JP2007243373A - Traffic information collection system, network apparatus, and traffic information collection apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a traffic information collection apparatus that can collect a condition under which a network apparatus filters a packet in spite of a small information amount and can revise the condition so as to efficiently collect traffic condition with a decreased information amount without constraints of filter setting conditions. <P>SOLUTION: The network apparatus includes a sampling means for extracting a packet and a report means that informs the traffic information collection apparatus about INDEX information of a MIB object storing a sampling rate of the sampling means by utilizing extension information of the flow statistics distribution protocol, and the traffic information collection apparatus acquires the sampling rate from the MIB object storing the sampling rate of the sampling means in the network apparatus on the basis of the INDEX information notified from the network apparatus and sets the sampling rate to a MIB object storing the sampling rate of the sampling means of the network apparatus. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a traffic information collection system, a network device, and a traffic information collection device. In particular, when monitoring traffic flowing on a network represented by the Internet, the traffic on a large-capacity network is efficiently monitored. It relates to the technique to do.

In the conventional flow statistics distribution protocol (sFlow, NetFlow), sampling is performed for all packets received by the input interface (IF). Depending on the vendor, it is possible to perform sampling after filtering, but there is no difference in the information to be delivered, so the traffic information collection device cannot grasp the presence or absence of filter conditions and the filter contents. Is in the situation. In this case, the filter conditions that can be set are arbitrary, but there is no mechanism for distributing the filter conditions.
In addition, the IPFIX protocol, which is one of the flow statistics distribution protocols (see Non-Patent Document 1 below), distributes all set information such as filter conditions, which increases the amount of information transferred. .
The technology defined by the IPFIX protocol can notify all information, but the filter condition only determines each parameter using an AND condition. It is not possible to exclusively specify filter conditions or filter conditions of different fields as OR conditions, and there are restrictions on the filter settings due to protocol restrictions.

As prior art documents related to the invention of the present application, there are the following.
http://www.ietf.org/internet-drafts/draft-dressler-ipfix-aggregation-02.txt RFC3954 Cisco NetFlow version9

As described above, NetFlow and sFlow can freely set filter setting information, but there is no function for distributing filter conditions and the like. In the IPFIX protocol, setting information can be notified. There are restrictions when setting. Further, since all information is distributed, there is a problem that the amount of information increases.
The present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to enable a traffic information collection device to collect conditions in which packets are filtered by a network device with a small amount of information. It is another object of the present invention to provide a technique that can change this, reduce the amount of information, and efficiently collect traffic information without being restricted by filter setting conditions.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
(1) A traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device, wherein the network device extracts a packet and filtering means for selecting the packet Sampling means, and report means for notifying the traffic information collection device of the INDEX information of the MIB object in which the sampling rate of the sampling means is stored using the extended information of the flow statistics distribution protocol, Based on the INDEX information notified from the network device, the traffic information collecting device uses the sampling rate from the MIB object in which the sampling rate of the sampling means in the network device is stored. Means for obtaining, the MIB object that contains the sampling rate of said sampling means of said network device, characterized by having a means for setting the sampling rate.
(2) In (1), when the reporting means of the network device classifies the packets hierarchically in the filtering means and samples the sampling means in a plurality of sampling instances, the sampling means Instances are grouped, and the INDEX of the MIB object storing the sampling rates of the sampling instances belonging to the group is notified to the traffic information collection device using the extended information of the flow statistics distribution protocol.

(3) A traffic information collecting system comprising a network device and a traffic information collecting device that collects traffic information distributed from the network device, wherein the network device extracts a packet and filtering means for selecting the packet Sampling means, and reporting means for notifying the traffic information collection device of INDEX information of the MIB object in which the filter condition of the filtering means is stored, using extended information of a flow statistics distribution protocol, and the traffic An information collecting device, based on INDEX information notified from the network device, means for acquiring a filter condition from an MIB object in which the filter condition of the filtering means in the network device is stored; The MIB object filter condition is stored in the filtering means of the network device, and having a means for setting the filter condition.
(4) In (3), when the report unit of the network device uses a plurality of filter conditions when selecting a packet in the filtering unit, the filter evaluated in the preceding stage of the matched filter condition The INDEX of the MIB object storing the condition is notified to the traffic information collection device using the extended information of the flow statistics distribution protocol.

