JP7294764B2 - Format conversion device, method and program - Google Patents

Description

The present invention relates to a format conversion apparatus, method, and program for data used in network traffic analysis.

In recent years, the number and types of terminals connected to a network have increased, and the network itself has also become more complex, with progress in virtualization and an increase in the types of services. Along with this, network monitoring and traffic trend analysis have become more important for network operation. A technology called xFlow is known as a technology for network monitoring and traffic trend analysis. In the xFlow technology, packets are sampled, and flow statistical information calculated from header information and the header portion itself (header sample) are transferred to an analysis device to aggregate and analyze traffic.

Among the xFlow technologies, NetFlow (see Non-Patent Document 1) and IPFIX (see Non-Patent Documents 2-1 to 2-6) are methods of sampling packets and calculating and transferring flow statistical information from header information. Are known. Among the xFlow technologies, sFlow (see Non-Patent Document 3) and IPFIX w/IE315 (see Non-Patent Document 4) are methods for sampling packets and cutting and transferring the header portion itself (header sample). Are known. In addition, pmacct (see Non-Patent Document 5) and nProbe (see Non-Patent Document 6) are known as implementations of technology for mutual conversion between various existing xFlow formats.

JP 2019-097069 A

B. Claise, "Cisco Systems NetFlow Services Export Version 9", [online], IETF, RFC3954, October 2004, [searched on October 11, 2019], Internet <https://www.ietf.org/rfc /rfc3954.txt.pdf> B. Trammell, and one others, "Bidirectional Flow Export Using IP Flow Information Export (IPFIX)", [online], IETF, RFC5103, January 2008, [retrieved on October 11, 2019], Internet <https:/ /www.ietf.org/rfc/rfc5103.txt.pdf> B. Claise, 2 others, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", [online], IETF, RFC7011, September 2013, [searched on October 11, 2013] , Internet <https://www.ietf.org/rfc/rfc7011.txt.pdf> B. Claise, and one others, "Information Model for IP Flow Information Export (IPFIX)", [online], IETF, RFC7012, September 2013, [searched on October 11, 2019], Internet <https:// www.ietf.org/rfc/rfc7012.txt.pdf> B. Trammell, and one others, "Guidelines for Authors and Reviewers of IP Flow Information Export (IPFIX) Information Elements", [online], IETF, RFC7013, September 2013, [searched on October 11, 2019], Internet <https://www.ietf.org/rfc/rfc7013.txt.pdf> S. D'Antonio, 3 others, "Flow Selection Techniques", [online], IETF, RFC7014, September 2013, [searched on October 11, 2019], Internet <https://www.ietf.org /rfc/rfc7014.txt.pdf> B. Trammell, 2 others, "Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol", [online], IETF, RFC7015, September 2013, [searched on October 11, 2019], Internet <https: //www.ietf.org/rfc/rfc7015.txt.pdf> Peter Phaal, and one others, "sFlow Version 5", [online], sFlow.org, July 2004, [searched on October 11, 2019], Internet <https://sflow.org/sflow_version_5.txt> S. Kashima, 2 others, "Information Elements for Data Link Layer Traffic Measurement", [online], IETF, RFC7133, May 2014, [searched on October 11, 2019], Internet <https://www. ietf.org/rfc/rfc7133.txt.pdf> "Welcome to the pmacct project!", [online], [searched on October 11, 2019], Internet <http://www.pmacct.net/> "nProbe / An Extensible NetFlow v5/v9/IPFIX Probe for IPv4/v6", [online], [searched on October 11, 2019], Internet <https://www.ntop.org/products/netflow/ nprobe/> Yuhei Hayashi, and one other person, "A Study of Setting Values for Inner-Outer Header Mapping Using Hash", The Institute of Electronics, Information and Communication Engineers 2019 Society Conference B-6-18

By the way, packets circulating in a network may be encapsulated by a tunnel protocol or the like. In such a network environment, there is a demand to aggregate and analyze traffic for packets inside capsules.

