DE69333761T2 - Network analysis method - Google Patents

Description

The The present invention relates to a network analysis method for use in deciding whether a network is in two subnets should be split.

The Mesh analysis method of the invention finds particular application in determining whether a network is divided into subnets (or logical segments) that should be through bridges connected at the level 2 of the 7-layer OSI reference model work. However, the mesh analysis method may be used in appropriate circumstances to decide whether a network (e.g., an IP network) is being used by a network Router or gateway or gateway operating on the Level 3 of the OSI Reference Model should be subdivided.

There Network monitoring systems The network operator has become more and more sophisticated and comprehensive a growing problem in identifying significant data the volume of data in a network operation by such monitoring systems is delivered. This is especially the case when the affected Network has multiple subnetworks, with certain nodes being global Server over all subnetworks, because it is difficult in such cases, have a real effect Image of what is actually happening in each subnet.

The Document "Some graph partitioning problems and algorithms related to routing in large computer networks "(Some Graph partitioning problems and algorithms related to a guide in big Computer Networks) by A. Bouloutas et al., Presented in the International Conference of distributed computing systems 1989, represents the next state of the Technology for the network partitioning problem.

A The object of the present invention is a network analysis method to make that an assessment facilitating the operation of the network at a subnetwork level.

Summary the invention

• 1) Überwachen des Netzes, um Verkehrsdaten zu sammeln und zu speichern, die eine Verbindung bzw. ein Verbindungsmaß zwischen den Knoten des Netzes, beurteilt nach einem Verkehr zwischen denselben, anzeigen;
• 2) Ausführen eines iterativen Prozesses zum Analysieren der Netzverkehrdaten, um die Knoten in Arbeitsgruppen zu klassifizieren, wobei jede derselben einen lokalen Server und einen oder mehrere Clientenknoten aufweist, wobei jede Iteration dieses Prozesses ein Zuteilen des Knotens mit der höchsten Verkehrsverbindung zu einer jeweiligen neuen Arbeitsgruppe als einen lokalen Server, ferner ein Zuteilen, als Clientenknoten zu der gleichen Arbeitsgruppe, der Knoten, deren Verbindung zu dem lokalen Serverknoten größer als ein vorbestimmter Teil der Gesamtverbindung des betreffenden Knotens ist, und ein Modifizieren der Verkehrsdaten durch eine Entfernung von Verkehr, der der neuen Arbeitsgruppe zugeordnet ist, beinhaltet;
• 3) Ausführen eines Prozesses zum Zusammenführen der bei Schritt (1) identifizierten Arbeitsgruppen, um zwei verbleibende Arbeitsgruppen zu hinterlassen; und
• 4) Entscheiden, ob sich ein Aufteilen des Netzes in zwei Unternetze lohnt, wobei jedes derselben eine jeweilige der Arbeitsgruppen beinhaltet, durch ein Vergleichen der Menge an Verkehr zwischen zwei Arbeitsgruppen, die nach Schritt (3) verbleiben, mit dem Gesamtverkehr, die jeder derartigen Arbeitsgruppe zugeordnet ist.

According to the present invention, there is provided a network analysis method for use with respect to a network having a plurality of nodes, the method comprising the steps of:

• 1) monitoring the network to collect and store traffic data indicating a link between the nodes of the network judged by traffic therebetween;
• 2) performing an iterative process for analyzing the network traffic data to classify the nodes into workgroups, each having a local server and one or more client nodes, each iteration of that process allocating the node with the highest traffic connection to a respective new workgroup as a local server, further allocating, as a client node to the same workgroup, the node whose connection to the local server node is greater than a predetermined part of the overall connection of that node, and modifying the traffic data by a removal of the traffic new working group includes;
• 3) performing a process of merging the workgroups identified in step (1) to leave two remaining workgroups; and
• 4) Deciding whether it is worth dividing the network into two subnets, each of which includes a respective one of the workgroups, by comparing the amount of traffic between two workgroups remaining after step (3) with the total traffic that each of them Workgroup is assigned.

Preferably the process of step (3) is an iterative process that one Identify the workgroup with the least amount of associated traffic and a merge same with the working group to which the same the highest connection includes.

The The object of the invention is achieved by the method according to claims 1 to 6 executed.

Short description the drawings

One Network analysis method according to the invention will now be made by way of non-limitative example on the attached schematic drawings described in which:

1 is a node cluster diagram representing an exemplary network with four subnets;

2 a diagram that is out of that 1 however, resembles an exemplary overall traffic between nodes of the network 1 for a certain monitoring period;

3 Fig. 12 is a diagram illustrating the main program items and data structures used in the mesh analysis method;

4A shows a first form of traffic element data structure;

4B shows a second form of traffic element data structure;

5 is a flowchart of an extract-from-server program that is in 3 is shown;

6 a diagram that is out of that 2 but only shows that component of the overall traffic that includes a node N1;

7 a diagram that is out of that 2 however, it only shows the components of the overall traffic remaining after a removal of a traffic associated with global servers, as by the Extract-from-Servers program 5 is identified;

