 130, a switch 140 having a packet mirroring function, a plurality of server devices 151, 152, 153, and a network according to the present invention. A degradation monitoring device 160 is included.

The client devices 111 , 112 , and 113 access a specific web site or web application through the network 120 . In this case, the connection is performed in the server devices 151, 152, and 153 associated with the web site and/or web application. The client devices 111, 112, and 113 access a specific web page through a web browser and request execution of a desired page or application. The request may include not only static content such as an html document, but also multimedia content such as video and audio and/or execution of other applications.

The client devices 111 , 112 , and 113 are operated by a user and may include any device including communication functions (including Internet access and web browser execution functions) and data processing functions. The client devices 111, 112, and 113 include mobile stations (MS), user equipment (UE), user terminals (UTs), wireless terminals, access terminals (AT), fixed and mobile subscriber units (Subscriber Units), subscribers. Subscriber Station (SS), cellular phone, wireless device, wireless communication device, wireless transmit/receive unit (WTRU), mobile node, mobile, mobile station, personal digital assistant), smartphone, laptop, netbook, personal computer, wireless sensor, consumer electronics (CE), Internet of Things (IoT) device or other terms. Various modified embodiments of the client devices 111, 112 and 113 include a portable computer having a wireless communication function, a photographing device such as a digital camera having a wireless communication function, a gaming device having a wireless communication function, and a music storage and playback home appliance having a wireless communication function. , Internet appliances capable of wireless Internet access and browsing, as well as portable units or terminals incorporating combinations of these functions, but are not limited thereto.

Each client device 111 , 112 , 113 may include a user communication interface including input devices such as a mouse and keyboard for receiving user input and a display for providing a control user interface for the user to interact with the networked devices. can The user interface may include a graphical user interface (GUI) to provide information to the user.

Network 120 includes wired and/or wireless networks. Network 120 may include the Internet. The network 120 may include a serial bus that provides a physical layer (medium) to transmit and receive data between variously connected client devices 111 , 112 , and 113 and server devices 151 , 152 , 153 . Here, the serial bus may include a 1394 serial bus. It may support both, but not necessarily limited to, time-multiplexed audio/video (A/V) streams and standard Internet Protocol (IP) communications (eg, IETF REC 2734). . Network 120 may also include non-1394 networks (eg, Ethernet, etc.). Also, the network 120 may include a home network. In addition, the network 120 may be any network supporting Internet of Things (IoT) connection. Each of the client devices 111 , 112 , and 113 may communicate with one or more server devices 151 , 152 , and 153 in the network 120 .

The server devices 151, 152, and 153 respond to users' requests by using network resources to provide services to users. This includes the return of information (data). It also includes the performance of a function (eg, a mechanical function) and return of state, data stream and return of state, acceptance of data stream and return of state, or storage of state for various actions. The server devices 151 , 152 , and 153 may include customized, built-in, and control programs to implement control of their own hardware.

The server devices 151 , 152 , and 153 may be associated with a specific web site and/or web application, and perform calculations and management related to tasks performed in each web site and/or web application. The server devices 151 , 152 , and 153 may interact with the client devices 111 , 112 , 113 and other servers. Exemplary services may include MPEG sourcing/sinking, and display services.

The server devices 151 , 152 , and 153 provide interface data (eg, HTML, XML, Java, JavaScript, GIF, JPEG, MPEG, graphic burst or for the intended purpose) that provides an interface for command and control of the device via the network 120 . any other format used). Server devices 151 , 152 , 153 may process information such as one or more Hypertext Markup Language (HTML) that provides commands and control of the device. The server devices 151, 152, and 153 use the Internet standard for representing HTML pages using a browser technique.

In the present invention, the server devices 151, 152, and 153 may include a web server, an app server, and a database server. However, it does not necessarily have to consist only of a combination of three server devices. It is valid that only the web server exists, and the app server and the database server do not exist, or it is possible to configure only one app server, and a combination of servers of various types and layers is also possible.