However, the conventional xFlow technology does not assume the aggregation and analysis of the traffic inside the capsule in the encapsulated packet, and only the traffic outside the capsule is the object of processing. Therefore, in a network where encapsulated packets are transferred, the conventional xFlow technology can only perform aggregation/analysis and xFlow format conversion of traffic outside the capsule, and cannot perform aggregation/analysis inside the capsule.

On the other hand, as a technique for analyzing encapsulated packets, there is known a format conversion technique that enables extraction and analysis of the packet inside the capsule (see Patent Document 1). Also, for encapsulated packets, there is known a technique of registering the correspondence between the packet header inside the capsule and the packet header outside the capsule in a database at high speed (see Non-Patent Document 7).

The above format conversion technology targets the encapsulated packet itself. It identifies the header type from the beginning of the packet, removes unnecessary headers, and associates the packet headers inside and outside the capsule. It is a method to Therefore, although the format of the encapsulated packet itself can be converted, the format of the header sample xFlow packet for the encapsulated packet must be converted to extract the packet inside the capsule, and the correspondence between the packet header inside the capsule and the packet header outside the capsule. There is a problem that it is not possible to perform

The present invention has been made in view of the above circumstances, and its object is to provide a format conversion device and method that enable traffic analysis, etc., using existing analysis devices even in networks in which encapsulated packets are distributed. to provide the program.

The present invention introduces a functional unit that generates an analysis packet for the packet inside the capsule for the header sample of the encapsulated packet collected by header sampling on the network to which the encapsulated packet is transferred, thereby improving the existing analysis Combined with equipment, it enables the aggregation and analysis of traffic inside the capsule.

That is, the present invention is a format conversion device provided in the preceding stage of the first and second analysis devices for analyzing packets, and converts encapsulated packets from a network through which encapsulated packets are distributed. An input for receiving an input of a header sample transfer packet in which meta information for analysis and an analysis header sample including an outer header that is a header of an encapsulated packet and an inner header that is a header of an in-capsule packet of the encapsulated packet are stored. and converting the format of the header sample transfer packet input by the input unit into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and the inner header included in the analysis header sample. a conversion unit that stores correspondence information between the header and the excluded outer header; a first output unit that transfers the header sample transfer packet converted by the conversion unit to the first analysis device ; a statistical analysis data generation unit for generating statistical analysis data based on the header sample transfer packet converted by the conversion unit; a second output unit for storing data transfer packets for type analysis and transferring them to the second analysis device; and a correspondence information output unit for outputting to an output destination device .

According to the present invention, it becomes possible to efficiently aggregate and analyze traffic inside the capsule in a network where encapsulated packets are transferred.

1 is a configuration diagram of a network system according to an embodiment of the present invention; FIG. Diagram explaining the format of each packet Functional block diagram of format converter Sequence example in a network system according to an embodiment of the present invention Analysis result display example Display example of correspondence information

A network system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a network configuration diagram for explaining the outline of the present invention.

In the present invention, as shown in FIG. 1, (1) header sampling by xFlow is set in a network 10 to which encapsulated packets are transferred. Next, (2) a functional unit having the following functions is introduced. Input: Capsule packet header sample xFlow packet. Output: header sample xFlow packets inside the capsule and/or statistical xFlow packets inside the capsule. Preservation: Correspondence of packet header inside and outside encapsulation. Then, (3) the existing xFlow analysis devices 21 and 22 aggregate and analyze the traffic.

That is, in the present invention, the format conversion device 100 has a function of generating an analysis packet for the packet inside the capsule from the header samples of the encapsulated packet collected by header sampling on the network 10 to which the encapsulated packet is transferred. By introducing it before the existing xFlow analysis devices 21 and 22, it is possible to combine with the existing xFlow analysis devices 21 and 22 to aggregate/analyze the traffic inside the capsule.

