JP4425255B2 - Network monitoring system, network monitoring method, and network monitoring program - Google Patents

Description

  The present invention relates to a network monitoring system, a network monitoring method, and a network monitoring program. For example, the present invention can be applied to a network monitoring system that measures multi-point broadband traffic that observes traffic of a broadband network at multiple points.

  In recent years, with the development of network technology, its importance has increased, and network systems have penetrated as social infrastructure. On the other hand, new and sophisticated viruses are generated every day. Threats such as virus infections cause network failures, and the damage increases with the scale of the network. Therefore, a system that monitors network traffic and detects anomalies is strongly desired.

  Conventionally, there is a technique disclosed in Patent Document 1 as a system for detecting an abnormality in a network.

  In Patent Literature 1, internal traffic flow information is acquired from a plurality of monitoring target devices arranged in a network, normal traffic is compared with the total amount of abnormal traffic, and the total amount of abnormal traffic is predetermined. A failure detection device that determines an abnormality when the ratio is exceeded is described.

JP 2005-72723 A

  By the way, the collection device collects traffic information in AS (Autonomous System) units or network units that dynamically change communication paths, and observes traffic on a large-scale network based on the traffic information collected by these collection devices. There is a multipoint broadband traffic monitoring system.

  In such a multi-point wideband traffic observation system, the path of communication traffic changes dynamically. Therefore, if each collection device attempts to statically collect traffic such as AS units, even when the traffic volume is small, Since it is necessary to perform the same processing as in a normal case, the processing load on the collection device increases.

  In addition, when a specific event occurs in traffic, it is desired to change and track a monitoring point by changing a route and analyze or analyze the specific event.

  Therefore, based on the above issues, traffic observation that dynamically responds to changes in route information enables traffic observation that follows changes in route information, enabling efficient and highly accurate traffic flow analysis. There is a need for a network monitoring system, a network monitoring method, and a network monitoring program.

In order to solve this problem, the network monitoring system according to the first aspect of the present invention is a network that monitors traffic in a network that includes a plurality of autonomous systems that can set route information according to an autonomous routing policy. A monitoring system comprising: (1) a plurality of collecting means for acquiring communication data flowing on a connection line between connected devices connecting between each autonomous system and collecting traffic information of an observation target set for observation; (2) Aggregation means for receiving collection information collected by each collection means and totaling each collection information according to the observation setting; (3) Multiple routes for collecting route information exchanged between connected devices of each autonomous system Information collection means, and (4) route information holding means for receiving each route information from each route information collecting means and holding each route information , (5) a routing information holding means to monitor the dynamic change detecting means for detecting a change of the routing information, the dynamic change of the routing information is detected by (6) dynamic change detecting means, the collecting unit Recognize changed routes and dynamically change the acquisition contents of observation settings according to the dynamic change of the route information for the collection means that observes the traffic information of the changed route that has changed dynamically characterized in that it comprises a monitoring setting instruction means for instructing the observation setting instructing.

A network monitoring method according to a second aspect of the present invention is a network monitoring method for monitoring traffic on a network configured by including a plurality of autonomous systems capable of setting route information according to an autonomous routing policy. ) A collection process in which a plurality of collection means acquire communication data flowing on connection lines between connected devices that connect each autonomous system, and collect traffic information of observation targets that are set for observation; (2) aggregation A means for receiving the collected information collected by each collecting means and totaling the collected information according to the observation setting; and (3) a route in which the route information collecting means is exchanged between connected devices of each autonomous system. a route information collection process to gather information, and (4) route information holding means receives the route information from the route information collection unit, each path information A path information holding step, (5) a dynamic change detecting unit that monitors the path information holding unit and detects a change in path information, and (6) an observation setting instruction unit When a dynamic change in the route information is detected by the automatic change detection unit, the route information is recognized by the collection unit that recognizes the changed route by the aggregation unit and observes the traffic information of the changed route that has changed dynamically. An observation setting instructing step for instructing the observation setting for instructing to dynamically change the acquisition content of the observation setting in accordance with the dynamic change of the observation setting.