(5) A network device in a traffic information collection system that includes a network device and a traffic information collection device that collects traffic information distributed from the network device, a filtering function unit that selects packets, and a packet extraction A sampling function unit, and a report function unit for notifying the traffic information collection device of INDEX information of the MIB object in which the sampling rate of the sampling function unit is stored, using extended information of a flow statistics distribution protocol It is characterized by.
(6) In (5), the report function unit categorizes the packets hierarchically in the filtering function unit, and the sampling function unit samples the plurality of sampling instances when sampled by a plurality of sampling instances. And the INDEX of the MIB object storing the sampling rate of the sampling instance belonging to the group is notified to the traffic information collecting device using the extended information of the flow statistics distribution protocol.

(7) A network device in a traffic information collection system that includes a network device and a traffic information collection device that collects traffic information distributed from the network device, a filtering function unit that selects packets, and a packet extraction A sampling function unit, and a report function unit for notifying the traffic information collection device of the INDEX information of the MIB object in which the filter condition of the filtering function unit is stored, using the extended information of the flow statistics distribution protocol. Features.
(8) In (7), when the report function unit uses a plurality of filter conditions when selecting a packet in the filtering function unit, the report function unit displays the filter condition evaluated in the preceding stage of the matched filter condition. The INDEX of the MIB object to be stored is notified to the traffic information collection device using the extended information of the flow statistics distribution protocol.

(9) A traffic information collection device in a traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device, and collects traffic information distributed from the network device A traffic condition collecting / accumulating unit to be accumulated, a traffic analysis function unit for analyzing traffic information collected by the traffic information collecting / accumulating unit, and a filter condition from the MIB object of the network device based on the INDEX information notified from the network device. Alternatively, an SNMP function unit that acquires a sampling rate and sets a filter condition or a sampling rate in the MIB object of the network device and traffic information And having a Shimesuru traffic screen display function unit.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, the traffic information collecting device can collect the conditions for filtering the packets with the network device with a small amount of information and can change the conditions. It is possible to efficiently collect traffic information without being restricted.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
FIG. 1 is a block diagram showing a schematic configuration of a traffic information collection system according to an embodiment of the present invention.
In FIG. 1, 1 is a packet, 10 is a network device such as a router (hereinafter simply referred to as NW device), and 20 is a traffic information collecting device.
The NW device 10 includes an input interface (IF) 11, a filter function unit 12, a sampling function unit 13, a report function unit 14, an MIB (Management Information Base) 15 of the filter function unit 12, and a sampling function unit 13. MIB16.
The traffic information collection device 20 includes a traffic information collection / storage function unit 21 that collects and stores traffic information distributed from the network device 10, and a traffic analysis function unit 22 that analyzes the traffic information collected by the traffic information collection / storage function unit 21. Based on the INDEX information notified from the network device 10, the filter condition or the sampling rate is acquired from the MIB (15, 16) of the network device, and the filter condition is added to the MIB (15, 16) of the network device. Alternatively, an SNMP function unit 23 that sets a sampling rate and a traffic screen display function unit 24 that displays traffic information are included.