The network 10 includes sections over which encapsulated packets are transferred. In the example of FIG. 1, a tunnel 14 is formed between a router 11 and a router 12 in a network 10, and the section between the routers 11 and 12 is a section in which encapsulated packets are transferred. That is, one router 11 terminating the tunnel 14 encapsulates a packet and sends the encapsulated packet to the opposite router 12 . The encapsulated packet sent from the router 11 is relayed by the router 13 arranged on the route between the routers 11 and 12 and reaches the other router 12 . Router 12 decapsulates the received encapsulated packet and sends the retrieved packet for forwarding to its destination address. The same is true for the reverse direction. Note that in the present invention, packet encapsulation may be performed in multiple stages. In this case, a plurality of encapsulation processes may be performed by devices with different communication paths, or may be performed by one device.

In the present invention, the existing xFlow technology is used to acquire the header contained in the encapsulated packet as an analysis header sample in the network 10, and the header sample xFlow packet storing the analysis header sample is transmitted to the format conversion device 100. . Acquisition of header samples for analysis and transmission to the format conversion device 100 may be performed by the routers 11 and 12 that perform encapsulation/decapsulation, or by the router 13 that relays the encapsulated packets. In the example of FIG. 1 , the router 13 that relays the encapsulated packet acquires the analysis header sample and transmits it to the format conversion device 100 .

FIG. 2 illustrates the format of each packet. Note that in FIG. 1, the layer 2 (L2) frame format is shown as including layer 3 (L3) packets. In this embodiment, an example in which IP (Internet Protocol) is used as the L3 protocol and Ethernet (registered trademark) is used as the L2 protocol will be described.

In FIG. 2, (A) shows the format of the packet 210 before encapsulation, that is, the packet 210 within the capsule. This packet 210 consists of an L2 frame header 211 , an L3 IP header 212 , and a payload 213 . Here, the IP header 212 of the packet 210 is also referred to as the inner header 212 .

(B) in FIG. 2 shows the format of the encapsulated packet 220 . This encapsulated packet 220 consists of an L2 frame header 221 , an Outer header 222 added by a predetermined encapsulation protocol, the Inner header 212 and the payload 213 . Here, the type and layer of the encapsulation protocol are irrelevant. For example, Outer header 222 is an IP header when IPIP tunneling protocol is used as the encapsulation protocol. Further, when MPLS (Multi-Protocol Label Switching) is used as an encapsulation protocol, the Outer header 222 becomes an MPLS header. Also, the Outer header 222 can include multiple headers attached in multiple stages according to multiple encapsulation protocols. In this case, multiple encapsulation protocols can span multiple layers. For example, the Outer header 222 can include a plurality of headers: IP header + User Datagram Protocol (UDP) header + Layer 2 Tunneling Protocol (L2TP) header. In this embodiment, the IPIP tunnel protocol is used as the encapsulation protocol, and Outer header 222 contains address information of routers 11 and 12 that terminate tunnel 14 in network 10 as a destination address and a source address. Note that the frame header 221 of the encapsulated packet 220 is different from the frame header 211 of the packet 210 described above.

In FIG. 2, (C) shows the format of a header sample xFlow packet 230 storing analysis header samples. This header sample xFlow packet 230 is generated by a router that acquires header samples for analysis and performs transmission processing to the format conversion device 100 . Header sample xFlow packet 230 includes L2 frame header 231 , L3 IP header 232 , xFlow data 233 , and header sample for analysis 234 . Here, the L3 IP header 232 is for transferring the header sample xFlow packet 230, and includes the address information of the format conversion device 100 as the destination address and the address information of the router 13 as the source address. Note that the frame header 231 of the header sample xFlow packet 230 is different from the frame header 221 of the encapsulated packet 220 and the frame header 211 of the packet 210 .