Network monitoring program of the third aspect of the present invention is a network monitoring program for monitoring the traffic of a network formed has a plurality of autonomous systems can set route information by autonomous routing policy, each autonomous An integrated management device that acquires communication data that flows on the connection line between connected devices that connect systems and collects traffic information of the observation target that is set for observation, and an integrated management device that is connected via a network . (1) receives the collected information collected by the collecting means, collecting unit to aggregate the collected information in accordance with the observation setting, (2) routing information to gather routing information exchanged between connected devices each autonomous system collecting means, (3) receives the route information from the route information collection unit, the path information holding for holding the route information Means, (4) the routing information holding means to monitor the dynamic change detecting means for detecting a change of the routing information, the dynamic change of the routing information is detected by (5) dynamic change detecting means, the collecting unit Recognize changed routes and dynamically change the acquisition contents of observation settings according to the dynamic change of the route information for the collection means that observes the traffic information of the changed route that has changed dynamically This is a program that functions as observation setting instruction means for instructing the observation setting to be instructed.

  According to the network monitoring system, the network monitoring method, and the network monitoring program of the present invention, in a network that includes a plurality of autonomous systems that can set route information according to an autonomous routing policy, the connected devices of the autonomous system It is possible to realize traffic setting that follows changes in route information between them, and to realize efficient traffic flow analysis and collection of highly accurate observation data.

(A) First Embodiment A network monitoring system, a network monitoring method, and a network monitoring program according to a first embodiment of the present invention will be described below with reference to the drawings.

  The first embodiment observes traffic information of a small-scale network (for example, an AS unit or a network whose path information can be dynamically changed) constituting a broadband network, and aggregates the traffic information of these small-scale networks. A case where the network monitoring system, the network monitoring method, and the network monitoring program of the present invention are applied to a traffic monitoring system of a multipoint broadband network that observes traffic information of the broadband network will be described.

(A-1) Configuration of the First Embodiment FIG. 1 is a configuration diagram showing the overall configuration of the network monitoring system of the first embodiment.

  In FIG. 1, a network monitoring system 4 according to the first embodiment is a system for monitoring traffic in a broadband network configured with a plurality of AS1 to AS5, and each AS1 to AS5 is connected to another AS. Router 3 (3-1 to 3-5).

  In FIG. 1, the network monitoring system 4 of the first embodiment includes at least a collection device 2 (2-1 to 2-6) that observes traffic between ASs and an integrated management device 1. Composed.

  AS1 to AS5 are autonomous systems managed by, for example, a corporate network system or a network connection company, and autonomous route information (routing table) by a routing protocol according to a policy that is independently operated in each system. Is to hold. In each AS1 to AS5, routers 3-1 to 3-5 are provided at connection boundaries with other ASs.

  Each router 3-1 to 3-5 uses a predetermined route information exchange protocol (for example, a protocol such as BGP or OSPF) to route information (routing table) in each AS1 to AS5 with another AS. Are exchanged, and communication data is exchanged between the ASs.

  The collection devices 2-1 to 2-6 acquire all communication data flowing on the lines between the ASs and route information (routing table) exchanged between the routers 3 and store all communication data. .

  In addition, the collection devices 2-1 to 2-6 create or update the route information (routing table), analyze and analyze the acquired communication data according to the set observation settings, and observe the statistical data to be observed Is to collect. That is, the collection devices 2-1 to 2-6 collect the traffic volume for each specific application, the traffic volume of a specific transmission source or transmission destination, the traffic volume of the monitoring line, and the like. Here, the observation settings of the collection devices 2-1 to 2-6 are set according to an instruction from the integrated management device 1, and are activated or stopped according to the instruction from the integrated management device 1, or the contents of the observation target Is set.

  Further, the collecting devices 2-1 to 2-6 regularly provide the integrated management device 1 with traffic flow statistical data and route information based on the monitoring settings. It is.

  The collection device 2-1 collects the traffic flow flowing between AS1 and AS2, the collection device 2-2 collects the traffic flow flowing between AS2 and AS3, and the collection device 2-3 is connected to AS3. The traffic flow flowing between AS5 is collected, the collecting device 2-4 collects the traffic flow flowing between AS2 and AS4, and the collecting device 2-5 collects the traffic flow flowing between AS3 and AS4 The collection device 2-6 collects the traffic flow flowing between AS4 and AS5.

