JP2021090161A - Format conversion device, method, and program - Google Patents

Abstract

To provide a format conversion device, method, and program that enable traffic analysis using existing analysis device even in a network in which an encapsulated packet is distributed.SOLUTION: A format conversion device 100 includes a packet input unit 110 that accepts input of a header sample transfer packet 230 including an analysis header sample 233 including an outer header 222 which is a header of an encapsulated packet 220 and an inner header 212 which is a header of the packet 210 in the capsule from a network 10 through which the encapsulated packet 220 is distributed, and a format conversion unit 120 that converts a format of the header sample transfer packet 230 into a format excluding the outer header 222 and stores correspondence information between the inner header 212 included in the analysis header sample 233 and the excluded outer header 22.SELECTED DRAWING: Figure 1

Description

The present invention relates to a format conversion device and method for data used in network traffic analysis, and a program.

In recent years, the number and types of terminals connected to the network have been increasing, and the network itself has become complicated as virtualization has progressed and the types of services have increased. Along with this, network monitoring and traffic trend analysis have become more important for network operation. A technique called xFlow is known as a technique for network monitoring and traffic trend analysis. In the xFlow technology, packets are sampled, and the flow statistical information calculated from the header information and the header part itself (header sample) are transferred to the analyzer to aggregate and analyze traffic.

Among the xFlow technologies, NetFlow (see Non-Patent Document 1) and IPFIX (see Non-Patent Documents 2-1 to 2-6) are methods for sampling packets, calculating flow statistical information from header information, and transferring the information. Are known. Among the xFlow technologies, sFlow (see Non-Patent Document 3) and IPFIX w / IE315 (see Non-Patent Document 4) are methods for sampling packets and cutting and transferring the header portion itself (header sample). Are known. Further, pmacct (see Non-Patent Document 5) and nProbe (see Non-Patent Document 6) are known as implementations of a technique for mutually converting various existing xFlow formats.

Japanese Unexamined Patent Publication No. 2019-097069

B. Claise, "Cisco Systems NetFlow Services Export Version 9", [online], IETF, RFC3954, October 2004, [Searched October 11, 1991], Internet <https://www.ietf.org/rfc /rfc3954.txt.pdf> B. Trammell, 1 other person, "Bidirectional Flow Export Using IP Flow Information Export (IPFIX)", [online], IETF, RFC5103, January 2008, [Search on October 11, 1st year], Internet <https: / /www.ietf.org/rfc/rfc5103.txt.pdf> B. Claise, 2 others, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", [online], IETF, RFC7011, September 2013, [Searched on October 11, 1991] , Internet <https://www.ietf.org/rfc/rfc7011.txt.pdf> B. Claise, 1 other person, "Information Model for IP Flow Information Export (IPFIX)", [online], IETF, RFC7012, September 2013, [Search on October 11, 1991], Internet <https: // www.ietf.org/rfc/rfc7012.txt.pdf> B. Trammell, 1 others, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", [online], IETF, RFC7013, September 2013, [Searched October 11, 1991], Internet <https://www.ietf.org/rfc/rfc7013.txt.pdf> S. D'Antonio, 3 others, "Flow Selection Techniques", [online], IETF, RFC7014, September 2013, [Searched October 11, 1991], Internet <https://www.ietf.org /rfc/rfc7014.txt.pdf> B. Trammell, 2 others, "Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol", [online], IETF, RFC7015, September 2013, [Searched October 11, 1st year], Internet <https: //www.ietf.org/rfc/rfc7015.txt.pdf> Peter Phaal, 1 other person, "sFlow Version 5", [online], sFlow.org, July 2004, [Searched on October 11, 1st year of Reiwa], Internet <https://sflow.org/sflow_version_5.txt> S. Kashima, 2 others, "Information Elements for Data Link Layer Traffic Measurement", [online], IETF, RFC7133, May 2014, [Searched October 11, 1991], Internet <https: // www. ietf.org/rfc/rfc7133.txt.pdf> "Welcome to the pmacct project!", [Online], [Searched on October 11, 1st year of Reiwa], Internet <http://www.pmacct.net/> "nProbe / An Extensible NetFlow v5 / v9 / IPFIX Probe for IPv4 / v6", [online], [Searched on October 11, 1st year of Reiwa], Internet <https://www.ntop.org/products/netflow/ nprobe /> Yuhei Hayashi, 1 other person, "A study of the setting values of the inner-outer header mapping method using hashes", IEICE 2019 Society Conference B-6-18