8th a diagram that is out of that 2 is similar, but shows only part of the network and only the component of the overall traffic associated with a local server node N5, as determined by the Extract-from-Server program 5 is identified;

9 is a flowchart of a motion suggestion program that is in 3 is shown;

10 a flowchart of a place-of-server program item is that generated by the motion suggestions program 9 is used;

11 Figure 12 is a flow diagram of a Place-Of-Client program item issued by the Motion Suggestions program 9 is used;

12 a diagram that is out of that 2 is similar, but shows only a subnet and only those components of the overall traffic that are local to the subnet and mapped to local servers, as by the Extract-from-Server program 5 is identified;

13 is a flowchart of a distribution proposal program that is in 3 is shown;

14 is a flowchart of a clipping-of-workgroup-program-object that is out through the splitting-suggestion-program 13 is used;

15 is a flowchart of a merge-of-workgroup-program-object that is out through the splitting-suggestion-program 13 is used; and

16 FIG. 5 is a flowchart of a split decision program item issued by the split proposals program. FIG 13 is used.

Best embodiment the invention

1 FIG. 10 illustrates an exemplary network having four logic segments (sub-networks) X1, X2, X3, and X4, each having a plurality of nodes N, the nodes associated with a particular logic segment being grouped together. The logic segments are interconnected by spanning devices in the form of bridges operating at level 2 of the 7-layer OSI reference model. Each bridge appears in the cluster diagram 1 in the form of a corresponding node in each of the two logic segments that connects them. The structure of the connection of the logic segments through the bridges is not relevant to the purposes of the present description. The exemplary network 1 may be formed by bridged Ethernet, each node being identified by an Ethernet address that is valid across all logic segments of the network. Nodes N are the source and sink of traffic to each other, this traffic being in the form of discrete message packets carrying both source and destination node addresses, as well as the data to be transmitted.

The network off 1 is used as the basis for exemplary traffic distribution diagrams which will be used hereafter to facilitate the description of the network analysis methods of the invention. For purposes of the following description, it is assumed that the topology of the network is already known as to which nodes are associated with which logic segments.

2 puts traffic through the network 1 over a certain period of time, with the course of message packets between two nodes being represented by a line drawn therebetween, the thickness of the line providing a rough indication of the amount of traffic. In the present example, traffic flows are derived by examining the layer 2 source and destination addresses associated with each packet. Since the layer 2 addresses are valid throughout the network, examining the layer 2 addresses gives the true source and destination nodes of a packet regardless of the path taken by the message packet over the network.

Despite the lack of clarity in 2 which results from the crowding of the traffic lines, it is possible to see that certain nodes communicate very strongly with the other nodes of the network. The nodes N1 and N2 on the Logic segment X1 z. B. seem to communicate with actually all other nodes of the network, which can reasonably conclude that these nodes have a certain total role when monitoring or controlling the network.

While diagrams of the form out 2 give a network operator a general impression of what is happening in the network, they do not allow a detailed study of the behavior of the network and can easily be misunderstood.

The network analysis methods described below analyze traffic data similar to the ones used to form maps 2 with a view to providing helpful information about the nature of the network and how to improve its performance.

The general philosophy behind the network analysis methods that are still Be described, that is that strong improvements in performance In general, the network does not require a repositioning of nodes originate, which have a global structure of communications (i.e. Communication is not primary with a logic segment) but by modifying the network in terms of nodes, mainly communicate with a logic segment (though not necessarily the segment where the node itself is located).

A important analysis task is therefore, the nodes, mainly on a global basis ("global Server ") communicate to locate the node, which is mainly with only one segment communicate and main communicators regarding this segment are ("local Server "). It is to realize that while There may be many nodes, mainly with only one segment Only some of these nodes have a server-like role to have. Thereupon the local servers are identified the network analysis methods described herein are then used to proposals as to whether to make one of these local servers another logic segment should be moved, and in terms of its whether there is a splitting of a segment between two associated ones worthwhile for local servers.

3 Figure 11 shows the main program items and main data structures used in the implementation of the present invention described below. In particular, three main program components are provided, these being an extract-from-server program 10 , a motion suggestion program 1 and a distribution proposal program 12 are.

For the extract-from-server program 10 Both traffic data and data about the logical arrangement of the network are available. The traffic data is in the form of a set of traffic elements 22 that characterize node-to-node traffic on the network over a period of time. The data about the logical arrangement of the network are in the form of a list of segments 20 and a list of nodes 21 Each list includes association information between segments and nodes. The extract-from-server program 10 analyzes the traffic data in traffic elements 22 set out to a global server list 23 and a local server list 24 to create.

The motion suggestions program 11 includes program items Place-by-Server 13 and placing-by-client 14 , The motion suggestions program 11 in turn, look at each local server running through the program 10 is identified to decide whether it would be beneficial to move the local server to another segment, and if so, whether there is also an advantage in moving one of its client nodes (ie nodes with which it is communicating ) to the same segment. Based on this analysis, the program generates 11 a list of motion suggestions (node motion list 25 ). The program 11 also generates a list of workgroups (workgroup list 26 ), where each workgroup has a local server and its closely related client nodes, if any.