The xFlow data 233 is defined by the xFlow technology and includes meta information of the encapsulated packet 220 that is not included in the analysis header sample 234 and that can be used in the analysis process. For example, meta information includes physical port information (interface information) at which the router 13 received the encapsulated packet 220 and time stamp information at which the encapsulated packet was received.

Analysis header sample 234 includes at least all or part of the Inner header 212 and the Outer header 222 . Analysis header sample 234 may include frame header 221 of encapsulated packet 220 . Also, in the example of FIG. 2( c ), the analysis header sample 234 includes a portion of the beginning of the payload 213 . This is because the Inner header 212 and Outer header 222 may have an undefined length due to the existence of an option area depending on the protocol. 220 is extracted from the top of the header 220 with a fixed length calculated from the maximum lengths of the inner header 212 and the outer header 222 . By such processing, the acquisition processing of the analysis header sample 234 can be performed at low load and at high speed. When the inner header 212 and the outer header 222 store their own header length information or when the header length is fixed, the payload 213 can be generated by referring to the header length information or using the fixed length. It is also possible to extract only the Inner header 212 and the Outer header 222 without including the beginning part of the .

The format converter 100 receives the header sample xFlow packet 230 from the network 10, converts it into data that can be processed by the xFlow analyzers 21 and 22 based on the existing xFlow technology, and outputs the data to each of the xFlow analyzers 21 and 22. The data communication path from the network 10 to the format conversion device 100 and its form (for example, presence or absence of a tunnel), and the data communication route and its form (for example, presence or absence of a tunnel) from the format conversion device 100 to each of the xFlow analysis devices 21 and 22 are No question.

FIG. 3 shows a functional block diagram of the format conversion device 100. As shown in FIG. Format conversion device 100 includes packet input section 110 , format conversion section 120 , correspondence information DB 130 , statistical xFlow data generation section 140 , packet output section 150 , and correspondence information output section 160 .

The format conversion device 100 is composed of a well-known information processing device. The format conversion device 100 may be implemented in any form. For example, it may be implemented as a dedicated hardware device, or may be implemented by installing a program in a physical computer or virtual computer. Moreover, the format conversion device 100 may be implemented by distributing each part thereof to a plurality of hardware devices. Further, each part or part of the format conversion device 100 may be mounted on the same physical device as the router 13 that acquires the header samples, or may be mounted on the same physical device as the xFlow analysis device 21 or 22. good.

Packet input unit 110 receives an input of header sample xFlow packet 230 from network 10 .

The format conversion unit 120 converts the format of the header sample xFlow packet 230 into a format in which the Outer header 222 included in the analysis header sample 234 is excluded from the header sample xFlow packet 230, and is included in the analysis header sample 234. Correspondence information between the inner header 212 and the excluded outer header 222 is stored in the correspondence information DB 130 .

The correspondence information stored in the correspondence information DB 130 is information that includes information that can identify the Inner header 212 and information that can identify the Outer header 222, and links (associates) the two. The information that can be used to identify each header depends on the protocol associated with that header. For example, in the case of IP headers, address information can be used. Also, for example, in the case of MPLS headers, label information can be used. Also, when the Outer header 222 includes a plurality of headers, it can include a plurality of pieces of information corresponding to the protocol associated with each header. Since the IPIP tunnel protocol is used as the encapsulation protocol in this embodiment, the address information included in the inner header 212 and the address information included in the outer header 222 are included. The address information includes at least L3 address information. The address information can further include address information of upper protocols from the viewpoint of L3. The support information may also include other information contained in the header, such as protocol type information. In this embodiment, each header includes a set of a destination IP address, a destination port number, a source IP address, and a source port number. As another example, it may be a 5-tuple further including protocol type information.

The statistical xFlow data generation unit 140 generates statistical analysis data based on a plurality of header sample xFlow packets converted by the format conversion unit 120 obtained in a predetermined period. The existing xFlow technology is used for this statistical processing.