By the way, packets circulating in the network may be encapsulated by a tunnel protocol or the like. In such a network environment, there is a demand for traffic aggregation and analysis of packets inside the capsule.

However, the conventional xFlow technology does not assume aggregation and analysis of the inner capsule traffic in the encapsulated packet, and only the outer capsule traffic is processed. Therefore, in the network to which the encapsulated packet is forwarded, the conventional xFlow technology can only perform aggregation / analysis and xFlow format conversion for the traffic outside the capsule, and cannot perform aggregation / analysis inside the capsule.

On the other hand, as an analysis method for encapsulated packets, a format conversion technique for extracting packets inside the capsule and enabling analysis is known (see Patent Document 1). Further, regarding the encapsulated packet, a technique for registering the association between the packet header inside the capsule and the packet header outside the capsule in the database at high speed is known (see Non-Patent Document 7).

The above format conversion technology targets the encapsulated packet itself, identifies the sequential header type from the beginning of the packet, removes unnecessary headers, and associates the packet header inside the capsule with the packet header outside the capsule. It is a method to do. Therefore, although the format of the encapsulated packet itself can be converted, the header sample xFlow packet for the encapsulated packet is formatted and converted to extract the packet inside the capsule, and the correspondence between the packet header inside the capsule and the packet header outside the capsule. There is a problem that it is not possible to attach.

The present invention has been made in view of the above circumstances, and an object of the present invention is a format conversion device and method that enable traffic analysis and the like using an existing analyzer even in a network in which encapsulated packets are distributed. To provide a program.

The present invention provides an existing analysis by introducing a functional unit that generates an analysis packet for a packet inside the capsule with respect to the header sample of the encapsulated packet collected by header sampling on the network to which the encapsulated packet is transferred. In combination with the device, it enables aggregation and analysis of capsule inner traffic.

That is, the present invention is a format conversion device provided in front of the analyzer that analyzes the packet, from the network in which the encapsulated packet formed by encapsulating the packet is distributed, to the outer header which is the header of the encapsulated packet and the outer header. The format of the header sample transfer packet input by the input unit and the input unit that accepts the input of the header sample transfer packet that stores the header sample for analysis including the inner header that is the header of the capsule packet of the encapsulated packet. A conversion unit that converts the header sample transfer packet into a format that excludes the outer header included in the analysis header sample, and stores the correspondence information between the inner header included in the analysis header sample and the excluded outer header. It is characterized by including an output unit that transfers the header sample transfer packet converted by the conversion unit to the analyzer.

Further, the present invention is a format conversion device provided in front of an analyzer that analyzes a packet, and is an outer header that is a header of the encapsulated packet from a network in which the encapsulated packet formed by encapsulating the packet is distributed. The format of the header sample transfer packet input by the input unit and the input unit that accepts the input of the header sample transfer packet that stores the header sample for analysis including the inner header that is the header of the capsule packet of the encapsulated packet. A conversion unit that converts the header sample transfer packet into a format that excludes the outer header included in the analysis header sample, and stores the correspondence information between the inner header included in the analysis header sample and the excluded outer header. , A data generation unit for statistical analysis that generates data for statistical analysis based on the header sample transfer packet converted by the conversion unit obtained in a predetermined period, and a statistical type generated by the data generation unit for statistical analysis. It is characterized by including an output unit that stores analysis data in a statistical type analysis data transfer packet and transfers the data to the analyzer.