The distribution proposal program 12 includes program elements clipping-from-workgroup 15 , Merge-of-workgroup 16 and distribution decision 17 , The program 12 looks at each logical element of the network and groups all nodes using the workgroups that are in the workgroup list 26 are listed as a base in two working groups. The program 12 then makes a decision as to whether it is worth splitting the segment between two workgroups, and if it decides that there is an advantage, there is a split proposal in a segment split list 27 one.

As will become clear below, the level of maturity of the programs depends 10 . 11 and 12 (and in particular the program 10 identifying global and local servers) from the level of detail provided by the traffic data (elements 22 ). Thus, the traffic data may simply be based on level 2 packet information, that is, on the source and destination node addresses message packets routed over the network, with no attempt to look at higher-level structuring included in the data portion of the packets. Alternatively, the traffic data may consider such higher-level structuring with consideration of providing an indication as to whether packets being routed to and from a particular node act so that the node acts in a server role or in a client role. In the absence of this more detailed form of traffic data must be the extract-from-server program 10 his assessment of which nodes are servers, just on the basis of Verkehrsverbindungsmaßgrößen hit.

suitable Network monitoring systems It will be apparent to those skilled in the art which level of Traffic data is always required. Such a system is z. In our European Patent Specification EP-A-0 480 555, which is based on random sampling based on packages (it can be seen that certain details in terms of how much data is on each scanned packet are recorded, u. U. of those described in this specification are to be changed have to, however, such a change for professionals is a routine matter in this area). Other surveillance systems, including those each at the watchpoints can record received packet also be used.

For clarity of explanation, first the operation of the programs 10 . 11 and 12 without referring to a study of higher level structuring of the packet data in the case where the traffic data is based on the level 2 packet information. The advancements that are possible with higher level structuring information are then discussed.

As has been indicated, the traffic data provided by the programs 10 . 11 . 12 be analyzed, a set of traffic elements 22 on. 4A shows the structure of a traffic element 22 in the case where the traffic data is based only on level 2 packet information. As can be seen, each traffic element has four fields, namely a node 1 identity field, a node 2 identity field, a total traffic field, and an "enable" flag field 22 the shape 4A There is a respective traffic element 22 for each pair of communicating nodes in the network, the identity of the affected nodes being recorded in the node 1 and node 2 identity fields. Every such traffic element 22 is used to record the total traffic (e.g., given the number of packets and / or the number of bytes) that is forwarded between the affected nodes in both directions.

The enable flag field of each traffic element 22 out 4A Allows items to be tagged for inclusion or exclusion from the traffic data at any given time by the programs 10 . 11 . 12 to be viewed as. By convention, if is an element 22 has set its prophecy flag to contain the same in the currently relevant traffic data, while if the flag is reset, the element is excluded. At the beginning (at the beginning of the program 10 ) are the activation flags of all traffic elements that make up the traffic data in a set state.

Regarding viewing the extract-from-server program 10 this program is in flowchart form in 5 shown and shows steps 30 to 39 on. At the beginning, the program examines 10 the traffic data generated by the traffic elements 22 and generates a list of all active nodes (step 30 ), ie nodes that send or receive traffic. If there are actually no active nodes (in step 31 tested), the program ends 10 immediate. However, if, as is generally the case, the traffic data shows that there are active nodes, the program will run 10 with step 32 in which it sees the presence of nodes in the list of active nodes acting as global servers.

In In this context, "global server" means a node, its traffic connection with one of the logic segments X1 to X4 of the network less than a predetermined one Share of total connection this node is with all segments. Generally, this predetermined proportion 50% or something similar Percentage. In other words For example, a global server is a node with no predominant connection metric to a particular one Logic segment of the network.

The measure of the traffic connection measure used in making the assessment as to whether a node is a global server is preferably simply a count of the number of partner nodes, ie the number of nodes with which the node of interest communicates. However, it would be possible to base the measurement on traffic volume in terms of packets, frames or bytes exchanged with each logic segment, assuming the overall traffic field of each traffic element 22 records the appropriate information.

6 sets the network traffic due to a global server node N1 in the logic segment X1 As can be seen, the node N1 communicates with substantially all other nodes with the result that its communication with each other of the logic segments X1 through X4 is less than 50% of its total communication with all segments.

Assuming that at least one global server in the active node list in step 32 is found, the program performs 10 next step 33 in which it identifies the global server in the active node list having the highest total traffic connection metric (again preferably measured for a partner node count, and if two global servers have the same partner node count, then it can be assumed that the total traffic volumes are considered). As soon as step 33 has identified the most active global server, the identity of that server becomes the global server list 23 added (step 34 ).

The program 10 next go to step 35 continue, in which the just identified server is removed from the active node list and its associated traffic elements are disabled by resetting the enable flag in each of these elements.