The web server is a server that provides requested content to a web client. The web server can serve static HTML or images such as JPEG or GIF to the web browser via HTTP protocol. In some cases, the web server may also embed a container that can run internal applications.

The app server may also be called a WAS (Web Application Server) server, which represents a middleware software server that provides an application execution environment and transaction processing and management in a client/server environment. Typically, the server end may be built as a three-tier web computing environment of a web server, an application server, and a database server, where the app server acts as an application server in a client/server environment. The app server provides an application execution environment and database access function, manages transactions, performs business logic to process tasks, and interworks applications between different types of systems.

The database server is a storage in which various data handled by the web server and/or the app server are stored. The database server may store a huge amount of data associated therewith depending on the nature of the web server and/or the web server and/or the job processed by the app server, the web site, or the web application. This may include personal information, institutional information, data related to various contents (eg, multimedia contents), and the like.

The router 130 or the router having a routing function extracts the location and destination of packets transmitted from the client devices 111, 112, and 113 through the network 120, and designates an optimal route to the location, and data along the route The packet is forwarded to the switch 140 . The router 130 identifies the receiving IP address and forwards the corresponding data to the switch 140 .

The switch 140 memorizes the unique MAC addresses of the respective server devices 151, 152, and 153, determines which packets are to be transmitted and where through this address, and transfers the packets received from the router 130 to the corresponding servers 151, 152, and 153. send. The switch 140 includes a switch serving as OSI layer 2, OSI layer 3, OSI layer 4, and/or other layers (eg, OSI layer 7). For example, a function of setting a path may be performed. In addition, functions such as load balancing, port forwarding, and QoS may be performed. The switch may be referred to as a network switch, a switching hub, a port switching hub, or the like.

The switch 140 copies or captures all packets received from the client devices 111, 112, 113 to the server devices 151, 152, 153 and all packets transmitted from the server devices 151, 152, 153 to the client devices 111, 112, 113, including a packet mirroring function, and , and provides the duplicated packet to the network performance degradation monitoring apparatus 160 according to the present invention.

In this invention, a session is named to include a process of 3-way handshaking. That is, the session is connected between the server and the client only after the 3-way handshaking is terminated, but if the 3-way handshaking attempt temporarily increases, the performance of the network system may deteriorate. In order to do this, it transmits a SYN signal and calls it a session from the time it attempts to connect.

2 is a block diagram of a network performance degradation monitoring apparatus according to the present invention.

The network performance degradation monitoring apparatus of the present invention includes a packet analysis module 200 , a structure management module 210 , a risk management module 220 , and a display management module 230 .

From the mirrored packet, the packet analysis module 200 provides information about a session, information about a server, information about a client, information about an application, information about a region, and a corresponding mirrored packet type (corresponding packet) from the mirrored packet. Whether it is a SYN signal, a SYN-ACK signal, a transaction request signal, or a transaction response signal) is extracted. A method for the packet analysis module 200 to analyze the above-described information from a mirrored packet may refer to Korean Patent Laid-Open No. 2020-0033090.

The structure management module 210 manages each structure to be described later based on the packet information analyzed by the packet analysis module 200 .

The risk management module 220 calculates a performance degradation risk as a ratio of standby flows (SYN waiting, transaction response waiting) to all flows made in the network system. The risk management module 220 calculates the performance degradation risk of each server, each client, each application, region, and the entire network system.

The display management module 230 displays the performance degradation risk of each server, each client, each application, region, and the entire network system calculated by the risk management module 220 on the screen.

The network performance degradation monitoring apparatus of the present invention manages each piece of information as a structure.

Network performance degradation monitoring apparatus of the present invention, a plurality of session structures (241,242,243) formed for each session for all sessions made in a network system, and a plurality of server structures formed for each server for all servers forming all the sessions (251,252,253), a plurality of client structures (261,262,263) formed for each client for all clients forming all the sessions, and a plurality of application structures formed for each application for all applications used by all the clients ( 271,272,273) and a plurality of local structures 281,282,283 formed for each region with respect to the region to which all the clients belong.