The packet output unit 150 transfers the header sample xFlow packet 240 obtained by the conversion by the format conversion unit 120 to the header sample analysis type xFlow analysis device (A) 21 . FIG. 2D shows the format of the header sample xFlow packet 240 transferred by the packet output unit 150. As shown in FIG. As shown, this header sample xFlow packet 240 includes an L2 frame header 241 , an L3 IP header 242 , xFlow data 233 and an analysis header sample 244 . Here, the difference in format between the header sample xFlow packet 240 output by the packet output unit 150 and the header sample xFlow packet 230 input to the packet input unit 110 is only the presence or absence of the Outer header 222 . Note that the L3 IP header 242 is for transferring the header sample xFlow packet 240, includes the address information of the xFlow analysis device (A) 21 as the destination address, and the address information of the format conversion device 100 as the source address. including. Note that the frame header 241 of the header sample xFlow packet 240 is different from the frame header 231 of the header sample xFlow packet 230, the frame header 221 of the encapsulation packet 220, and the frame header 211 of the packet 210. want to be

The packet output unit 150 also stores the statistical analysis data generated by the statistical xFlow data generating unit 140 in the statistical xFlow packet 250 and transfers it to the statistical xFlow analysis device (B) 22 . FIG. 2(E) shows the format of the statistical xFlow packet 250 output by the packet output unit 150 . As shown, it includes an L2 frame header 251 , an L3 IP header 252 and xFlow data 253 .

Here, the xFlow data 253 is statistical analysis data generated by the statistical xFlow data generator 140 . The L3 IP header 252 is for transferring the statistical xFlow packet 250, includes address information of the xFlow analysis device (B) 22 as the destination address, and address information of the format conversion device 100 as the source address. including. The frame header 251 of the statistical xFlow packet 250 includes the frame header 241 of the header sample xFlow packet 240, the frame header 231 of the header sample xFlow packet 230, the frame header 221 of the encapsulation packet 220, and the frame of the packet 210. Note that the header 211 is different.

The correspondence information output unit 160 outputs the correspondence information stored in the correspondence information DB 130 to an arbitrary output destination. The correspondence information output unit 160 can output the correspondence information to the same output destination as the analysis results of the xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 . The correspondence information output unit 160 may output the correspondence information in response to a request from the output destination, or may notify the output destination in the form of "push". For example, the correspondence information can be output at the update timing of the correspondence information DB 130 or periodically.

The xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 are analysis devices used in the existing xFlow technology. The xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 are each configured by a known information processing device. The implementation form of the xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 is irrelevant. You may Also, the xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 may be distributed and implemented in a plurality of hardware devices.

The xFlow analysis device (A) 21 analyzes the header sample as an input. Specifically, methods such as sFlow (see Non-Patent Document 3) and IPFIX w/IE315 (see Non-Patent Document 4) are used. Used. The xFlow analysis device (B) 22 analyzes the flow statistical information calculated from the header information of the sampled packets as input. (See Patent Documents 2-1 to 2-6).

The xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 each provide analysis results to the terminal 300 of the user. The xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 may provide analysis results in response to a request from the provider, or may notify the provider in the form of "push". good. For example, the analysis result can be output at the update timing of the analysis result or periodically.

Next, a sequence example of the network system according to this embodiment will be described with reference to the sequence chart of FIG.

In the analysis implementation phase, as shown in FIG. 4, first, the router 13 of the network 10 in which the encapsulated packet 220 is distributed acquires the analysis header sample 234 from the encapsulated packet 220, and converts the analysis header sample 234 and xFlow A header sample xFlow packet 230 containing data 233 is transferred to the format conversion device 100 (step S1).

The format conversion device 100 converts the format of the header sample xFlow packet 230 into a format excluding the Outer header 222, and stores the correspondence information between the Inner header 212 and the Outer header 222 in the correspondence information DB 130 (step S2). The format conversion device 100 then transfers the format-converted header sample xFlow packet 240 to the xFlow analysis device (A) 21 (step S3). In addition, the format conversion device 100 generates statistical analysis data for the xFlow analysis device (B) 22 based on the format-converted header sample xFlow packet, and stores the statistical analysis data in a statistical xFlow packet. Packet 250 is forwarded to xFlow analysis device (B) 22 .