The program now returns to step 32 back and performs a test based on the modified traffic data (ie the traffic data, whereby certain of the elements 22 disabled) to see if there are any global servers present in the Active Node List; if this is the case, the step 33 to 35 repeated. This process continues until there are no more global servers in the Active Node List through the test from step 32 be identified. For the exemplary traffic off 2 Three iterations of the step occur 33 to 35 until no more global server is found. The first iteration identifies node N1 as a global server, the second iteration identifies node N2 as a global server, and the third iteration identifies N3 as a global server. If the traffic elements of these global servers are disabled, the remaining elements represent a traffic distribution that is in 7 is shown.

When step 32 can not identify a global server will step 36 executed to test for the presence of a local server in the Active Node List. In this context, a "local server" is a node whose traffic link with the logic segment to which it is most connected is greater than a predetermined proportion (generally 50% or so) of its total link with all segments The nodes N4, N5, N6 and N7 off 7 as local servers for the traffic being considered (in fact there are a number of other nodes that are in 7 act as local servers, but they are not referenced for clarity). It will be appreciated that the measure of traffic link used in testing for a local server, as in the global server test, may simply be a count of partner nodes or may be a measure of the actual traffic volume. It can also be seen that the traffic connection measures are performed on the basis of the traffic data, as are the same by the deactivation of traffic elements by step 35 are modified.

Assuming that at least one local server is identified in the active node list, the program moves 10 then with step 37 in which it identifies the local server with the highest traffic connection metric (preferably measured as a count of the total number of partner nodes, with a tie being resolved by a reference to traffic volume). Once the local server with the highest traffic link has been identified, the identity of that server becomes the local server list 24 added (step 38 ). step 35 is then executed to remove the identified server from the active node list and its associated traffic elements 22 to disable.

After that, the program returns 10 in a loop back to step 32 to test again for the existence of global servers in the active node list (it will be appreciated that the deactivation of the traffic elements associated with the currently identified local server may have resulted in the appearance of a new global server in the active node list, though is not the case for the present exemplary traffic).

The identification of global and local servers thus continues with the preferred identification of global servers until no more global or local servers are found. This causes the program of step 36 to step 39 exit, in which the same all traffic elements 22 reactivated while the program is running 10 have been disabled. The program 10 ends then.

Once the extract-from-server program 10 the local server has identified the motion suggestions program 11 in order to ensure the optimal logic segment X1 to X4 for each server and to suggest, as a consequence, whether to move a local server node along with one of its client nodes. A typical situation in which a local server could be usefully moved is in 8th representing the logic segments X3 and X4 and the component of the traffic in 7 1, which is associated with a local server node N5. Out 8th It can be seen that the node N5 communicates mainly with the logic segment X4, although the local server node N5 is located on the logic segment X3. It would, of course, be advantageous if the local server node N5 were moved from the logic segment X3 to the logic segment X4. This type of situation should be the motion suggestions program 11 identify.

9 is a flowchart of the motion suggestions program 11 , This program should act on the collected traffic data, of which the traffic elements 22 that were assigned to the identified global servers have been removed. Consequently, the first step 40 of the program 11 Disable the traffic elements associated with the global servers. Then the program enters 11 a loop structure in which each local server is considered in turn in a partner count size order (step 41 ), wherein the exit test from this loop structure in step 42 is, which performs a test to see if there is any local server left to process.

Each local server becomes processing steps 44 to 48 to determine whether it should be moved to a different logic segment, or whether one of its client nodes should be moved.

In particular, in step 44 the placing-of-server program item 30 to determine whether the considered local server (the current "destination" server) should be moved, with motion suggestions in the node move list 25 to be placed. The Place-Of-Server Program Object 13 It is also believed that it implements a suggested move for the destination server to enable the subsequent step 46 checks if any of the client nodes of the target server should also be moved.

In step 45 For example, a new workgroup data structure (hereafter referred to simply as a "workgroup") is created for the destination server if it has not previously been included as a client node in a workgroup that was earlier in an iteration of steps 44 to 48 with respect to a local server with a higher client node count. The workgroups are in a workgroup list 26 connected. Each workgroup is considered to be associated with the logic segment on which the local server causing the generation is located.

Next will be in step 46 the placing-of-client program item 46 to ensure that any of the client nodes of the target server should be moved to the logical segment of the server (this is the segment on which the server resides after an implementation of a motion suggested by step 44 provided). Each client move proposal generated by the place-of-client program is in the node move list 25 stored, with each suggestion being temporarily implemented. Further, each client node that is well connected to the destination server (ie, at least half of the total client connection size is at the destination server) is placed in the same workgroup as the destination server.

It it can be seen that a assess whether a client node works well with its associated local server ver is connected, by looking at the traffic volume measurements and not the node count is executed.

After all client nodes of the destination server have been examined to see if they could preferably be moved, an assumed movement of the destination server and its clients from their original segments is determined by an appropriate action in the relevant segment and node data structures 20 and 21 vice versa (step 47 and 48 ).

Once all the local servers in the local server list 24 recorded, a processing in the steps 44 to 48 have undergone the looping structure of the motion suggestions program item 11 at step 42 and all Global Server traffic items are re-enabled (step 49 ) before the program object 11 is ended.

