JP2005110037A - Method and device for collecting packet - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To collect only a required information of packets before divided without accumulating and analyzing all of the data, related to the packets which are divided on a route. <P>SOLUTION: A packet processing part 4 holds IP packets which has been taken in a temporary storage device. The IP packets split from the temporary storage device are sequentially read for searching the border of a frame, and a header information of the IP packets before divided is cut out and stored in the storage device. A packet border searching process part 42 compares the sum of a data length of the IP packets which have been already read and the split IP packet length which is currently processed to the IP packet length of the frame acquired from the IP header information at the top of the frame, for determining whether the frame border is within the split IP packets which are currently processed. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a packet collection apparatus and method for collecting header information of an IP packet before division from IP packets divided on a route.

Conventionally, as a method for searching for a boundary of a packet developed in a byte stream and restoring the original packet, it has been necessary to sequentially search the packet boundary through full scanning (hereinafter referred to as linear scanning).
5 and 6 show a conventional packet collecting method. In the example shown in FIG. 5, an IP packet exchanged between A and B based on PPP (Point to Point Protocol) is converted into a byte stream (original packet), and is divided between paths CD in the middle and encapsulated. It has become. Here, in GRE (Generic Routing Encapsulation) or the like, when collecting the divided packets propagating between the CDs, in order to collect and accumulate the header information necessary for the analysis of the original packet, (c) in FIG. As shown in (d) and (e), all the divided packets are collected, the data stream is reconstructed, and the packet boundary is linearly scanned byte by byte and analyzed (GRE packet processing, PPP frame processing). There was a need. Only the collected headers are stored in a disk (storage device).

On the other hand, there are two methods listed below as the conventional traffic monitor / analyzer technology.
(1) Collect traffic on the network and accumulate all information in the collected frames. Then, when the collection and accumulation of a plurality of packets are completed, each frame is analyzed.
(2) By using high-speed hardware, in parallel with packet collection, protocol analysis up to the upper layer in the frame is performed to obtain necessary information.

Further, there is a technique in which the frame length is extracted and stored by paying attention to the fact that not all frame information is necessary for measuring the traffic volume of a LAN (Local Area Network). This makes it possible to measure traffic with a simple configuration at low cost (see, for example, Patent Document 1).
In addition, there is a technique in which an analysis is performed by predicting an upper layer protocol, focusing on the fact that packets from the same application are collected between the same terminals (for example, see Patent Document 2).
JP-A-4-180423 JP-A-7-231317

  However, according to the above-described prior art, it is necessary to collect all the divided packets, reconstruct the data stream, and linearly scan the packet boundary byte by byte. Further, according to the technique disclosed in Patent Document 1, a method of temporarily accumulating all packets and then analyzing them requires a large amount of storage capacity, and is difficult to observe for a long time. Further, since the mass storage device has a low storage speed, there are many occurrences of packet dropping. Furthermore, according to the technique disclosed in Patent Document 2, it is necessary to reconstruct a data stream in parallel with data collection, which requires a large-capacity memory device and high-speed hardware. In any of the patent documents, the correspondence of divided and encapsulated packets is not considered.

  The present invention has been made in view of the above circumstances, and does not accumulate and analyze all data for packets divided on a route, saves storage capacity, reduces the load of collection processing, It is an object of the present invention to provide a packet collection apparatus and method capable of collecting only necessary information of a packet before being divided while reducing the number of missed packets.

  In order to solve the above-described problem, the present invention provides a packet collection device that collects header information of an IP packet before division from an IP packet divided on a route, and the received or accumulated IP packet A packet type determination unit that captures IP packets necessary for analysis, and holds the captured IP packets in a temporary storage device, and sequentially reads the divided IP packets from the temporary storage device to search for frame boundaries And a packet processing unit that cuts out header information of the IP packet before the division and stores it in a storage device.

  In the present invention, the packet processing unit obtains the IP packet length of the frame from the IP header information at the head of the frame, and currently processes the data length of the IP packet already read from the temporary storage device. A comparison of the sum of the divided IP packet lengths and the acquired IP packet length is sequentially performed in units of the divided IP packets, and the frame boundary exists in the divided IP packet currently being processed. A packet boundary search processing unit for determining whether or not.

  Further, in the present invention, the packet boundary search processing unit is configured to store all data and to reconstruct and analyze the data string when detecting the loss of the divided IP packet. And is switched to full scanning by the linear scanning processing unit.