  The integrated management apparatus 1 acquires collected information (statistical data) from the plurality of collecting apparatuses 2-1 to 2-6, and totals the collected information (statistical data) according to a predetermined aggregation method. The integrated management device 1 receives route information (routing table) from a plurality of collection devices 2-1 to 2-6, and manages route information in the broadband network.

  Although details of the statistical data aggregation method in the integrated management apparatus 1 will be described later, by providing the integrated management apparatus 1, it is possible to monitor the monitoring line at all times, and to integrate AS1 to AS5 by totaling the statistical data. Traffic in a wideband network can be monitored. That is, the integrated management device 1 performs traffic information for each monitoring line and traffic information for each application on the broadband network integrating AS1 to AS5 based on aggregated data of traffic flows of the broadband network integrating AS1 to AS5. In addition, at least traffic information from a specific transmission source, traffic information to a specific transmission destination, and the like are collected to monitor traffic abnormalities. Further, the integrated management device 1 refers to the aggregated data, and detects that there is a traffic abnormality when the abnormality detection condition based on the observation setting is satisfied. And an alarm notification function for notifying an alarm.

  When the integrated management device 1 detects a dynamic change in route information, the integrated management device 1 instructs the collection device 2 that monitors the changed route to perform observation setting. The observation setting process according to the dynamic change of the route information by the integrated management apparatus 1 will be described in detail in the operation section.

  FIG. 2 is a block diagram illustrating a hardware configuration of the collection device 2. FIG. 3 is a functional block diagram showing functions realized by the collection device 2.

  As illustrated in FIG. 2, the collection device 2 includes at least a CPU 21, a storage unit 22, and a communication unit 23. The CPU 21 is responsible for the overall control function of the collection device 2. The storage unit 22 includes, for example, a ROM, a RAM (which is a concept including a nonvolatile writable memory such as an EEPROM), and the like. For example, the CPU 21 uses the fixed data stored in the ROM or the temporary data stored in the RAM, and executes the processing program stored in the ROM using the RAM as a working memory, whereby the function of the collection device 2 is achieved. To control. The communication unit 23 transmits and receives information to and from the integrated management apparatus 1 and receives information between the routers 3 according to a predetermined communication protocol.

  In FIG. 3, the main function units realized by the collection device 2 of this embodiment include a communication data collection function unit 221, a data storage management function unit 223, an abnormality detection function unit 224, a temporary storage function unit 225, and a communication data storage. Unit 226, statistical data storage unit 227, temporarily accumulated data storage unit 228, and path information storage unit 220.

  The communication data collection function unit 221 acquires route information exchanged between ASs, provides route information to the route information storage unit 220, and creates or updates route information. The acquisition of route information can be realized by recognizing the route information exchange protocol based on the packet type. The communication data collection function unit 221 periodically provides route information to the integrated management apparatus 1.

  The communication data collection function unit 221 acquires communication data that flows on the connection line between the ASs that are monitoring lines, and stores the acquired communication data in the communication data storage unit 226. Here, in the first embodiment, it is assumed that the monitoring line of the communication data collection function unit 221 is an ultra-high-speed line (for example, 3 Gbps), and the processing load related to the ultra-high-speed acquisition of communication data increases. The communication data is acquired at a normal sampling rate, and after receiving an instruction from the integrated management apparatus 1, an ultra-high-speed acquisition (acquisition at a sampling rate compatible with an ultra-high-speed line) is performed.

  Further, the communication data collection function unit 221 performs a traffic flow statistical process based on the communication data in accordance with the observation settings, and stores the traffic flow statistical data obtained by the statistical process in the statistical data storage unit 227. Is. In addition, the communication data collection function unit 221 notifies the integrated management device 1 of statistical data of a predetermined traffic flow.

  Here, the observation setting information includes, for example, an instruction on whether or not to perform ultra-high-speed acquisition, the name of a specific application, and address information of a specific source or destination (for example, the third layer of the OSI basic reference model, Address information in the fourth layer), specific route information to be monitored (information including AS number), condition information for abnormality detection, and the like.