It is noted that the reason why the local server through the program object 11 In order to process their client count size, the assignment of nodes to workgroups is step by step 45 maximize as much as possible. In particular, by later processing the less connected local servers, it is possible that they have already been included in the workgroup of a more connected local server. In this case, not only the less connected local server is included in the same workgroup as the more connected local server, but also the client nodes of the less connected local server, which are well connected to the less connected local server, are more connected to the working group local server included.

10 Figure 12 is a flowchart of the Place-Of-Server program item 13 in step 44 of the motion suggestions program 11 is performed. The placing-from-server program 13 obtains the identity of a particular destination server and then proceeds to test whether it is worth moving the server to a different segment. As a preparatory step, however, the program leads 13 first, test to see if the server is actually a spanning device (bridge / router / gateway) that can not be readily moved and for purposes of the program 13 should be treated as firm (see step 50 ). Actually, step 50 are generalized to a check of a list of nodes that are specified as immovable for some reason.

The placing-from-server program 13 next go to step 51 on which the optimal segment for the server under consideration is ensured. In the present example, this is done by looking for the minimum total hop count between the server and its client nodes, which works on the basis that a client on the same segment as the server has a "zero" hop count, whereas a client on a different segment has a "one" jump count (regardless of how many segments actually have to jump on the physical network to forward a message from the server to that client). So the server is supposedly again arranged on each logic segment and the corresponding hop count is calculated. The segment location that generates the minimum hop count is then identified as the optimal segment for the server under consideration.

It it can be seen that others Dimensions as the simple skip count measurement, described above for determining the optimum segment can be used. Suitable dimensions are the ones for any location of the server sensitive to the intersegment component of the Traffic between the destination server and its clients. So z. B. another suitable measure that Inter-segment traffic volume in packets / frames / bytes, for each position of the server.

Once the optimal segment location has been determined for the destination server, a check is made in step 52 in terms of whether this segment is different from the current segment of the target segment. If these segments are the same, the program ends 13 , However, assuming that the optimal segment is different from the current segment for the server, step 53 is executed, in which a check is made as to whether the destination server is already firmly established as a client node in a workgroup generated with respect to a previously-considered server. As explained above, it is possible that a server as a client is well connected to a better connected server and therefore is firmly in the workgroup latter. In this case, the less well-connected server is considered immobile, with the program 13 is terminated without making a motion suggestion to the server.

Provided that the destination server is not fixed as a client in the workgroup of another server, step 54 the placing-of-server program 13 executed to propose a motion to the node motion list 25 add. This proposal identifies the affected server, its current segment, and the proposed new segment. The proposed move is also believed to be performed, at times, by appropriate modification of the server and segment data structures to indicate that the server is now on the just identified optimal segment. Then the program ends 13 ,

11 Figure 10 is a flowchart of a Place-Of-Client program item 14 in step 46 of the motion suggestions program 11 is performed. The program 14 is executed for each client node of the destination server during a current iteration of the motion suggestions program 11 is looked at.

The first two steps 60 and 61 of the program 14 check if the client node under consideration is already fixed in a workgroup, or if it is a device (or otherwise more generally immovable), in either case the client node is considered immobile and the program 14 is ended.

However, provided that the client node under consideration is not immovable, a test will be next in step 62 to see if the client node is well connected to the affected server. In this context, "well connected" means that the connection score of the client node to the server is more than 50% of the total connectivity of that client's node (measured by traffic volumes) If the client node is not well connected to its server, it will not be considered appropriate for the client node to be moved to the same segment as the server, the program 14 ends. However, if the client node interfaces well with the server under consideration that is, the client node is added to the server's workgroup, and the identity of the destination is entered into the data structure of the client node, identifying the server as the primary server for the client node (step 63 ). After that, in step 64 a check is made as to whether the segment of the client is different from the segment of the server, if so, step 65 is executed to make a motion suggestion in the node motion list 25 which suggests that the client node is moved to the segment of the server. An execution of step 65 also includes temporarily moving the client node to the segment of the server by updating the affected client node and the affected segment data structures.

After describing the operation of the motion suggestion program 11 and its associated program items 13 and 14 now becomes the allocation proposal program item 12 with its associated program items 15 . 16 and 17 considered.

The distribution proposal program 12 again looks at each logic segment to decide whether it would be beneficial to divide one of the segments into two. 12 Figure 5 illustrates a situation taken from the exemplary traffic data where a logic segment, in this case the segment X2, is split into two segments (here, corresponding to groupings based on local server nodes N6 and N7).

The allocation proposal program 12 starts from the base of the node groupings that are in the workgroup list 26 through the motion suggestions program 11 were formed. However, the workgroups that are in the list 26 are not immediately usable to make a decision regarding segment splitting, since each such workgroup may contain nodes of more than one segment and additionally not all the network nodes are included in the workgroups (only the nodes that are well connected to server nodes, were through the program 11 locked in).

