WO2004045155A1

WO2004045155A1 - Network traffic statistics method of ip device

Info

Publication number: WO2004045155A1
Application number: PCT/CN2003/000959
Authority: WO
Inventors: Jie Li; Libin Wang; Jianping Xie; Hui Yuan
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2002-11-14
Filing date: 2003-11-13
Publication date: 2004-05-27
Also published as: AU2003284790A1; CN1501622A; CN100438411C

Abstract

The invention relates to a network traffic statistics method of IP devices in which computer for traffic statistics connects IP devices that to be statistical by IP network, characterized in that, realize traffic statistics according to following step: computer for traffic statistics receives original statistical data transmitted from IP device, and stores it into data buffer queue; the computer used to traffic statistics read data from said data buffer queue, and statistical process separately according to statistical policy, exporting corresponding statiscal result. by means of the foregoing method, it is possible that establish statistical policy according to require and acquire perfect and detailed traffic statistics data of multiple IP device in the case of not increace network device.

Description

Network traffic statistics method of IP equipment

TECHNICAL FIELD The present invention relates to the field of data communications, and more particularly, to a method for counting network traffic of an IP (Internet Protocol) device. BACKGROUND OF THE INVENTION In data communication networks, with the increase of human network information exchange, the complexity of network connections is getting higher and higher. With the development of data communication networks and business-based needs, operators and network management designers are paying more and more attention to the detailed communication status of equipment. Data communication products based on detailed traffic data statistics technology have emerged at the historic moment.

The generation of detailed traffic statistics technology of IP equipment is mainly based on the following needs: After community users and corporate networks access the Internet, the application of establishing cross-regional connections through Internet service providers is becoming more and more common; in commercial operations In the community access service, the method of charging based solely on the quality of work service and traffic guarantee connection cannot meet the market demand. In the community access service, individual users have a long-term online connection, so there is a need to pay for traffic. Enterprise users use it for reasonable use. And monitoring networks, more and more attention is paid to the details of network usage; operators must rationalize and optimize existing networks and optimize network performance, which must also be based on detailed network traffic data.

In the prior art, the network traffic statistics technology of IP devices mainly has the following two methods: Existing technology 1. As shown in FIG. 1, a management information database (MIB) table is configured on the IP device, and the MIB table stores the information. Information about each port of the IP device and simple inbound and outbound network traffic information. The network management software uses a single network management protocol (SNMP protocol). The MIB table on the IP device can be used to obtain statistics on the inbound and outbound traffic of each interface. Currently most nets Management software provides network performance analysis data in this way.

Existing Technology 2. As shown in FIG. 2, a packet forwarding statistical device is externally connected to an interface of an IP device, and detailed data traffic statistics are performed on the interface of the IP device. For example, the packet forwarding statistical device may adopt Lucent (Lucent ) Network counter (Netcounter), the network management software reads detailed statistics of the inbound and outbound traffic of the IP device interface from the packet forwarding statistics device.

In the above-mentioned prior art 1, the traffic acquisition method is universal, and no additional equipment is needed. However, because the related network traffic data provided by Table B is relatively simple, the traffic statistics obtained by the network management software are rough. The sum of the outbound traffic and the inbound traffic of the interface cannot obtain the complete and detailed traffic statistics of the IP device, such as: unable to obtain the traffic analysis based on the source / destination address, the traffic analysis between the interfaces, and the traffic based on the application protocol analysis. Therefore, this technical solution cannot be used for the charging of individual users, nor can it achieve the optimization and monitoring of the performance of operators' corporate network users based on source / destination addresses and applications.