The session structures 241,242,243 are managed by a session tree table 240, the server structures 251,252,253 are managed by a server tree table 250, and the client structures 261,262,263 are managed by a client tree table ( 260 , the application structures 271,272 and 273 are managed by the application hash table 270 , and the local structures 281,282 and 283 are managed by the local hash table 280 .

The session tree table 240, the server tree table 250, the client tree table 260, the application hash table 270, and the local hash table 280 are red and black for structures managed respectively. It is managed by applying the Red-Black Tree algorithm. For a description of the red-black tree algorithm, see .

The region information may be country information or city information. The local information to which the client belongs can be obtained from the client IP address.

3 is an exemplary diagram of a session connection between a server and a client in a network system.

A session (this is called session 1) is connected between server1 and client1 (using application1), a session (this is called session2) is connected between server1 and client3 (using application1), and server2 A session (this is called session 3) is connected between client2 and client2 (using application2), a session (this is called session4) is connected between server2 and client3 (using application2), and server2 and client A session (this is called session 5) is connected between 5 (using application 2), and a session (this is called session 6) is connected between server 3 and client 4 (using application 2). Client1 and Client2 are located in Region1, and Client3, Client4, and Client5 are located in Region2.

FIG. 4 is a structure configuration and connection diagram generated in the exemplary network system diagram of FIG. 3 , and FIG. 5 is a configuration diagram of a session structure according to the present invention.

In the exemplary diagram of FIG. 3 , since there are 6 sessions, 6 session structures are formed. In the session 1 structure, information on session 1 connected between server 1 and client 1 is recorded and managed, and each structure in which server, client, application, and region information related to the session is recorded is linked.

As shown in FIG. 5, the session structure includes information about the session 51, a server structure pointer 52 for connecting to a server structure corresponding to a server connected to the session, and a client connected to the session. A client structure pointer 53 for connecting to a client structure, an application structure pointer 54 for connecting to an application structure corresponding to an application activated by a client connected to the session, and a location in which the client connected to the session is located. contains a local structure pointer 55 for linking to a corresponding local structure.

Here, the session information includes server information connected to the session, client information connected to the session, application information activated by the client connected to the session, region information where the client connected to the session is located, and information about the session. Status information (request, wait, response) is included. That is, it includes information such as whether a SYN signal or a transaction request signal is transmitted from the client to the server, whether a response to the corresponding request is in an unfinished standby state, or whether a response to the corresponding request is transmitted to the client. The risk management module 220 calculates a performance degradation risk by periodically receiving state information of a corresponding session for all sessions connected to the network system and calculating a ratio of standby flows among all flows.

In the session1 structure, information about session1, server1 structure pointer, client1 structure pointer, application1 structure pointer, and area1 structure pointer are linked and stored. Similarly, in the session 2 structure, information on session 2 connected between server 1 and client 3 is recorded and managed, and information about session 2, server 1 structure pointer, client 3 structure pointer, and application 1 structure pointer Wow, the local 2 structure pointer is linked and stored.

Similarly, information about session 3 connected between server 2 and client 2 is recorded and managed in the session 3 structure, and information about session 4 connected between server 2 and client 3 is recorded and managed in the session 4 structure, Information on session 5 connected between server 2 and client 5 is recorded and managed in the session 5 structure, and information about session 6 connected between server 3 and client 4 is recorded and managed in the session 6 structure.

Each session structure contains information about each session, a server structure pointer to connect to a server structure corresponding to the session, a client structure pointer to connect to a client structure corresponding to the session, and an application structure used by the client. An application structure pointer for connecting to , and a local structure pointer for connecting to the local structure to which the client belongs are recorded.

6 is a block diagram of a server structure according to the present invention.