  Thereby, the communication data collection function part 221 can collect the statistical data of the traffic flow of a monitoring line according to observation setting information. That is, the communication data collection function unit 221 performs application protocol determination, transmission source address determination, transmission destination address determination, and the like based on the header information of the stored communication data. To collect traffic information by application, traffic information by source address to be observed, traffic information by destination address to be observed, traffic information by route to be monitored, etc. be able to.

  When the observation setting information acquisition function unit 222 receives the request information regarding the observation setting from the integrated management apparatus 1, the observation setting information acquisition function unit 222 sets the observation setting information included in the received request information regarding the observation setting in the observation setting information storage unit 229. is there. A predetermined encryption process (for example, SSL communication) may be used for the distribution of the observation setting information.

  The data storage management function unit 223 monitors the storage capacity of the communication data storage unit 226, and deletes old data when it exceeds a predetermined storage capacity. Thereby, in order to acquire all the communication data, it is possible to store the communication data without preparing a storage device having an excessive storage capacity.

  Based on the communication data stored in the communication data storage unit 226, the abnormality detection function unit 224 is related to the traffic amount to a specific transmission destination, the traffic amount from a specific transmission source, the transmission destination and the transmission source. This is a function that monitors the traffic volume for each port type and detects a traffic abnormality when each traffic volume exceeds a set threshold value. Thereby, for example, so-called PortScan, so-called IP sweep, or traffic abnormality for each port type can be determined. Further, when the abnormality detection function unit 224 detects an abnormality, it notifies the integrated management apparatus 1 of abnormality detection information regarding the detected abnormality. At this time, as the abnormality detection information, for example, the identification information of the collection device 2, the identification information of the monitoring network, threshold conditions (for example, application protocol name, threshold value and unit, etc.), traffic volume at the time of abnormality, detection time, etc. And Moreover, as a notification method of abnormality detection information, e-mail notification, SNMPTRAP notification, etc. are applicable, for example.

  The temporary storage function unit 225 temporarily stores communication data information when an abnormality is detected when an abnormality is detected by the abnormality detection function unit 224. Thereby, the communication data information at the time of abnormality detection can be saved separately. The temporary storage function unit 225 can be realized, for example, by installing a hard link or the like in communication data at the time of detecting an abnormality, and may not be deleted even after a normal communication data storage period has elapsed. . As described above, the accumulation function unit 225 is a so-called snapshot function for improving the efficiency of aggregation, and may be arranged in a distributed manner as long as transfer of collected information (statistical data) can be reduced.

  The communication data storage unit 226 stores all communication data acquired by the communication data collection function unit 221 under the management of the data storage management function unit 223. The statistical data storage unit 227 stores the statistical data of the traffic flow of the monitoring line collected by the communication data collection function unit 221. Temporary storage data storage unit 228 temporarily stores communication data information when an abnormality is detected under the instruction of temporary storage function unit 225.

  The route information storage unit 220 stores the route information acquired by the communication data collection function unit 221.

  Next, the hardware configuration and functions of the integrated management apparatus 1 will be described with reference to the drawings. FIG. 4 is a block diagram illustrating a hardware configuration of the integrated management apparatus 1. FIG. 5 is a functional block diagram showing functions realized by the integrated management apparatus 1.

  As illustrated in FIG. 4, the integrated management apparatus 1 includes at least a CPU 11, a storage unit 12, and a communication unit 13. The CPU 11 is responsible for the overall control function of the integrated management apparatus 1. The storage unit 12 includes, for example, a ROM, a RAM (which is a concept including a nonvolatile writable memory such as an EEPROM), and the like. For example, the CPU 11 uses the fixed data stored in the ROM and the temporary data stored in the RAM, and executes the processing program stored in the ROM using the RAM as a working memory. Control the function. The communication unit 13 transmits / receives information to / from the collection device 2 according to a predetermined communication protocol.