In the above-mentioned prior art 2, an additional packet forwarding statistics device is added, and the packet forwarding statistics device can only provide detailed traffic data of one IP interface of the IP device, and thus cannot perform traffic on multiple IP interfaces. For statistics, if you want to perform traffic statistics on each interface, you need to add a large number of packet forwarding statistics equipment, which is very costly. In addition, it can be seen from Figure 2 that the interface between the IP device and the IP backbone network needs to pass through this. The packet forwarding statistics device is connected, and its traffic will be affected by statistical performance. It can be seen that adding the packet forwarding statistics device cannot provide complete IP device traffic information. SUMMARY OF THE INVENTION The object of the present invention is to provide a network traffic statistics method for IP devices. Without adding a network device, a statistical strategy can be customized according to needs to obtain comprehensive detailed traffic statistics data of multiple IP devices.

The technical solutions adopted by the present invention to solve the above technical problems are: A network traffic statistics method for an IP device, in which a computer for traffic statistics and an IP device being counted are connected through an IP network, and the method includes the following steps:

(1) The computer for traffic statistics described above receives the original traffic data sent by the IP device, and stores the raw traffic data in a data cache queue;

(2) Read the original traffic data from the data cache queue, perform statistical processing according to the statistical strategy, and output the statistical result.

Before step (1), the following steps are also included: (

a. Configure the IP device according to the required traffic information;

b. According to the configuration information in step a, the outbound traffic statistics reporting and inbound traffic statistics reporting functions of each interface of the IP device are respectively activated, and a plurality of types of raw traffic data required in the above configuration information are sent to a computer for traffic statistics. .

The statistical strategy includes: a data aggregation method that classifies data according to key fields and value fields of the data being counted; an output method of statistical results, including text, database, and binary output methods; and a length of statistical time.

The step (1) further includes: after receiving the original traffic data sent by the IP device, the computer first checks the original traffic data according to a data aggregation method in the statistical policy, and filters out unnecessary The original traffic data is then stored in the data cache queue.

The step (2) further includes: after the computer reads the original traffic data from the data cache queue, first classify the read data according to a data aggregation method in the statistical strategy, and then press The statistical strategy performs statistical processing on the pre-processed data.

The step (2)) further includes determining whether the statistical time reaches a statistical time length in the statistical strategy, and if yes, outputting a statistical result within the statistical time length according to an output manner in the statistical strategy, and Saved on the computer hard disk or other storage medium , Otherwise, return to step (1).

The counted IP devices may be one or more.

The IP device may be an IP device group in which addresses or names of multiple IP devices are defined as a whole statistical object.

The method also includes the following online management steps:

(a) Real-time monitoring of control commands from the IP network;

(b) After receiving the control order, conduct authority verification;

(c) If the authority authentication is passed, analyze the control protocol, and then determine whether the received command is a configuration command or a query command;

(d) if it is a configuration command, adjust the working status of the data statistics module and the data receiving module online;

(e) if it is a query command, directly fetching the data to be queried from the data file or database of the computer hard disk or other storage medium;

(f) After encapsulating the processing result of the above configuration command or query command according to the protocol, it is sent to the control command issuer via the control port.

Compared with the prior art, the present invention has the following advantages:

a. Since the present invention does not need to increase equipment investment and is implemented by pure software, the network connection between the management computer and the IP equipment is free, simple, and easy to design and maintain;

b. The present invention can simultaneously manage and traffic statistics on multiple devices, and the statistical results can be used as the basis for monitoring and billing;

c. Since the present invention can support detailed traffic information such as source address / destination address, uplink and downlink traffic, service type, etc., thereby facilitating differentiated charging of cell services;

d. Since the present invention can provide detailed port-based inbound and outbound traffic information of multiple devices, it can support traffic accounting in a VPN (Virtual Private Network) networking mode. FIG. 1 is a schematic diagram of implementing traffic statistics using the snmp protocol in the prior art; FIG. 2 is a schematic diagram of implementing traffic statistics by adding a packet forwarding statistics device in the prior art;

3 is a schematic diagram of a network connection principle of the traffic statistics method of the present invention;

4 is a principle block diagram of network management traffic statistics in the present invention;

FIG. 5 is a schematic diagram of a complete statistical process in a traffic statistics method of the present invention;

Figure 6 is a schematic diagram of the workflow of the data receiving module shown in Figure 4;

FIG. 7 is a schematic diagram of the work flow of the data statistics module shown in FIG. 4;

FIG. 8 is a schematic diagram of the workflow of the online management module shown in FIG. 4. Mode for Carrying Out the Invention The present invention is described in detail below with reference to the drawings and specific embodiments.