The server structure includes information about the corresponding server 61, a session structure management table 62 for managing session structure pointers corresponding to all sessions to which the server is connected, and a client IP corresponding to all clients connected to the server. A client information management table 63 for managing addresses, an application information management table 64 for managing an application list corresponding to all applications activated in all clients connected to the server, and past risk information of the server It includes a server risk table 65 to store, and a server current risk 66 to store the current performance degradation risk of the server. Preferably, the client IP address and the application list are managed as hash values.

The risk management module 220 calculates the instantaneous risk by calculating the ratio of the standby flow to the total flow periodically (eg, 1 second), and based on the calculated instantaneous risk and the past risk information stored in each structure for the past 7 seconds The current risk is calculated by averaging the risks of

In the server1 structure, information on the server1 is recorded and managed, in the server2 structure information on the server2 is recorded and managed, and in the server3 structure information on the server3 is recorded and managed.

7 is a block diagram of a client structure according to the present invention.

The client structure includes information about the corresponding client 71, a session structure management table 72 that manages session structure pointers corresponding to all sessions to which the client is connected, and a server IP corresponding to all servers connected to the client. A server information management table 73 for managing addresses, an application information management table 74 for managing a list of all applications activated in the client, and a client risk table 75 for storing past risk information of the client; and a client current risk 76 that stores the current degradation risk of that client. Preferably, the server IP address and the application list are managed as hash values.

Here, the client risk is calculated based on the server's standby flow among all flows, and is calculated as the ratio of the response standby flow for each client. The risk management module 220 periodically (eg, 1 second) calculates the instantaneous risk of the ratio of the standby flow to the total flow, and averages the risks of the past 7 seconds based on the past risk information stored in each structure to determine the current risk Calculate.

8 is a block diagram of an application structure according to the present invention.

The application structure includes a session structure management table 82 that manages information 81 about the application, session structure pointers corresponding to all sessions to which all clients in which the application is activated are connected, and a session structure management table 82 in which the application is activated. A client information management table 83 that manages client IP addresses corresponding to the applications, an application risk table 84 that stores past risk information of the application, and an application current risk 85 that stores the current performance degradation risk of the application ) is included. Here, the client IP address is preferably managed as a hash value.

9 is a block diagram of a local structure according to the present invention.

The local structure includes information 91 on the region, a session structure management table 92 that manages session structure pointers corresponding to all sessions connected to all clients located in the region, and a session structure management table 92 for all clients located in the region. The client information management table 93 for managing the corresponding client IP addresses, the application information management table 94 for managing the application list corresponding to the applications activated to all the clients, and the detailed regional classification of the region A sub-region management table 95 for managing a sub-region list for, a regional risk table 96 for storing historical risk information of the region, and a regional current risk 97 for storing the current performance degradation risk of the region include Here, the client IP address and the application list are preferably managed as hash values.

10 is an operation flowchart illustrating a process of creating and updating a structure according to the present invention.

When a mirrored packet is input (S101), the packet analysis module analyzes the corresponding packet (S102). Extracting session information from the packet, the structure management module 210 queries the session tree table 240 for a session structure corresponding to the session. The session tree table 240 generates a corresponding session structure and returns it to the structure management module when the corresponding session structure does not exist, and when the corresponding session structure exists, the current state of the corresponding session structure is updated (S103).

In addition, a server structure linked with the corresponding session structure is created or the corresponding server structure is updated (S104). In addition, a client structure linked with the corresponding session structure is created or the corresponding client structure is updated (S105). In addition, an application structure linked with the corresponding session structure is created or the corresponding application structure is updated (S106). Also, a local structure linked with the corresponding session structure is created or the corresponding local structure is updated (S107).

That is, when a new session is created, a session structure is created and a server structure, a client structure, an application structure, and a local structure corresponding to the session structure are created, or a previously created server structure, a client structure, an application structure, and a local structure are created. In , the session structure management table, the server information management table, the client information management table, the application information management table, etc. are updated to add information about the currently created session.

11 is an operation flowchart illustrating a risk management process of the present invention.

When the risk calculation cycle arrives (S111), the risk management module detects state information for each session of all flows (S112). The risk management module calculates the flow versus standby flow for each server, reads historical risk information for each server and calculates the average value to calculate the current risk, and updates the server risk table and server current risk of the server structure of each server ( S113).