According to the present invention, it is possible to efficiently aggregate and analyze the traffic inside the capsule in the network to which the encapsulated packet is forwarded.

Configuration diagram of the network system according to the embodiment of the present invention Diagram illustrating the format of each packet Functional block diagram of the format converter Sequence example in the network system according to the embodiment of the present invention Analysis result display example Correspondence information display example

A network system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a network configuration diagram illustrating an outline of the present invention.

In the present invention, as shown in FIG. 1, (1) header sampling by xFlow is set in the network 10 to which the encapsulated packet is transferred. Next, (2) introduce a functional unit having the following functions. Input: Capsule packet header sample xFlow packet. Output: Header sample inside the capsule xFlow packet and / or Statistical xFlow packet inside the capsule. Save: Correspondence of packet headers inside and outside the capsule. Then, (3) traffic aggregation and analysis are performed by the existing xFlow analyzers 21 and 22.

That is, in the present invention, the format conversion device 100 having a function of generating an analysis packet for the packet inside the capsule with respect to the header sample of the encapsulated packet collected by header sampling on the network 10 to which the encapsulated packet is transferred is provided. By introducing it in front of the existing xFlow analyzers 21 and 22, it is possible to aggregate and analyze the packet inner traffic in combination with the existing xFlow analyzers 21 and 22.

The network 10 includes a section to which the encapsulated packet is forwarded. In the example of FIG. 1, a tunnel 14 is formed between the router 11 and the router 12 in the network 10, and the section between the routers 11 and 12 is a section to which the encapsulated packet is transferred. That is, one router 11 that terminates the tunnel 14 encapsulates the packet and sends the encapsulated packet toward the other router 12 that opposes the packet. The encapsulated packet sent from the router 11 is relayed by the router 13 arranged on the route between the router 11 and the router 12, and reaches the other router 12. The router 12 decapsulates the received encapsulated packet and sends the extracted packet to the destination address. The same applies to the reverse direction. In the present invention, packet encapsulation may be performed in multiple stages. In this case, the plurality of encapsulation processes may be performed by devices having different communication paths, or may be performed by one device.

In the present invention, using the existing xFlow technology, the header included in the encapsulated packet is acquired as the header sample for analysis in the network 10, and the header sample xFlow packet containing the header sample for analysis is transmitted to the format conversion device 100. .. The process of acquiring the header sample for analysis and transmitting it to the format conversion device 100 may be performed by the routers 11 and 12 that perform encapsulation / decapsulation, or may be the router 13 that relays the encapsulated packet. In the example of FIG. 1, the router 13 that relays the encapsulated packet acquires the header sample for analysis and transmits it to the format conversion device 100.

FIG. 2 illustrates the format of each packet. In the figure, the layer 2 (L2) frame format is described as including the layer 3 (L3) packet. In this embodiment, an example in which IP (Internet Protocol) is used as the L3 protocol and Ehernet (registered trademark) is used as the L2 protocol will be described.

In FIG. 2, (A) shows the format of the packet 210 before encapsulation, that is, the packet 210 in the capsule. The packet 210 includes a frame header 211 of L2, an IP header 212 of L3, and a payload 213. Here, the IP header 212 of the packet 210 is also referred to as an Inner header 212.