The NW device 10 having the selective traffic monitoring function selects traffic based on the packet characteristic information by the filter function unit 12, and the sampling function unit 13 selects the traffic based on a predetermined sampling rate. Extract the packet.
The extracted packet is sent from the report function unit 14 as traffic information of only the upper byte of the header information of the packet or the counter for each flow (Source IP address, Destination IP address, Protocol, Source Port, Destination Port). It is distributed to the information collecting device 20.
In this embodiment, when distributing the traffic information described above, the report function unit 14 distributes the INDEX of the MIB information related to the used sampling interval and the used filter condition by using the extended information of the flow statistics distribution protocol. The setting information can be acquired and set by SNMP (Simple Network Management Protocol).
As a result, the traffic information collecting device 20 can collect setting information and use it as a part of the aggregate information. When displaying the traffic volume on the Web or the like, the filter condition can be displayed. Make it possible. Further, by analyzing the traffic and autonomously controlling the filter conditions, it is possible to further narrow down abnormal traffic and improve detection accuracy.

FIG. 2 is a diagram for explaining a method of notifying the INDEX of the MIB object storing the sampling rate as extension information of the flow statistics distribution protocol in the present embodiment.
In the present embodiment, when a plurality of sampling instances are generated on the sampling function unit 13 of the NW device 10, the INDEX is often an instance ID. Therefore, the instance ID is notified.
As a method for notifying extension information, Enterprise Tag can be extended with sFlow version5. In NetFlow version 9, an Eterprise Tag is defined in advance and included in the Template (Template Flow Set), so that it can be notified in the traffic information (Data Flow Set).
Here, as shown in FIG. 2A, this Type name is “Sampling Rate INDEX”. In the traffic information collecting device 20, the object ID of the MIB 16 in which the sampling interval is stored is held in advance, and when the data is accessed, the notified INDEX information is attached (appended) to the object ID. Access via SNMP.
The traffic analysis function unit 20 can control the sampling interval by instructing the SNMP function unit 23 based on the measurement result of the traffic measurement function (flow statistics distribution protocol).

FIG. 3 is a diagram for explaining a method of notifying the INDEX of the MIB object storing the matched filter condition as the extended information of the flow statistics distribution protocol in the present embodiment.
In this embodiment, the filter function unit 12 of the NW device 10 notifies the INDEX of the MIB 15 storing the matched filter conditions as the extended information of the flow statistics distribution protocol.
The filter condition is stored in a private MIB object for each vendor. Therefore, the traffic information collecting device 20 holds the object ID storing the filter condition of the NW device 10 and its SYNTX for each item, and when receiving the INDEX notification, accesses the MIB 16 from this object ID and INDEX. To do.
As a method for notifying the extended information, the extended information is used similarly to the method for notifying the sampling interval. Here, as shown in FIG. 3A, this Type name is “Match Filter Index”. “Object Number” indicates the number of INDEX objects necessary for accessing the target object.
As a result, the traffic information collecting device 20 can display the filter condition in the traffic screen display function unit 24 together with the traffic volume (bps, pps) and the like.
Further, the traffic analysis function unit 22 can aggregate the traffic volume based on the INDEX of the filter condition. This makes it possible to grasp the traffic volume based on information that cannot be distributed by the traffic measurement function (flow statistics distribution protocol). For example, when the filter condition is a packet with a TCP window size of 20000 or less as the filter condition, the traffic analysis function unit 22 grasps the traffic amount of only the TCP SYN flag by performing data aggregation based on INDEX. It becomes possible to do.

FIG. 5 is a diagram for explaining a method of notifying the INDEX of the MIB object storing the filter conditions that do not match as extension information of the flow statistics distribution protocol in the present embodiment. In FIG. 5, 15-1 to 15-4 are MIBs of the filter function unit 12.
When a plurality of filter conditions are applied in the filter function unit 12 of the NW device 10, there are filter conditions that are evaluated before the matched filter conditions.
Therefore, in this embodiment, since the previous filter condition is exclusive, the traffic information collecting device 20 is also notified of the previous filter condition, and the traffic information for each filter condition can be analyzed.
FIG. 4 is a diagram illustrating a concept when a plurality of filter conditions are applied in the filter function unit 12 of the NW device 10.
When the filter conditions are applied in the order of INDEX1 → 2 → 3 → 4 → 5 in FIG. 4 and the filter conditions satisfy INDEX = 5, INDEX = 1, 2, 3, and 4 evaluated in the previous stage are notified.
As a result, the filter condition of INDEX = 5 is a filter condition for selecting all packets, but traffic information collection indicates that traffic other than the filter condition of INDEX = 1, 2, 3, 4 is applied. The device 20 can be notified.
The technique for notifying the extended information is the same as the technique for notifying the sampling interval. Here, as shown in FIG. 5A, this Type name is “No Match Previous Filter Indexs”. “Previous Index Number” indicates the number of INDEXs necessary for accessing the target object.