  In order to solve the above-described problems, the present invention provides a packet collection method for collecting header information of an IP packet before division from an IP packet divided on a route, and the received or accumulated IP packet , Reading the IP packet necessary for analysis, obtaining the IP packet length of the frame from the IP header information at the head of the frame, and the data length of the already read IP packet and the currently processed division A comparison between the sum of the IP packet lengths and the acquired IP packet length is performed sequentially for each of the divided IP packets, and whether or not the frame boundary exists in the divided IP packet currently being processed. And the header information of the IP packet before the division from the frame boundary is extracted and stored in the storage device And having a that step.

  According to the present invention, the packet processing unit holds the IP packet captured by the packet type determination unit in the temporary storage device, sequentially reads the IP packets divided from the temporary storage device, and searches for the boundary of the frame. By extracting the header information of the IP packet before the division and storing it in the storage device, the necessary information about the packet before the division can be obtained without accumulating and analyzing all the data about the packet divided on the route. Can be acquired.

Further, in the packet processing unit, the packet boundary search processing unit adds the sum of the data length of the IP packet already read from the temporary storage device and the divided IP packet length currently processed, and the packet length acquisition unit A comparison is made with a packet that acquires the IP packet length of the frame acquired from the top IP header information, and a determination is made as to whether or not the frame boundary exists in the divided IP packet currently being processed. Only necessary information of the packet before being divided can be collected while saving the capacity, reducing the load of the collection process, and reducing the loss of the packet.
Furthermore, when the packet boundary search processing unit detects the loss of the divided IP packets, it starts up the linear scanning processing unit to store all data and reconstruct and analyze the data string to perform linear scanning. By switching to full scanning by the processing unit, packet collection loss can be minimized.

FIG. 1 is a block diagram showing the internal configuration of the packet collection apparatus of the present invention. The packet collection device of the present invention includes a network (NW) data receiving unit 1, a storage device 2, a packet type determination unit 3, a packet processing unit 4, a temporary storage device 5, and a storage device 6.
The NW data receiving unit 1 receives IP packet data propagating through the network and supplies it to the packet type determination device 3. The packet type determination device 3 is also supplied with IP packets stored locally in the storage device 2. The packet type determination unit 3 reads received or accumulated IP packets, takes in IP packets necessary for analysis, and supplies them to the packet processing unit 4.

The packet processing unit 4 holds the captured IP packet in the temporary storage device 5, sequentially reads the IP packets divided from the temporary storage device 5, searches for a frame boundary, and header information of the IP packet before the division And decapsulation processing unit 41, packet boundary search processing unit 42, and linear scan processing unit 43.
The decapsulation processing unit 41 holds the encapsulated information for each session in the temporary storage device 5 and passes the acquired IP packet to the packet boundary detection processing unit 42 together with the information. The packet boundary search processing unit 42 is acquired from the sum of the data length of the IP packet already read from the temporary storage device 5 and the divided IP packet length currently processed, and the IP header information at the head of the frame. The frame is compared with the IP packet length of the frame to determine whether the frame boundary exists in the divided IP packet currently being processed. Then, the header information of the IP packet before the division is cut out and stored in the storage device 6.

  When the packet boundary search processing unit 42 detects the loss of the divided IP packet, the packet boundary search processing unit 42 activates the linear scanning processing unit 43 that accumulates all data, reconstructs and analyzes the data string, and performs linear scanning. Control to switch to full scanning by the processing unit 43 is also performed.

2 to 4 are diagrams for explaining the operation of the embodiment of the present invention. The operation procedure (FIG. 2), the function added by the present invention (FIG. 3), and the operation concept (FIG. 4) are shown. Each is shown. The step numbers used in FIGS. 2 and 4 are the same.
Hereinafter, the operation of the embodiment of the present invention shown in FIG. 1 will be described in detail with reference to FIGS.

In the present invention, as described above, in order to obtain necessary information of a packet before being divided without accumulating and analyzing all data about the packet divided on the route, the IP expanded in the byte stream is used. Whether or not the packet boundary exists in the processed divided packet by obtaining the length of the original packet from the packet sequence and comparing the data length of the already read packet with the currently processed divided packet length The header information of the IP packet before the division is cut out and stored in the storage device 6. In addition, when packet loss occurs, switching to linear scanning minimizes packet collection loss.
Here, as shown in FIG. 3, the IP packet length (2) of each packet can be collected from the IP header (2) of the collected packet. Further, the IP packet length (1) in the PPP frame can be acquired from the IP packet header (1) in the PPP frame. As a result, the position of the packet boundary can be predicted and high-speed search can be realized. Details will be described below.