  In FIG. 5, the main functions realized by the integrated management apparatus 1 of this embodiment are the statistical data collection function unit 121, the statistical data aggregation function unit 122, the dynamic change detection function unit 123, the observation setting management function unit 124, and the abnormality. It has at least a detection function unit 125, a path information storage unit 127, a statistical data storage unit 128, and an aggregate data storage unit 129.

  The statistical data collection function unit 121 acquires statistical data from each collection device 2 and gives the acquired statistical data to the statistical data storage unit 128 for storage. The statistical data collection function unit 121 acquires route information from each collection device 2 and stores the acquired route information in the route information storage unit 127.

  Here, the statistical data is the statistical data of the traffic flow collected from each collection device 2, for example, the traffic information for each application that is the observation target, the traffic information for each transmission destination address that is the observation target, and the observation target Traffic information for each source address and traffic information for each route to be monitored.

  The statistical data aggregation function unit 122 creates aggregated data according to predetermined observation settings based on the statistical data stored in the statistical data storage unit 128, and stores the created aggregated data in the aggregated data storage unit 129. Is.

  Here, the statistical data aggregation function unit 122 aggregates the traffic information to be observed according to the observation setting. As the aggregation method, for example, a method of aggregation from a physical viewpoint, a method of aggregation from a logical viewpoint, There are a method of aggregation from a time point of view, or an aggregation method that combines these aggregation methods.

  Aggregation methods from a physical point of view include, for example, (a) aggregation for each monitoring line, (b) aggregation for each protocol adopted by the monitoring line, (c) aggregation for a plurality of monitoring lines at a specific connection destination, ( d) A method of collecting statistical data by targeting physically tangible items such as aggregating every monitoring line of all connection destinations.

(A) Aggregation for each monitoring line is a method for aggregating statistical data for each monitoring line. For example, the statistical data from the collection device 2 includes the identification information of the network monitored by the collection device 2; Based on the network identification information, the statistical data for each network is identified, and the statistical data is aggregated for each monitoring line (for example, aggregation of the number of packets, aggregation of the bandwidth (data amount), etc.). Thus, for example, statistical data from the collection device 2 that monitors networks with different media such as an optical line and an electric line and the collection device 2 with different installation locations on each network can be obtained for each network. Aggregated data can be aggregated, and traffic volume differences due to differences in circuit media and traffic volumes of physically separated networks can be aggregated.

(B) Aggregation for each monitoring line protocol is performed by grouping, for example, collection devices 2 having different monitoring line protocols, such as TCP / IP, ATM, OC3, SONET, and the like. It is an aggregation of quantity. Thereby, the difference in traffic volume for each application protocol can be shown.

(C) Aggregation for each of the plurality of monitoring lines at the specific connection destination is, for example, totaling the traffic amounts of the plurality of monitoring lines that have communicated with a specific transmission destination (destination). Thereby, communication with respect to a certain specific transmission destination can be monitored. This can be realized by identifying a specific network address, a specific TCP port number, or a specific UDP port number.

(D) Aggregation of all connection destinations for each monitoring line is, for example, grouping the lines 6 from the same transmission source to all connection destinations and totaling the traffic volume from the same transmission source. Thereby, it is possible to monitor communication from a specific transmission source.

  The aggregation method from a logical point of view is, for example, logical aggregation such as (e) aggregation for each communication of a specific transmission / reception destination, (f) aggregation for each special data used for security attacks, etc. A method of collecting statistical data as the target of the above.

(E) Aggregation for each specific transmission / reception destination communication aggregates statistical data of communication to a specific destination or communication from a specific source.

(F) Aggregation of special data only aggregates statistical data of special attack packet data (for example, a Syn packet or a packet with an incorrect attribute) used for a security attack.

  The aggregation method from the viewpoint of time refers to (g) a method of aggregating collected information at time intervals such as minutes, hours, days, and months. For example, aggregate information can be created every 5 minutes, every hour, every day, every week, or every month.

  The dynamic change detection function unit 123 monitors the route information between ASs stored in the route information storage unit 127 and detects a dynamic change in the route information.