Referring to 13 includes the first step 70 of the allocation proposal program 12 checking if there are workgroups in the workgroup list 26 gives. If no such workgroups exist, the program becomes 12 ended without any segmentation proposals being made. Generally, however, there are several workgroups in the workgroup list 26 , in which case the program 12 with step 71 The cut-off continues in the Workgroup Program object 15 is performed. The purpose of the clipping-from-workgroup program 15 This is to cut each workgroup to be segment-only and to include only nodes on that segment, their join by nodes on the segment to the server with respect to which the workgroup in step 45 from program 11 was generated, can be traced. In particular, the program removes 15 any node from the workgroup that is not on the same logical segment as the workgroup, and also any node whose inclusion in the workgroup is either directly or indirectly a result of the original inclusion of a node that is not on the logic segment of the workgroup.

Once the workgroups have been cut off, it will turn into a loop structure that has a looping mechanism based on the steps 72 and 73 for picking up each segment and executing processing steps 74 to 77 occurred. In particular, in step 72 the first or next segment in the list of segments targeted, where step 73 checks if the end of the list has not yet been reached (if this is the case, the program ends 12 ).

For each logic segment, the steps become 74 to 77 executed. In step 74 will create a collection "WGCLTN" from all workgroups in the list 26 which are relevant to the current target segment. step 75 Check if there is more than one workgroup in the WGCLTN collection. If this is not the case, it is assumed that it is not worth splitting the logic segment, with processing returning to the beginning of the loop to accommodate the next segment. Assuming, however, that there are at least two workgroups in WGCLTN, the program will run 12 with step 76 In which the Merge-Of-Workgroups program object 16 is executed, which means that all nodes are assigned to the considered logic segment workgroups and the number of workgroups is reduced to only two.

Then step leads 77 the division decision program object 17 to decide whether it is worth the considered logic segment according to the final two working groups, by step 76 were split up. A positive distribution proposal is added to the segment distribution list 27 where each entry identifies the affected segment and the two groupings of nodes into which a subdivision of the segment is proposed.

14 Figure 12 is a flow chart of the Clip-off Workgroup Program item 15 , This program 15 basically has one Double loop structure, through the processing steps 85 to 87 on each constituent node of each workgroup in workgroup list 26 be applied. In particular, the steps 80 and 81 Loop control steps that cause the program 15 every workgroup in the list 26 examined in turn until all work groups were examined. For each new workgroup examined, a list is "removed" in step 82 initialized. Thereafter, an inner loop structure is entered in which each node of the current workgroup is viewed in turn. However, a progression down through the constituent nodes of a workgroup depends on whether one processing step 86 or not, and if so, that node is removed from the workgroup and placed in the removed list, and processing of the workgroup nodes begins again at zero. By contrast, when step goes 86 is not performed on a particular node, advances down the nodes of the considered workgroup.

In particular, after the list is removed in step 82 was initialized, step 83 the first constituent node of the target working group, where step 84 checks if there is such a node (if this is not the case, it indicates that all nodes in a workgroup have been processed, with processing to step 80 returns to pick up a new working group). step 85 is then executed with respect to the first node, which step is simply a test of whether the affected node is on the same segment as the workgroup. If the destination node is not on the same segment as a workgroup, then step goes 86 executed to remove the target node from the workgroup and add it to the removed list. Thereafter, the processing returns to step 85 back, ie the same workgroup is picked up again and its first new node found. On the other hand, when in step 85 it is found that the target node is on the same segment as the workgroup, step 87 to ensure that the primary server of the target node is in the removed list, which of course is not the case with reference to the first node being examined for a workgroup. A negative result in step 87 results in an execution of step 88 to move the destination node to the next node in the workgroup and to move the processing to step 84 to return. Processing continues in this fashion, with nodes from the current workgroup in step 86 be cut off if they are either not on the same segment as the workgroup (in step 85 tested) or the primary server of the affected node is in the remote list (in step 87 ) Tested. When a node is truncated, processing of the workgroup nodes is reinitialized.

15 Figure 12 is a flow chart of the Merge-of-Workgroup program item 16 in step 26 of the distribution proposal program 12 is performed. When starting this program object, many of the nodes of the affected segment may not yet be allocated to the work groups relevant for the segment. The first step 90 of the program 16 therefore serves to generate a set "AUN" of all active, unallocated nodes on the segment of interest, ie nodes with associated traffic that are not yet in a workgroup of the segment.

Once the list AUN has been generated, the program will run 16 with step 91 It also creates a respective new workgroup for each node in AUN, with each such workgroup being logged in the WGCLTN collection by workgroups for the affected segment.

An iterative process is then performed to reduce the number of workgroups in the WGCLTN collection to two, with step 92 a test for this condition is. The process of reducing the number of workgroups to two is accomplished by merging workgroups. So in step 93 the smallest workgroup in WGCLTN is identified either in terms of the number of affected nodes or the traffic volume flowing between these nodes. Once this smallest workgroup is identified, it is removed from the WGCLTN collection and added to the workgroup in WGCLTN, which has the largest join size (given node or traffic volume), with this addition in step 94 is performed.

Once the number of workgroups in WGCLTN has been reduced to two, the merge-from-workgroup program becomes 16 completed.