In FIG. 2, (B) shows the format of the encapsulated packet 220. The encapsulation packet 220 includes a frame header 221 of L2, an Outer header 222 attached by a predetermined encapsulation protocol, an Inner header 212, and a payload 213. Here, the type and layer of the encapsulation protocol do not matter. For example, when the IPIP tunneling protocol is used as the encapsulation protocol, the Outer header 222 is an IP header. When MPLS (Multi-Protocol Label Switching) is used as the encapsulation protocol, the Outer header 222 becomes an MPLS header. Further, the Outer header 222 can include a plurality of headers attached in multiple stages by a plurality of encapsulation protocols. In this case, the plurality of encapsulated protocols can span multiple layers. For example, the Outer header 222 can include a plurality of headers: IP header + UDP (User Datagram Protocol) header + L2TP (Layer 2 Tunneling Protocol) header. In the present embodiment, the IPIP tunnel protocol is used as the encapsulation protocol, and the Outer header 222 includes the address information of the routers 11 and 12 that terminate the tunnel 14 in the network 10 as the destination address and the source address. It should be noted that the frame header 221 of the encapsulated packet 220 is different from the frame header 211 of the packet 210.

FIG. 2C shows the format of the header sample xFlow packet 230 containing the header sample for analysis. The header sample xFlow packet 230 is generated by a router that acquires the header sample for analysis and transmits it to the format conversion device 100. The header sample xFlow packet 230 includes a frame header 231 of L2, an IP header 232 of L3, xFlow data 233, and a header sample 234 for analysis. Here, the IP header 232 of L3 is for forwarding the header sample xFlow packet 230, includes the address information of the format conversion device 100 as the destination address, and includes the address information of the router 13 as the source address. It should be noted that the frame header 231 of the header sample xFlow packet 230 is different from the frame header 221 of the encapsulated packet 220 and the frame header 211 of the packet 210.

The xFlow data 233 is defined by the xFlow technology, and includes meta information of the encapsulated packet 220 that can be used in the analysis process, which is not included in the analysis header sample 234. For example, as meta information, physical port information (interface information) for receiving the encapsulated packet 220 in the router 13 and time stamp information for receiving the encapsulated packet can be mentioned.

The analytical header sample 234 includes at least all or part of the Inner header 212 and the Outer header 222. The analytical header sample 234 may include the frame header 221 of the encapsulated packet 220. Further, in the example of FIG. 2C, the header sample 234 for analysis includes a part of the beginning of the payload 213. This is because the Inner header 212 and the Outer header 222 may have an indefinite length due to the existence of an optional area depending on the protocol. Therefore, when extracting the analysis header sample 234 from the encapsulation packet 220, the encapsulation packet This is because the process of extracting from the beginning of 220 with a fixed length calculated from the maximum lengths of the Inner header 212 and the Outer header 222 is performed. By such a process, the acquisition process of the header sample 234 for analysis can be performed with low load and high speed. If the Inner header 212 and the Outer header 222 store their own header length information or if the header length is fixed, the payload 213 can be obtained by referring to the header length information or by using the fixed length. It is also possible to extract only the Inner header 212 and the Outer header 222 without including a part of the beginning of the head.

The format conversion device 100 receives the header sample xFlow packet 230 from the network 10, converts it into data that can be processed by the xFlow analyzers 21 and 22 using the existing xFlow technology, and outputs the data to each xFlow analyzer 21 and 22. Regarding the data communication path and its form (for example, the presence or absence of a tunnel) from the network 10 to the format conversion device 100, and the data communication path and its form (for example, the presence or absence of a tunnel) from the format conversion device 100 to each of the xFlow analyzers 21 and 22 It doesn't matter.

FIG. 3 shows a functional block diagram of the format conversion device 100. The format conversion device 100 includes a packet input unit 110, a format conversion unit 120, a correspondence information DB 130, a statistical type xFlow data generation unit 140, a packet output unit 150, and a correspondence information output unit 160.

The format conversion device 100 is composed of a well-known information processing device. The mounting form of the format conversion device 100 is irrelevant, and may be mounted as, for example, a dedicated hardware device, or may be mounted by installing a program on a physical computer or a virtual computer. Further, the format conversion device 100 may be mounted by distributing each part to a plurality of hardware devices. Further, each part or a part of the format conversion device 100 may be mounted on the same physical device as the router 13 that acquires the header sample, or may be mounted on the same physical device as the xFlow analyzer 21 or 22. Good.