  When the dynamic change detection function unit 123 detects a dynamic change in route information, the observation setting management function unit 124 refers to the route information storage unit 127 and the aggregated data storage unit 129 and observes the changed route. The observation setting instruction is given to the collecting device 2 that is in operation.

  At this time, for example, the observation setting management function unit 124 may instruct observation setting according to the dynamic change of all the route information, or refer to the aggregated data storage unit 129 and dynamically When the traffic volume on the route before the change to 超 え exceeds the threshold (that is, when the traffic volume on the route before the change is large), the observation setting is instructed, or the traffic is based on a specific application protocol Or, the observation setting may be instructed.

  The contents of the observation setting instruction to the collection device 2 include, for example, an instruction for performing ultra-high-speed acquisition, observation of traffic information of a specific application, acquisition of traffic information from a specific destination, to a specific source The acquisition of traffic information can be applied.

  Based on the aggregated data stored in the aggregated data storage unit 129, the anomaly detection function unit 125 is based on the traffic flow expressed in pps or bps, the number of scans per unit time and / or the number of sweep hosts, for example. It is judged whether it is not exceeded or greatly deviated from normal, the degree of abnormality of notification data is quantified (for example, displayed in%), and when an abnormality is detected, the setting file of each collecting device 2 Is distributed, and settings for monitoring data of a specific transmission source or transmission destination, setting of a grouping range, updating of a threshold value, and the like are performed. This set value is reflected in each collection device 2, and monitoring with the new setting can be continued.

  The route information storage unit 127 stores route information from each collection device 2, the statistical data storage unit 128 stores statistical data from each collection device 121, and the aggregated data storage unit 129 The aggregated data aggregated by the statistical data aggregation function unit 122 is stored.

(A-2) Operation of the First Embodiment Next, in the network monitoring system 4 of the first embodiment, the operation of the observation setting process according to the dynamic change of route information will be described with reference to the drawings.

  In the following, focusing on the communication traffic flow from AS1 (transmission source) to AS5 (transmission destination) shown in FIG. 1, the operation of the observation setting process when the communication path from AS1 to AS5 changes dynamically will be described.

  First, the routers 3-1 to 3-5 of each AS1 to AS5 exchange route information (routing table) between routers using a predetermined route information exchange protocol (step S1).

  Further, the path information exchanged by each router 3-1 to 3-5 is acquired by the communication data collection function unit 221 of each collection device 2-1 to 2-6 (step S2), and each collection device 2-1 is exchanged. In 2-6, the acquired route information is stored in the route information storage unit 220 and is given to the integrated management apparatus 1 (step S3).

  Here, the route information exchange protocol applied by the routers 3-1 to 3-5 is not particularly limited. However, in this embodiment, for example, a broadband network represented by the Internet or the like is assumed. OSPF or the like can be applied.

  FIG. 1 shows a case in which route information exchanged between the router 3-1 and the router 3-2 is given to the collection device 2-1 and the integrated management device 1 for easy understanding. However, the route information exchanged between all the routers 3-1 to 3-5 is similarly processed.

  Here, when attention is paid to the communication traffic from AS1 (transmission source) to AS5 (transmission destination), the initial traffic flow is assumed to flow along the route of AS1 → AS2 → AS3 → AS5.

  Then, the route information (routing table) seen from each of the router 3-1, the router 3-2, and the router 3-3 is as shown in (A-1) to (A-3) of FIG. . FIG. 6A-4 shows an example of the contents of the routing table viewed from the router 3-4. At this time, it is assumed that route information having the transmission destination AS5 has not been created.

  That is, FIG. 6A-1 shows that the address of the router 3-2 is the transfer destination of the communication data when the AS5 is the transmission destination as seen from the router 3-1, and FIG. 2) shows that the address of the router 3-3 is the transfer destination of the communication data when the AS 5 is the transmission destination when viewed from the router 3-2. FIG. 3 indicates that the transfer destination of communication data when AS5 is the transmission destination is the address of the router 3-5.

  Also in the integrated management apparatus 1, the same route information (routing table) as that in FIG. 6 is managed.

  In FIG. 1, when communication data is transmitted from AS1 to AS5, the communication data is subjected to transfer processing based on route information (routing table) by routers 3-1 to 3-3, and passes between routers. Then, it is transferred to the router 3-5 of the AS 5 that is the transmission destination (step S4).