FIG. 7 is a diagram for describing a method for notifying the INDEX of the MIB object of the target sampling group as the extension information of the flow statistics distribution protocol in the present embodiment in the hierarchical sampling method.
In the present embodiment, packets are classified hierarchically in the filter function units (12-1 to 12-6) of the NW device 10, and specified in each layer in the sampling function units (13-1 to 13-3). When sampling is performed at the sampling interval, sampling instances of all layers are grouped, and the INDEX of the MIB object storing the sampling interval is notified.
For example, as shown in FIG. 6, packets flowing from a certain input interface (IF) 11 in the NW device 10 are classified into three layers according to a plurality of filter conditions of the filter function units (12-1 to 12-6). Is done. In each layer, sampling is performed at predetermined sampling intervals in the sampling function units (13-1 to 13-3). In FIG. 6, 16-1 to 16-3 are MIBs of the sampling function units (13-1 to 13-3).
When the INDEX of the MIB object is each instance ID, it notifies that the instance ID = 1, 2, 3 is included in the hierarchical group as the extension information of each traffic measurement function (flow statistics distribution protocol). In this case, it is a condition that each sampling instance is the same traffic measurement point (scope, sourceid).

The technique for notifying the extended information is the same as the technique for notifying the sampling interval. Here, as shown in FIG. 7A, this Type name is “Stratified Sampling Group lndexs”. “Group Index Number” indicates the number of INDEXs included in the group.
By notifying “Sampling Rate Index” and “Stratified Sampling Group Indexs”, the traffic analysis function unit 22 of the traffic information collecting device 20 identifies a group that is performing hierarchical sampling among a plurality of sampling instances. It becomes possible to do.
As a result, in addition to estimating the amount of traffic to be processed in each sampling instance, it is also possible to estimate the entire amount of traffic that has flowed into the input interface (IF) 11 of the NW device 10.
As described above, in this embodiment, it is possible to more efficiently measure traffic information by filtering packets before sampling to narrow down to a specific traffic and monitoring the traffic.
In addition, since the traffic information collecting device 20 can autonomously change the sampling interval and the filter condition according to the aggregation result and the analysis result, it is possible to improve the detection accuracy of abnormal traffic.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a block diagram which shows schematic structure of the traffic information collection system of the Example of this invention. FIG. 10 is a diagram for explaining a method for notifying an INDEX of an MIB object storing a sampling rate as extension information of a flow statistics distribution protocol in the embodiment of the present invention. FIG. 10 is a diagram for explaining a method for notifying an INDEX of a MIB object storing matched filter conditions as extension information of a flow statistics distribution protocol in the embodiment of the present invention. It is a figure which shows the concept in the case of applying several filter conditions in the filter function part of the network apparatus of this invention. FIG. 10 is a diagram for describing a method for notifying an INDEX of a MIB object storing a filter condition that does not match as extension information of a flow statistics distribution protocol in the embodiment of the present invention. In the filter function part of the network apparatus of this invention, it is a figure which shows the concept in the case of classifying into three layers according to a plurality of filter conditions, and sampling at a predetermined sampling interval in each sampling layer in each layer . In the Example of this invention, it is a figure for demonstrating the method of notifying INDEX of the MIB object of the object sampling group by the hierarchical sampling method as extended information of a flow statistics delivery protocol.