16 Fig. 10 is a flow chart of the split decision program item 17 in step 77 of the distribution proposal program 12 is performed. The program 17 makes a decision as to whether a logic element should be split into two such segments corresponding to the two remaining workgroups in the WGCLTN list for the affected segment. This decision is made on the basis of traffic flows in and between the two working groups (for convenience, these working groups are referred to as WG1 and WG2). In the flowchart 16 becomes Assuming that the traffic flow is evaluated in bytes, this of course depends on the traffic unit used in the traffic measure which is in the overall traffic field of the traffic elements 22 is collected.

In step 95 from program 17 the internal traffic of each workgroup WG1 and WG2 is determined, this internal traffic being the total traffic between nodes within each workgroup. Also in step 95 a determination of the connection dimension between the workgroups WG1 and WG2 is performed. As already indicated, the internal traffic measures and the workgroup connection metric are displayed in the flowchart 16 all determined by bytes.

Next is step 96 executed to determine all internal traffic for the affected segment, again in bytes.

• – ein Test, daß der interne Verkehr, in Bytes, für jede der Arbeitsgruppen WG1 und WG2 größer als ein vorbestimmter Prozentsatz (z. B. 20%) des gesamten internen Verkehrs des Segmentes ist;
• – ein Test, daß die Anzahl von Knoten in jeder der Arbeitsgruppen WG1 und WG2 größer als eine vorbestimmte Schwelle ist (z. B. 4);
• – ein Test hinsichtlich dessen, ob das Verbindungsmaß zwischen WG1 und WG2 kleiner als der interne Verkehr für jede Arbeitsgruppe von WG1 und WG2 ist.

On the basis of the previous dimensions, then step 97 performed to determine whether dividing the affected segment in two is worthwhile. The criteria used for this decision are practical and may vary depending on the circumstances. Essentially, however, splitting a logic segment only pays off if the overall connection between the two workgroups WG1 and WG2 is not too large. It also makes little sense to split a segment if one or both of the workgroups represent only a small amount of total traffic for the segment, or if the number of nodes in one of the workgroups is small. step 97 gives details of what has been done by running three tests and only recommending splitting the segment if all three tests are passed. These three tests are as follows:

• A test that the internal traffic, in bytes, for each of the workgroups WG1 and WG2 is greater than a predetermined percentage (eg 20%) of the total internal traffic of the segment;
• A test that the number of nodes in each of the workgroups WG1 and WG2 is greater than a predetermined threshold (eg 4);
• A test as to whether the link between WG1 and WG2 is less than the internal traffic for each WG1 and WG2 workgroup.

As already mentioned at the beginning The above description is an implementation of the network analysis method the invention for the case where the traffic data does not indicate the server / client role of a node sending / receiving data. Such information can however available be. So z. For example Messages sent under the TCP protocol, every message a source node port number and a destination node port number. Certain Port numbers are for the more common Assigned services in advance. Port numbers that way are assigned in advance are known as "known ports." A machine z. For example, which provides a host name server service does so at one known port with a port number of 42, being similar to an X.400 mail service is provided on a known port number 103.

Generally acts when a node uses an endpoint that is not known Port is and communicates with a known port of another node, this latter node as a server, during the first-mentioned node acts as a client. A check Therefore, the port numbers of the source and destination nodes allows an estimation of the roles are performed, which is done by the nodes become.

It occurs frequently on that both Nodes communicate with each other through known ports. In this Case either no assessment can be made as to which node acts as a server and which acts as a client, or it has to resort to a certain prioritization of known port numbers be an assessment regarding the roles of the affected node perform. Naturally helps if no node uses a known port, viewing Port numbers do not determine the roles of affected nodes.

4B FIG. 12 illustrates one form of traffic element data structure suitable for use in the case where known port numbers are used to identify node roles. The first two fields of the data structure off 4 contain the identities of the communicating node pair. The fourth and fifth fields are used to specify which of the identified nodes acts as a client and which acts as a server (if such information was derived). The fifth field identifies the protocol under consideration, in which respect the use of the known port is not limited to the TCP protocol and identical or similar mechanisms operate in other protocols. The sixth field of the data structure 4B is used to hold the port count for a node that has been identified to act as a server, this port number being of course a known port number. The seventh and eighth fields contain traffic volume data in the two directions of traffic flow between the pair of affected nodes. The last field is the Activated Flag field, already referenced above with reference to the data structure 4A has been described.

It can be seen that while there is no role information collected in the case where be only necessary to provide a traffic element for each pair of nodes, such information being derived from the traffic, at least three traffic elements are required with respect to each node pairing, namely an element for recording a traffic with respect to a first of the nodes as a Server acts, a second element for recording traffic with respect to another node acting as a server, and a third element for recording traffic with respect to the node to which no role allocation could be made. In fact, it may be convenient to provide a respective traffic element for each combination of a known port on a node communicating with a non-known port on the other node.