  At this time, it is assumed that the collection devices 2-1 to 2-3 have received instructions from the integrated management device 1 and are set to perform ultra-high-speed acquisition.

  The communication data flowing between the routers is acquired at a high speed by the communication data collection function unit 221 of each collection device 2-1 to 2-3 (step S5), and the acquired communication data is stored in the communication data storage unit 226. Statistical processing of the traffic flow to be observed is performed.

  The statistical data of the traffic flow statistically processed in each of the collection devices 2-1 to 2-3 is given to the statistical data collection function unit 121 of the integrated management device 1 (step S6) and stored in the statistical data storage unit 128. At the same time, the statistical data of the traffic flow to be monitored is aggregated by the statistical data aggregated data function unit 122 and stored in the aggregated data storage unit 129 as aggregated data.

  Here, some event occurs in the traffic flow from AS1 to AS5, and as shown in FIGS. 6 (B-1) to (B-4), the route information changes, and the traffic flow route from AS1 to AS5. Is changed from AS1 to AS2 to AS4 to AS5.

  That is, as shown in FIG. 6 (B-2), the AS route information (routing table) seen from the router 3-2 indicates that the forwarding destination whose destination is AS5 is changed from the router 3-3 to the router 3-4. Suppose that it has changed.

  Accordingly, as shown in FIG. 6 (B-3), the route information with the destination AS5 as seen from the router 3-3 is deleted, and as shown in FIG. 6 (B-4), the router As seen from 3-4, it is assumed that route information whose destination is AS5 and whose destination is the router 3-5 is newly added.

  Then, as in steps S1 to S3, the path information exchanged between the routers 3-1 to 3-5 is acquired by the collection devices 2-1 to 2-5, and is given to the integrated management device 1 for integrated management. The route information is updated by the statistical data collection function unit 121 of the apparatus 1.

  FIG. 7 is a flowchart showing the operation of the observation setting process according to the dynamic change of the route information in the integrated management apparatus 1.

  In FIG. 7, when the route information changes and the route information stored in the route information storage unit 127 is updated, the dynamic change detection function unit 123 detects the dynamic change of the route information (step S21). .

  When the dynamic change of the route information is detected by the dynamic change detection function unit 123, the observation setting management function unit 124 refers to the route information storage unit 127 and the aggregated data storage unit 129, and traffic information of the route before the change (Step S22), the collection device 2 of the route after the change is specified (step S23), and an observation setting instruction is given to the collection device 2 (step S24).

  For example, as shown in FIG. 6, when the route information changes, the traffic flow from AS1 to AS5 changes to the route of AS1 → AS2 → AS4 → AS5 (S7).

  Then, the observation setting management function unit 124 collects the collection device 2-4 that observes between the router 3-2 and the router 3-4, and the collection device 2 that observes between the router 3-4 and the router 3-5. The observation setting is instructed to -6 (S8).

  Thus, if observation setting can be performed according to the dynamic change of the route information, the collection devices 2-4 and 2-6 are set by normal wire speed data acquisition, the route changes, When it is recognized that the amount of traffic increases, it is possible to instruct the setting of ultra-high speed acquisition, so that the processing load on the collection device can be reduced. In addition, when tracking a specific event, it is possible to efficiently track while reducing the processing load on the collection device by setting the observation setting for the collection device that is observing the line to be tracked. be able to.

(A-3) Effect of the First Embodiment As described above, according to the first embodiment, the collection device performs static observation by performing observation setting according to the dynamic change of route information. As compared with the above, the processing load of the collecting apparatus can be reduced.

  Further, according to the first embodiment, even when a specific event occurs in the traffic, it is possible to realize the tracking of the traffic by changing the route, and to efficiently analyze and analyze the specific event. .

(B) Other Embodiments In the first embodiment, if the functional configurations of the collection device and the integrated management device can be connected on a network and can implement the functions described in the first embodiment, The servers that realize the respective functions may be distributed and may be provided in the same server.