Explanation of symbols

1 packet 10 network device 11 input interface (IF)
12 Filter Function Unit 13, 13-1 to 13-3 Sampling Function Unit 14 Report Function Unit 15, 15-1 to 15-4, 16-1 to 16-3 MIB (Management Information Base)
20 Traffic Information Collection Equipment 21 Traffic Information Collection and Storage Function Unit 22 Traffic Analysis Function Unit 23 SNMP Function Unit 24 Traffic Screen Display Function Unit

Claims (9)

A traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device,
The network device includes filtering means for selecting packets;
Sampling means for extracting packets;
Reporting means for notifying the traffic information collection device of the INDEX information of the MIB object in which the sampling rate of the sampling means is stored, using the extended information of the flow statistics distribution protocol;
The traffic information collecting device, based on the INDEX information notified from the network device, means for acquiring a sampling rate from a MIB object in which the sampling rate of the sampling unit in the network device is stored;
A traffic information collection system comprising: means for setting the sampling rate in an MIB object that stores the sampling rate of the sampling means of the network device.   The report means of the network device classifies the packets hierarchically in the filtering means, and groups the plurality of sampling instances when the sampling means samples at a plurality of sampling instances. 2. The traffic information collection system according to claim 1, wherein the INDEX of the MIB object storing the sampling rate of the sampling instance to which it belongs is notified to the traffic information collection device using the extended information of the flow statistics distribution protocol. . A traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device,
The network device includes filtering means for selecting packets;
Sampling means for extracting packets;
Reporting means for notifying the traffic information collection device of the INDEX information of the MIB object in which the filtering condition of the filtering means is stored, using the extended information of the flow statistics distribution protocol;
The traffic information collecting device, based on the INDEX information notified from the network device, means for obtaining a filter condition from an MIB object in which the filter condition of the filtering means in the network device is stored;
A traffic information collection system comprising: means for setting the filter condition in an MIB object in which the filter condition of the filtering means of the network device is stored.   The report unit of the network device stores an INDEX of an MIB object that stores a filter condition evaluated in a preceding stage of the matched filter condition when a plurality of filter conditions are used when selecting a packet in the filtering unit. The traffic information collection system according to claim 3, wherein the traffic information collection device is notified using the extended information of the flow statistics distribution protocol. A network device in a traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device,
A filtering function unit for selecting packets;
A sampling function unit for extracting packets;
And a report function unit for notifying the traffic information collection device of INDEX information of the MIB object in which the sampling rate of the sampling function unit is stored, using extended information of a flow statistics distribution protocol. machine.   The report function unit classifies the packets hierarchically in the filtering function unit, and groups the plurality of sampling instances when the sampling function unit samples with a plurality of sampling instances, and belongs to the group. 6. The network device according to claim 5, wherein the INDEX of the MIB object storing the sampling rate of the sampling instance is notified to the traffic information collecting device using the extended information of the flow statistics distribution protocol. A network device in a traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device,
A filtering function unit for selecting packets;
A sampling function unit for extracting packets;
A network device comprising: a report function unit for notifying the traffic information collection device of INDEX information of an MIB object in which the filter condition of the filtering function unit is stored, using extended information of a flow statistics distribution protocol .   When a plurality of filter conditions are used when the packet is selected in the filtering function unit, the report function unit flows an INDEX of the MIB object that stores the filter condition evaluated before the matched filter condition. The network device according to claim 7, wherein the traffic information collection device is notified using extended information of a statistical distribution protocol. A traffic information collection device in a traffic information collection system comprising a network device and a traffic information collection device that collects traffic information distributed from the network device,
A traffic information collecting and accumulating unit for collecting and accumulating traffic information distributed from the network device;
A traffic analysis function unit that analyzes the traffic information collected by the traffic information collection and storage unit;
Based on the INDEX information notified from the network device, the filter condition or sampling rate is acquired from the MIB object of the network device, and the filter condition or sampling rate is set in the MIB object of the network device. An SNMP function unit;
A traffic information collection device having a traffic screen display function unit for displaying traffic information.

Images