The network connection principle of the traffic statistics method of this embodiment is shown in FIG. 3, where a computer 301 for network / traffic statistics recording, a computer 302 equipped with a traffic-based accounting software system, and network management / performance analysis and network monitoring software The computer 303 is connected to multiple IP devices through an IP network. The functions of the above three computers can also be realized by a network management computer.

The method of the present invention can be implemented by pure software on the basis of existing hardware. In the network

IP devices can count their own detailed traffic and generate raw statistics. The following are the specific steps of the method according to the invention:

a. Add a network flow (NS, Net Stream) device software module to the IP device that needs to collect detailed traffic statistics. This module can extract information during the process of IP packet forwarding, and can distinguish the source / destination address and source / destination of the traffic. Autonomous domain, service class (TOS), source / destination IP port, This NS device software module can enable the outbound traffic statistics reporting and inbound traffic statistics reporting function of each interface of the IP equipment according to the configuration;

b. According to the required traffic information, configure the IP devices that need to be counted, that is, send the configuration information to the IP addresses and ports of the IP devices that need to be counted, and determine which IP devices need to be counted and which data; The network flow device software module starts the outbound traffic statistics reporting and inbound traffic statistics reporting functions of each interface of the IP device according to the above configuration information, and sends a variety of raw traffic data required in the above configuration information to Computer 301 for traffic statistics recording.

The above two-step operation is the basis for the subsequent steps.

In the present invention, a computer 301 for network / flow statistics recording is provided with network management flow statistics software. The principle of the network management flow statistics software is shown in FIG. 4, which includes three sub-modules: a data receiving module 401 and a data statistics module 402. And online management module 403. The data receiving module 401 receives the original traffic data from the cache queue; the data statistics module 402 statistically processes the original traffic data described in step b according to a customized statistical strategy, and stores the output statistical data in a network / The traffic statistics record is stored in the hard disk or other storage medium of the computer 301. The online management module 403 monitors the management commands sent by the management software, and controls the data receiving module 401 and the data statistics module 402 online. The statistical strategy in the present invention includes: a data aggregation method that classifies data according to the key and value fields of the data being counted; an output method of the statistical result (such as an output method including text, database, and binary); and the length of the statistical time .

The complete statistical process in the traffic statistics method of the present invention is shown in FIG. 5, which includes the workflow of the data receiving module 401 and the workflow of the data statistics module 402. FIG. 6 is a schematic diagram of the work flow of the data receiving module 401. As can be seen from FIG. 4 and FIG. 6, the computer for network / traffic statistics recording is connected to multiple IP devices through the data receiving module 401, and simultaneously monitors multiple ports. The work flow of the data receiving module 401 is the following steps: 501. Receive raw traffic data sent by multiple IP devices described in step b.

502. The original traffic data is verified according to a data aggregation manner in a pre-customized statistical strategy, and the original traffic data that is not required by the user is filtered out;

503. Store the remaining original traffic data in the data cache queue, and wait for the data statistics module to retrieve it.

FIG. 7 is a schematic diagram of the workflow of the data statistics module 402. The workflow of the data statistics module 402 includes the following steps:

504. Read the original traffic data from the data buffer queue of the data receiving module 401 described in step 503.

505: Preprocess the read raw traffic data according to a data aggregation method of a pre-customized statistical strategy, for example, according to the address of the device sending the raw traffic data, the port number to receive the data, and the type of statistics in the raw data record. Statistics of the outgoing / incoming interface; according to the data type, the device supports the statistical data record format; according to the physical data of the device, such as the slot number; and the time information generated by the original data, such as the relative start time of the device, UTC The time (seconds since 1970) was pre-processed to preliminarily classify the raw data into various required types.