The packet input unit 110 receives the input of the header sample xFlow packet 230 from the network 10.

The format conversion unit 120 converts the format of the header sample xFlow packet 230 into a format in which the Outer header 222 included in the analysis header sample 234 is excluded from the header sample xFlow packet 230, and is included in the analysis header sample 234. Correspondence information between the Inner header 212 and the excluded Outer header 222 is stored in the correspondence information DB 130.

Correspondence information The correspondence information stored in the DB 130 includes information that can identify the Inner header 212 and information that can identify the Outer header 222, and is information that links (associates) the two. The information that can identify each header depends on the protocol related to the header. For example, in the case of an IP header, address information can be used. Further, for example, in the case of MPLS header, label information can be used. Further, when the Outer header 222 includes a plurality of headers, a plurality of information corresponding to the protocol related to each header can be included. In the present embodiment, since the IPIP tunnel protocol is used as the encapsulation protocol, the address information included in the Inner header 212 and the address information included in the Outer header 222 are included. The address information includes at least L3 address information. The address information can further include the address information of the upper layer protocol from the viewpoint of L3. In addition, the correspondence information can include other information included in the header such as protocol type information. In the present embodiment, the destination IP address and the destination port number included in each header and the set of the source IP address and the source port number are included. Further, as another example, it may be 5-tuple including further protocol type information.

The statistical type xFlow data generation unit 140 generates data for statistical type analysis based on a plurality of header sample xFlow packets converted by the format conversion unit 120 obtained in a predetermined period. The existing xFlow technology is used for this statistical processing.

The packet output unit 150 transfers the header sample xFlow packet 240 obtained by the conversion by the format conversion unit 120 to the header sample analysis type xFlow analyzer (A) 21. FIG. 2D shows the format of the header sample xFlow packet 240 transferred by the packet output unit 150. As shown in the figure, the header sample xFlow packet 240 includes a frame header 241 of L2, an IP header 242 of L3, xFlow data 233, and a header sample 244 for analysis. Here, the only difference in format between the header sample xFlow packet 240 output by the packet output unit 150 and the header sample xFlow packet 230 input to the packet input unit 110 is the presence or absence of the Outer header 222. The IP header 242 of L3 is for transferring the header sample xFlow packet 240, includes the address information of the xFlow analyzer (A) 21 as the destination address, and the address information of the format conversion device 100 as the source address. including. Note that the frame header 241 of the header sample xFlow packet 240 is different from the frame header 231 of the header sample xFlow packet 230, the frame header 221 of the encapsulated packet 220, and the frame header 211 of the packet 210. I want to be.

Further, the packet output unit 150 stores the statistical type analysis data generated by the statistical type xFlow data generation unit 140 in the statistical type xFlow packet 250 and transfers it to the statistical type xFlow analyzer (B) 22. FIG. 2E shows the format of the statistical type xFlow packet 250 output by the packet output unit 150. As shown in the figure, the frame header 251 of L2, the IP header 252 of L3, and the xFlow data 253 are included.

Here, the xFlow data 253 is statistical type analysis data generated by the statistical type xFlow data generation unit 140. Further, the IP header 252 of L3 is for transferring the statistical type xFlow packet 250, includes the address information of the xFlow analyzer (B) 22 as the destination address, and the address information of the format conversion device 100 as the source address. including. The frame header 251 of the statistical type xFlow packet 250 includes the frame header 241 of the header sample xFlow packet 240, the frame header 231 of the header sample xFlow packet 230, the frame header 221 of the encapsulated packet 220, and the frame of the packet 210. Note that this is different from header 211.

The correspondence information output unit 160 outputs the correspondence information stored in the correspondence information DB 130 to an arbitrary output destination. The correspondence information output unit 160 can output the correspondence information to the same output destination as the analysis results of the xFlow analyzer (A) 21 and the xFlow analyzer (B) 22. The correspondence information output unit 160 may output the correspondence information in response to a request from the output destination, or may notify the output destination in the form of "push". For example, the correspondence information can be output at the update timing of the correspondence information DB 130 or periodically.

The xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 are analyzers used in the existing xFlow technology. The xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 are each composed of well-known information processing devices. The mounting form of the xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 is not limited, and may be mounted as a dedicated hardware device, for example, or mounted by installing a program on a physical computer or a virtual computer. You may. Further, the xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 may be distributed and mounted on a plurality of hardware devices.

The xFlow analyzer (A) 21 performs analysis by inputting a header sample. Specifically, methods such as sFlow (see Non-Patent Document 3) and IPFIX w / IE315 (see Non-Patent Document 4) are available. Used. The xFlow analyzer (B) 22 analyzes the flow statistical information calculated from the header information of the sampled packet as an input, and specifically, NetFlow (see Non-Patent Document 1) and IPFIX (non-Patent Document 1). (See Patent Documents 2-1 to 2-6) and the like are used.

The xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 each provide analysis results to the user's terminal 300. The xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 may provide the analysis result in response to a request from the provider, or may notify the provider in the form of "push". Good. For example, the analysis result can be output at the update timing of the analysis result or periodically.

Next, a sequence example of the network system according to the present embodiment will be described with reference to the sequence chart of FIG.

In the analysis execution phase, as shown in FIG. 4, first, the router 13 of the network 10 through which the encapsulated packet 220 is distributed first acquires the analysis header sample 234 from the encapsulated packet 220, and then obtains the analysis header sample 234 and xFlow. The header sample xFlow packet 230 in which the data 233 is stored is transferred to the format conversion device 100 (step S1).

The format conversion device 100 converts the format of the header sample xFlow packet 230 into a format excluding the Outer header 222, and stores the correspondence information between the Inner header 212 and the Outer header 222 in the correspondence information DB 130 (step S2). Then, the format conversion device 100 transfers the obtained header sample xFlow packet 240 that has been format-converted to the xFlow analyzer (A) 21 (step S3). Further, the format conversion device 100 generates statistical analysis data for the xFlow analyzer (B) 22 based on the format-converted header sample xFlow packet, and stores the statistical analysis data in the statistical xFlow. The packet 250 is transferred to the xFlow analyzer (B) 22.

In the analysis result confirmation phase, the format conversion device 100 provides the user terminal 300 with the correspondence information stored in the correspondence information DB 130 (step S11). Further, the xFlow analyzer (A) 21 and the xFlow analyzer (B) 22 provide the analysis results to the user terminal 300, respectively (steps S12 and S13). As a result, the user terminal 300 can obtain the analysis result based on the Inner header 212 carried out by the xFlow analyzer (A) 21 and the xFlow analyzer (B) 22, and the correspondence between the Inner header 212 and the Outer header 222. Since the relationship can be recognized, efficient aggregation and analysis of the traffic inside the capsule becomes possible in the network 10 in which the encapsulated packet 220 is distributed. FIG. 5 shows an example of the analysis result in the xFlow analyzer (A) 21 displayed on the user terminal 300. Further, FIG. 6 shows an example of the corresponding information displayed on the user terminal 300.

Although one embodiment of the present invention has been described in detail above, the present invention is not limited to the above-described embodiment, and various improvements and modifications may be made without departing from the gist of the present invention. ..

For example, in the above embodiment, the format conversion device 100 is configured to output both the header sample xFlow packet 240 for the xFlow analyzer (A) 21 and the statistical type xFlow packet 250 for the xFlow analyzer (B) 22. However, it may be configured to output only one of them.