The risk management module calculates the flow versus waiting flow for each client, reads the historical risk information for each client and calculates the average value to calculate the current risk, and updates the client risk table and client current risk of each client's client structure ( S114).

The risk management module calculates the flow versus standby flow for each application, reads the historical risk information for each application and calculates the average value to calculate the current risk, and updates the application risk table and application current risk of each application's application structure ( S115).

The risk management module calculates the flow versus standby flow for each region, reads the historical risk information for each region and calculates the average value to calculate the current risk, and updates the regional risk table and regional current risk of the regional structure in each region (S116) ).

200: packet analysis module 210: structure management module
220: risk management module 230: display management module
240: session tree table 241 to 243: session structure
250: server tree table 251-253: server structure
260: client tree table 261 to 263: client structure
270: application hash table 271-273: application structure
280: local hash table 281 to 283: local structure

Claims (6)

In a network system in which a plurality of client devices and a plurality of server devices are connected, in the network performance degradation monitoring device provided by mirroring packets transmitted and received at the server end,
a packet analysis module for extracting session information, information about a server connected to the session, information about a client connected to the session, and a type of the mirrored packet from the mirrored packet; information analyzed by the packet analysis module a structure management module for managing a session structure, a server structure, and a client structure based on ; A risk management module for calculating and managing a performance degradation risk as a ratio of standby flows to all flows made in the network system from the information stored in the session structure, the server structure, and the client structure, and for all sessions made in the network system A plurality of session structures formed for each session, a plurality of server structures formed for each server for all servers forming all the sessions, and a plurality of client structures formed for each client for all clients forming all sessions including;
Each of the session structures includes information about the corresponding session, a server structure pointer for connecting to a server structure corresponding to a server connected to the corresponding session, and a client structure pointer for connecting to a client structure corresponding to a client connected to the corresponding session. do;
Each of the server structures includes information about the corresponding server, a session structure management table for managing session structure pointers corresponding to all sessions to which the server is connected, and client IP addresses corresponding to all clients connected to the server. a client information management table;
Each of the client structures includes information about the corresponding client, a session structure management table managing session structure pointers corresponding to all sessions to which the client is connected, and server IP addresses corresponding to all servers connected to the client. Network system performance degradation real-time monitoring device comprising a server information management table. The method of claim 1,
The packet analysis module further extracts information about an application activated in the client and information about a region in which the client is located,
The network system performance degradation real-time monitoring apparatus includes a plurality of application structures formed for each application activated in all clients forming all the sessions, and a plurality of local structures formed in each region in which all clients forming all sessions are located. including more
The session structure further includes an application structure pointer for connecting to an application structure corresponding to an application activated by a client connected to the session, and a local structure pointer for connecting to a local structure corresponding to a region in which the client connected to the session is located. do,
The server structure further includes an application information management table for managing the list of applications activated in all clients connected to the server,
The client structure further comprises an application information management table for managing an application list corresponding to applications activated in the corresponding client, network system performance degradation real-time monitoring apparatus. The apparatus of claim 2, wherein the area information is country information or city information. 3. The method of claim 2,
The network system performance degradation real-time monitoring device,
a session tree table for managing the plurality of session structures;
a server tree table for managing the plurality of server structures;
a client tree table for managing the plurality of client structures;
an application hash table for managing the plurality of application structures;
Network system performance degradation real-time monitoring apparatus further comprising a local hash table for managing the plurality of local structures. 5. The method of claim 4,
Each of the session tree table, the server tree table, the client tree table, the application hash table, and the local hash table,
A real-time monitoring device for network system performance degradation, characterized in that it manages each managed structure by applying a red-black tree algorithm. The method of claim 1,
Network system performance degradation real-time monitoring device, characterized in that it further comprises a display management module for displaying on the screen the performance degradation risk of each server, client, application, region, and the entire network system calculated by the risk management module.

Images