The packet processing unit 4 first reads a frame start symbol from the divided IP packet temporarily stored in the temporary storage device 5 (S21), then sets 0 to the parameter “length” and the unprocessed data length to the parameter “DATA_LENGTH”. Are set respectively (S22). Then, IP packet length data (IP_LENGTH) is acquired from the IP header at the head of the frame (S23).
Next, the packet boundary search processing unit 42 obtains the sum of the data length (DATA_LENGTH) of the IP packet already read from the temporary storage device 5 and the divided IP packet length (length) currently processed. It is compared with the IP packet length (IP_LENGTH), and it is determined whether or not the frame boundary exists in the divided IP packet currently being processed (S24).

Here, if DATA_LENGTH + length <IP packet length, the process proceeds to the next packet processing as length = length + DATA_LENGTH (S25). If DATA_LENGTH + length ≧ IP packet length, the frame boundary is searched from the DATA_LENGTH-length position of this packet. The position is predicted (S26). If the search is hit (S28 Yes), the header information of the IP packet before the division is cut out and held in the storage device 6 (S29).
Note that, when the packet loss is found by the decapsulation processing by the decapsulation processing unit 41 (Yes in S27), the above-described frame boundary prediction becomes impossible, so the packet boundary search processing unit 42 sets the linear scan processing unit 43 to The linear scanning processing is started and the linear scanning processing unit 43 performs full scanning (S30).

  As described above, according to the present invention, by using the packet length after encapsulation and the packet length of the frame, it is possible to determine whether or not the packet boundary exists in the divided packet, and the entire scan is performed. It becomes possible to perform processing that does not require linear scanning by. For this reason, it has become possible to collect only necessary information for the divided and encapsulated byte stream that had to be analyzed after collecting all the packets in the past, saving storage capacity, reducing the burden of collection processing, Contributes to reducing packet loss.

It is a block diagram which shows the internal structure of the packet collection apparatus of this invention. It is the flowchart quoted in order to demonstrate operation | movement of this invention embodiment. It is a figure which shows the operation principle for packet length acquisition required in order to estimate a packet boundary position. It is the operation | movement conceptual diagram quoted in order to demonstrate operation | movement of this invention embodiment. It is the figure quoted in order to demonstrate the conventional packet collection method. It is the figure quoted in order to demonstrate the conventional packet collection method.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... NW data receiving part, 2 ... Memory | storage device, 3 ... Packet type determination part, 4 ... Packet processing part, 5 ... Temporary memory | storage device, 6 ... Memory | storage device, 41 ... Decapsulation processing part, 42 ... Packet boundary search process Part, 43 ... linear scanning processing part

Claims (4)

A packet collection device for collecting header information of an IP packet before division from an IP packet divided on a route,
A packet type determination unit that reads the received or accumulated IP packets and takes in the IP packets necessary for analysis;
The captured IP packet is held in a temporary storage device, the IP packets divided from the temporary storage device are sequentially read to search for the boundary of the frame, and the header information of the IP packet before the division is cut out and stored in the storage device A packet processing unit to store;
A packet collection device comprising: The packet processing unit
The IP packet length of the frame is acquired from the IP header information at the head of the frame, and the sum of the data length of the IP packet already read from the temporary storage device and the divided IP packet length currently processed Packet boundary search processing for sequentially comparing the acquired IP packet length in units of the divided IP packets and determining whether the frame boundary exists in the divided IP packet currently being processed Part,
The packet collection device according to claim 1, further comprising: The packet boundary search processing unit
When the loss of the divided IP packet is detected, a linear scan processing unit is activated to accumulate all data, reconstruct and analyze the data string, and switch to full scanning by the linear scan processing unit. The packet collection device according to claim 2, wherein: A packet collection method for a packet collection device for collecting header information of an IP packet before division from an IP packet divided on a route,
Reading the received or accumulated IP packets and capturing the IP packets necessary for analysis;
Obtaining the IP packet length of the frame from the IP header information at the beginning of the frame;
A comparison between the data length of an already read IP packet and the divided IP packet length currently processed and the acquired IP packet length is sequentially performed in units of the divided IP packets, and the frame boundary Determining whether or not exists in the segmented IP packet currently being processed;
Cutting out the header information of the IP packet before the division from the frame boundary and storing it in a storage device;
A packet collection method characterized by comprising:

Images