10 ... Network 11, 12, 13 ... Router 14 ... Tunnel 100 ... Format conversion device 110 ... Packet input unit 120 ... Format conversion unit 130 ... Corresponding information DB
140 ... Statistical xFlow data generation unit 150 ... Packet output unit 160 ... Corresponding information output unit 210 ... Packet (packet in capsule)
212 ... Inner header 220 ... Encapsulation packet 222 ... Outer header 230 ... Header sample xFlow packet 240 ... Header sample xFlow packet (after conversion)
250 ... Statistical xFlow packet

Claims (8)

It is a format conversion device provided in front of the analyzer that analyzes packets.
A header in which an analysis header sample including an outer header which is a header of an encapsulated packet and an inner header which is a header of an in-capsule packet of the encapsulated packet is stored from a network in which an encapsulated packet formed by encapsulating a packet is distributed. Input section that accepts sample transfer packet input and
The format of the header sample transfer packet input by the input unit is converted into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and the inner header included in the analysis header sample and the above. A conversion unit that saves the correspondence information with the excluded outer header,
A format conversion device including an output unit that transfers a header sample transfer packet converted by the conversion unit to the analyzer. It is a format conversion device provided in front of the analyzer that analyzes packets.
A header in which an analysis header sample including an outer header which is a header of an encapsulated packet and an inner header which is a header of an in-capsule packet of the encapsulated packet is stored from a network in which an encapsulated packet formed by encapsulating a packet is distributed. Input section that accepts sample transfer packet input and
The format of the header sample transfer packet input by the input unit is converted into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and the inner header included in the analysis header sample and the above. A conversion unit that saves the correspondence information with the excluded outer header,
A data generation unit for statistical analysis that generates data for statistical analysis based on a header sample transfer packet converted by the conversion unit obtained in a predetermined period, and a data generation unit for statistical analysis.
A format conversion device including an output unit that stores statistical analysis data generated by the statistical analysis data generation unit in a statistical analysis data transfer packet and transfers the data to the analysis device. The format conversion device according to claim 1 or 2, wherein the header sample transfer packet includes meta information for analysis of the encapsulated packet. The format conversion device according to any one of claims 1 to 3, wherein the header sample transfer packet includes a frame header of a frame that stores and distributes an encapsulated packet in the network. The format according to any one of claims 1 to 4, further comprising a corresponding information output unit that outputs the corresponding information stored by the conversion unit to the output destination device of the analysis result of the analyzer. Conversion device. It is a format conversion method in the format conversion device provided in front of the analyzer that analyzes packets.
An analysis header sample including an outer header which is a header of an encapsulated packet and an inner header which is a header of an in-capsule packet of the encapsulated packet is provided from a network in which an encapsulated packet whose input unit encapsulates a packet is distributed. An input step that accepts the input of the stored header sample transfer packet, and
The conversion unit converts the format of the header sample transfer packet input by the input step into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and is included in the analysis header sample. A conversion step for saving the correspondence information between the inner header and the excluded outer header, and
A format conversion method, characterized in that the output unit includes an output step of transferring a header sample transfer packet converted by the conversion unit to the analyzer. It is a format conversion method in the format conversion device provided in front of the analyzer that analyzes packets.
An analysis header sample including an outer header which is a header of an encapsulated packet and an inner header which is a header of an in-capsule packet of the encapsulated packet is provided from a network in which an encapsulated packet whose input unit encapsulates a packet is distributed. An input step that accepts the input of the stored header sample transfer packet, and
The conversion unit converts the format of the header sample transfer packet input by the input unit into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and is included in the analysis header sample. A conversion step for saving the correspondence information between the inner header and the excluded outer header, and
A data generation step for statistical analysis in which the data generation unit for statistical analysis generates data for statistical analysis based on the header sample transfer packet converted by the conversion unit obtained in a predetermined period.
A format characterized in that the output unit includes an output step of storing the statistical analysis data generated by the statistical analysis data generation unit in a statistical analysis data transfer packet and transferring the data to the analyzer. Conversion method. A format conversion program for causing a computer to function as each part of the format conversion device according to any one of claims 1 to 5.

Images