The node role information collected in the above manner is particularly useful in identifying the global and local servers, which is the operation performed by the extract-from-server program 10 is performed. In the execution of this latter program, the estimates of whether a node is a global or a local server are based on its traffic link when acting in a server role as opposed to a client role, such distinction now being made by using multiple traffic elements every node pairing is possible. In particular, in assessing whether a node acts as a server, reference is made to the traffic elements for which that node is identified as a server. In fact, in general, a reference is also made to the traffic elements where the role of the affected node is undefined (in other words, the only traffic elements ignored are those for which the affected node is identified as a client). The inclusion of traffic for which a server has no identified role is consistent with the description of the extract-from-server program 5 stated above, that when there is no traffic, the known port includes, in both cases the same result is obtained.

It will also be appreciated that if the traffic associated with a server is disabled (eg, in step 35 out 5 ), involving only disabling the traffic elements for which the affected node is identified as a server or for which no identification has been made.

Similar considerations apply with respect to how the role information is associated with the motion suggestions program 11 and the distribution proposals program 12 be used.

Various Modifications to the network analysis method described above are of course possible. So although the procedure may be described in terms of a network was made up of subnets by logic segments Level 2 of the seven-layer OSI reference model, the method will also be applied to networks where the subnets take other forms, eg. B. Groupings of nodes passing through routers / gateways which work at level 3 of the seven-layer OSI reference model.

• – Zuteilen des Knotens mit dem größten Verkehrsverbindungsmaß zu einer jeweiligen neuen Arbeitsgruppe als einen lokaler Server;
• – weiteres Zuteilen der Knoten als Clientenknoten zu der gleichen Arbeitsgruppe, deren Verbindungsmaß zu dem Lokalserverknoten größer als ein vorbestimmter Abschnitt (z. B. 50%) des Gesamtverbindungsmaßes des betroffenen Knotens ist, und
• – Modifizieren der Verkehrsdaten durch ein Entfernen von Verkehr, der der neuen Arbeitsgruppe zugeordnet ist.

Furthermore, the three main analysis tasks that can be performed by the extract-from-server program 10 , the Motor Suggestions Program 11 and the distribution proposals program 12 are operated independently, provided that suitable initial information is provided. Thus, the motion suggestions analysis task may be executed independently of the extract-from-server task, provided that the motion suggestions task is provided with a list of local servers and their clients, and appropriate traffic data. Similarly, the splitting proposal task can also be performed independently of the extract-from-server task. In fact, the splitting proposal task could be executed independently of the motion suggestion task, provided that either equivalent workgroup information was made available elsewhere or the operation of the splitting suggestion task was modified to form workgroups themselves. For this purpose, data on traffic inside the affected subnet can be analyzed to classify nodes on the subnet by an iterative procedure into workgroups that include the following steps for each iteration:

• Allocating the node with the greatest traffic link to a respective new workgroup as a local server;
• Further allocating the nodes as client nodes to the same workgroup whose link to the local server node is greater than a predetermined portion (e.g., 50%) of the total link size of the node concerned, and
• Modifying the traffic data by removing traffic associated with the new workgroup.

These Working groups can then be reduced to two in a way already described and then a decision is made with respect to it can, if the subnet useful can be split.

Claims (6)

A network analysis method for use with respect to a network (X2) having a plurality of nodes (N), the method comprising the steps of: 1) monitoring the network (X2) to provide traffic data (X2); 22 ) to collect and store a connection between nodes (N) of the network, judged by traffic between them; 2) performing an iterative process of analyzing the network traffic data to classify the nodes into workgroups, each having a local server (N6, N7) and one or more client nodes, each iteration of that process allocating the node with the highest traffic connection to a respective new workgroup as a local server (N6, N7), further allocating, as client node, to the same workgroup, the node whose connection to the local server node (N6, N7) is greater than a predetermined part of the overall connection of the respective one Node, and modifying the traffic data by removing traffic associated with the new workgroup; 3) performing a process of merging the workgroups identified in step (2) to leave two remaining workgroups; and 4) deciding whether it is worth splitting the network into two subnets, each of which includes a respective one of the workgroups, by comparing the amount of traffic between two workgroups remaining after step (3) with the total traffic each one assigned to such workgroup. A method according to claim 1, where the process of step (3) is an iterative process, identifying the workgroup with the smallest amount associated traffic and merging it with the working group, to the same the highest Compound includes. A method according to claim 1 or 2, wherein the predetermined part, to the in step 2) of claim 1, one half is. A method according to a the previous claims, in which the connection of a node to other nodes (N) in terms at least one of the following is measured: - the number the other nodes with which it communicates; - one Number of frames involved in traffic with the other nodes are; - one Number of bytes involved in traffic with the other nodes are. A method according to a the previous claims, in step 1) of claim 1, monitoring the network for one executed in such a way is to make it possible that role information can be collected that indicates whether a Node (s) in a server or client role relative to individual Traffic objects that are assigned to the same, wherein the Identify a node as a local server (N6, N7) in step 2) without reference to a traffic for which the node is acting as a client acts as indicated by the role information. A method according to claim 5, where the role information based on the known Tor status node endpoints are derived, which are assigned to a traffic are that runs between a pair of nodes, with a node of the straight identified pair acting in one server role and the other Nodes in a client role, where the endpoint for the one Knot is a known goal while the other endpoint is not.