506. Perform statistical processing on the pre-processed data according to a pre-customized statistical strategy. In FIG. 7, only three statistical strategies are drawn. In fact, there can be multiple different statistical strategies. Through customized statistical strategies, You can obtain the statistical results of traffic statistics according to the aggregation of different primary key values. From this, you can use the source address / destination address, source address / destination address autonomous domain, service type (TOS), source address / destination address IP port, The inbound and outbound packets, application layer protocols, or network layer protocols of the forwarding device are distinguished, and corresponding traffic statistics are performed.

507. After the time for performing statistical processing on the data of different statistical strategies reaches a predetermined statistical time length, for example, a time period can be set every 10 minutes, and then the output is customized. Output the statistical results within 10 minutes in the form of data file, database data or binary, and save them to the computer 301 hard disk or other storage medium for network / traffic statistics recording. This will get the required statistical results. . The traffic-based accounting software system on computer 302 and the network management / performance analysis and network monitoring software on computer 303 can use these statistical results through network file sharing or remote access to the database, and can use predefined management protocols to control traffic Statistical software for remote online management.

Figure 8 shows the workflow of the online management module. As shown in Figure 8, the online management process has some independence from the statistical process shown in Figure 5. The specific steps are as follows:

801. Real-time monitor the control command sent by the IP network.

802. Perform permission authentication after receiving the control command.

803: If the authority authentication is passed, analyze the control protocol, and then determine whether the received configuration command or query command is received.

804. If it is a preparation command, adjust the working status of the data statistics module and the data receiving module online, for example, deploy a statistical strategy;

805. If it is a query command, directly retrieve the data to be queried from the data file or database of the computer 301 hard disk or other storage medium for network / traffic statistics recording;

806. After the processing result of the configuration command or the query command is encapsulated according to the protocol, it is sent to the control command issuer through the control port.

It can be seen that the online management process will affect the initial configuration in step b above, for example, it will affect the traffic statistics configuration of the IP device; in addition, the statistical result obtained in step 507 may be queried, and the statistical result will be output to the issuer of the control command, so that Perform other operations such as billing and monitoring based on statistical results.

In summary, the method of the present invention can customize the statistical strategy according to needs without adding network equipment, and can obtain comprehensive and detailed traffic statistics of multiple IP equipment. The network management flow statistics software and the network management performance analysis monitoring software based on the present invention and The billing software is independent of each other and can be installed on one or more computers as needed. According to the characteristics of the IP device, the traffic statistics method of the present invention can distinguish uplink / downlink traffic and can simultaneously count; it can also support group statistics of multiple devices on the network at the same time; in addition, the steps of the present invention

In 506, the following 22 data aggregation methods can also be extended:

(1) Source node mode, using source IP address as a key aggregation;

(2) The destination node mode uses the destination IP address as a key aggregation;

(3) Host node mode, using source and destination IP addresses as keywords for aggregation;

(4) Source port mode, using source port number as a key aggregation;

(5) The destination port mode uses the destination port number as a key aggregation;

(6) Agreement method, using the name of the agreement as a keyword aggregation;

(7) Detailed destination node mode, using destination IP address, source port number, destination port number, and protocol name as keywords for aggregation;

(8) Detailed host node method, using source IP address, destination IP address, source port number, destination port number, and protocol name as keywords for aggregation;

(9) Detailed interface mode, aggregated by five keywords: source IP address, destination IP address, input interface index, output interface index, and next hop IP address;

(10) The bill service method is aggregated with six keywords: source IP address, destination IP address, source port number, destination port number, protocol type, and service type;

(11) Autonomous domain aggregation mode, using the source autonomous domain number and the destination autonomous domain number as keywords to aggregate;

(12) The network matrix mode is aggregated by six keywords: input interface index, output interface index, source IP subnet, destination IP subnet, subnet mask of source IP address, and subnet mask of destination IP address.