  Each function of the collection device, the integrated management device, and the observation setting management device described above is realized as a processing program that can be executed by a computer as software, but may be realized as hardware.

1 is an overall configuration diagram of a network monitoring system according to a first embodiment. It is a block diagram which shows the hardware constitutions of the collection apparatus of 1st Embodiment. It is a functional block diagram which shows the function which the collection device of 1st Embodiment implement | achieves. It is a block diagram which shows the hardware constitutions of the integrated management apparatus of 1st Embodiment. It is a functional block diagram which shows the function which the integrated management apparatus of 1st Embodiment implement | achieves. It is explanatory drawing which shows the structural example of the route information of 1st Embodiment. It is a flowchart which shows the observation setting process according to the dynamic change of the route information of 1st Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Integrated management apparatus, 2 (2-1 to 2-6) ... Collection apparatus, 3 (3-1 to 3-5) ... Router (connection apparatus), 4 ... Network monitoring system.

Claims (4)

A network monitoring system for monitoring traffic on a network configured with a plurality of autonomous systems capable of setting route information by an autonomous routing policy,
A plurality of collection means for acquiring communication data flowing on a connection line between connected devices connecting the autonomous systems, and collecting traffic information of an observation target set for observation;
Aggregating means for receiving the collected information collected by each collecting means and totaling the collected information according to the observation setting;
A plurality of route information collection means for collecting route information exchanged between connected devices of each of the autonomous systems;
Route information holding means for receiving each route information from each route information collecting means and holding each route information;
Dynamic change detection means for monitoring the route information holding means and detecting changes in the route information;
When the dynamic change of the route information is detected by the dynamic change detection means, the collecting means for recognizing the changed route by the counting means and observing the traffic information of the changed route that has changed dynamically. On the other hand, a network monitoring system comprising observation setting instruction means for instructing to dynamically change the acquisition contents of the observation setting in accordance with the dynamic change of the route information.   The network monitoring system according to claim 1, wherein the observation setting instruction unit instructs observation setting including an ultra-high speed acquisition command for acquiring traffic information at a sampling rate higher than normal. A network monitoring method for monitoring traffic on a network configured with a plurality of autonomous systems capable of setting route information by an autonomous routing policy,
A collection step in which a plurality of collection means acquire communication data flowing on a connection line between connection devices connecting the autonomous systems, and collect traffic information of an observation target that is set for observation,
A counting step in which the counting means receives the collected information collected by each of the collecting means and totals the collected information according to the observation setting;
Route information collection means, the route information collection step that collects the routing information that is exchanged between connected devices of each autonomous system,
Path information holding means receives said respective path information from top Kikei path information collecting unit, and the path information holding step for holding the respective path information,
A dynamic change detecting unit that monitors the route information holding unit and detects a change in the route information;
When the observation setting instruction means detects the dynamic change of the route information by the dynamic change detection means, the observation setting instruction means recognizes the changed route by the counting means, and displays the traffic information of the changed route that has changed dynamically. A network monitoring method comprising: an observation setting instruction step for instructing the collecting means for observation to dynamically change the acquisition contents of the observation setting according to the dynamic change of the route information. A network monitoring program for monitoring traffic on a network configured with a plurality of autonomous systems capable of setting route information by an autonomous routing policy,
Acquires a communication data flowing connection over line between connected devices for connecting upper SL each autonomous system, a plurality of collecting means for collecting traffic information of the observation target is observed set, integrated connecting via the network Management device
Aggregating means for receiving the collected information collected by each of the collecting means and totaling the collected information according to the observation setting,
Route information collection unit that collects the routing information that is exchanged between connected devices of each autonomous system,
Receive the respective path information from top Kikei path information collecting means, the route information holding means for holding the respective path information,
Dynamic change detection means for monitoring the route information holding means and detecting changes in the route information;
When the dynamic change of the route information is detected by the dynamic change detection means, the collecting means for recognizing the changed route by the counting means and observing the traffic information of the changed route that has changed dynamically. On the other hand, a network monitoring program that functions as observation setting instruction means for instructing to dynamically change the acquisition contents of the observation setting in accordance with the dynamic change of the route information.

Images