(13) Detailed source node mode, aggregated by four keywords: source IP address, source port number, destination port number, and protocol name; (14) Detailed autonomous system matrix method, with nine keys: source IP address, destination IP address, source port number, destination port number, protocol name, input interface index, output interface index, source autonomous system number and destination autonomous system number Word aggregation

(15) A simple autonomous system aggregation method, using the four keywords of interface SNMP index, output interface index, source autonomous system number and destination autonomous system number to aggregate;

(16) A single protocol port aggregation method, which uses source port number, destination port number, and protocol name to aggregate;

(17) A single-source prefix aggregation method, in which four keywords, namely, an interface index, a source autonomous system number, a source IP subnet, and a source IP address subnet mask are used to aggregate;

(18) The destination prefix aggregation method is to aggregate four keywords: an output interface SNMP index, a destination autonomous system number, a destination IP subnet, and a destination IP address subnet mask.

(19) The prefix aggregation method includes input interface index, output interface index, source autonomous system number, destination autonomous system number, source IP subnet, destination IP subnet, source IP address subnet mask, and destination IP address. Subnet mask aggregation of eight keywords;

(20). The host matrix method of the autonomous system is aggregated with four keywords: source IP address, destination IP address, source system number and destination autonomous system number.

(21) The host interface matrix mode is aggregated by source IP address, destination IP address, protocol name, input interface index and output interface index;

(22) Detailed call list mode, aggregated by eight keywords: source IP address, destination IP address, source port number, destination port number, protocol name, service type, input interface index and output interface index.

The above are only the preferred embodiments of the present invention, but the scope of protection of the present invention is not limited to this. Anyone familiar with the technology can easily think of changes or replacements within the technical scope disclosed by the present invention. , Should be covered within the protection scope of the present invention.

Claims

Claim

1. A network traffic statistics method for an IP device, wherein a computer used for traffic statistics is connected to an IP device being counted through an IP network, and the method includes the following steps:

(1) The computer for traffic statistics receives the original traffic data sent by the IP device, and stores the raw traffic data into a data cache queue;

2. The method according to claim 1, further comprising the following steps before step (1):

a. Configure the IP device according to the required traffic information;

3. The method according to claim 1, wherein the original traffic data is extracted by a network flow device software module on the IP device.

4. The method according to claim 1, wherein the statistical strategy comprises: a data aggregation method for classifying according to a key field and a value field of the data to be counted; an output method of the statistical result, including a text and a database And binary output mode; and, the length of statistical time.

5. The method according to claim 4, characterized in that the step (1) further comprises: after the computer receives the original traffic data sent by the IP device, first aggregate the data according to the data in the statistical policy. This method verifies these original traffic data, filters out unnecessary original traffic data, and stores the remaining original traffic data in the data cache queue.

6. The method according to claim 4, wherein the step (2) further comprises: after the computer reads the original traffic data from the data buffer queue, first according to the data in the statistical policy The read data is classified and preprocessed in an aggregation mode, and then the preprocessed data is statistically processed according to the statistical strategy described.

7. The method according to claim 6, characterized in that the step (2)) further comprises: judging whether the statistical time reaches the statistical time length in the statistical strategy, and if it is, save it on the computer hard disk Or other storage media, otherwise, return to step (1).

8. The method according to any one of claims 1 to 7, wherein the number of IP devices to be counted may be one or more.

9. The method according to any one of claims 1 to 7, wherein the IP device is an IP device group that defines addresses or names of multiple IP devices as an overall statistical object.

10. The method according to any one of claims 1 to 7, wherein the method further comprises the following online management steps:

(a) Real-time monitoring of control commands from the IP network;

(b) After receiving the control order, conduct authority verification;

(c) If the authority authentication is passed, analyze the control protocol and determine whether the configuration command or query command is received;