In the analysis result confirmation phase, the format conversion device 100 provides the correspondence information stored in the correspondence information DB 130 to the user terminal 300 (step S11). Also, the xFlow analysis device (A) 21 and the xFlow analysis device (B) 22 provide the analysis results to the user terminal 300 (steps S12 and S13). As a result, the user terminal 300 can obtain the analysis result based on the inner header 212 performed by the xFlow analysis device (A) 21 and the xFlow analysis device (B) 22, and the correspondence between the inner header 212 and the outer header 222. Recognition of relationships enables efficient aggregation and analysis of intracapsule traffic in the network 10 through which the encapsulated packet 220 is distributed. FIG. 5 shows an example of the analysis result of the xFlow analysis device (A) 21 displayed on the user terminal 300. As shown in FIG. Also, FIG. 6 shows an example of correspondence information displayed on the user terminal 300 .

Although one embodiment of the present invention has been described in detail above, the present invention is not limited to the above-described embodiment, and various improvements and modifications may be made without departing from the gist of the present invention. .

For example, in the above embodiment, the format conversion device 100 is configured to output both the header sample xFlow packet 240 for the xFlow analysis device (A) 21 and the statistical xFlow packet 250 for the xFlow analysis device (B) 22. However, the configuration may be such that only one of them is output.

DESCRIPTION OF SYMBOLS 10... Network 11, 12, 13... Router 14... Tunnel 100... Format conversion apparatus 110... Packet input part 120... Format conversion part 130... Correspondence information DB
140 Statistical xFlow data generation unit 150 Packet output unit 160 Corresponding information output unit 210 Packet (capsule packet)
212 Inner header 220 Encapsulation packet 222 Outer header 230 Header sample xFlow packet 240 Header sample xFlow packet (after conversion)
250 Statistical type xFlow packet

Claims (4)

A format conversion device provided in front of first and second analysis devices for analyzing packets,
Meta information for analyzing the encapsulated packet , the outer header that is the header of the encapsulated packet, and the inner header that is the header of the packet within the capsule of the encapsulated packet are obtained from the network in which the encapsulated packet that encapsulates the packet is distributed. an input unit for receiving an input of a header sample transfer packet in which are stored header samples for analysis including;
converting the format of the header sample transfer packet input by the input unit into a format in which the outer header included in the header sample for analysis is excluded from the header sample transfer packet, and the inner header included in the header sample for analysis and the a conversion unit that stores correspondence information with the excluded outer header;
a first output unit that transfers the header sample transfer packet converted by the conversion unit to the first analysis device ;
a statistical analysis data generation unit that generates statistical analysis data based on header sample transfer packets converted by the conversion unit obtained in a predetermined period;
a second output unit that stores the statistical analysis data generated by the statistical analysis data generation unit in a statistical analysis data transfer packet and transfers the packet to the second analysis device;
A format conversion device, comprising: a correspondence information output unit that outputs the correspondence information saved by the conversion unit to an output destination device of analysis results of the first and second analysis devices. 2. The format conversion device according to claim 1 , wherein said header sample transfer packet includes a frame header of a frame that stores an encapsulated packet and is distributed in said network. A format conversion method in a format conversion device provided upstream of first and second analysis devices for analyzing packets,
The input unit receives meta information for analysis of the encapsulated packet, the outer header which is the header of the encapsulated packet, and the header of the packet within the capsule of the encapsulated packet from the network in which the encapsulated packet that encapsulates the packet is distributed. an input step of receiving an input of a header sample transfer packet in which an analysis header sample including an inner header is stored;
A conversion unit converts the format of the header sample transfer packet input in the input step into a format in which the outer header included in the analysis header sample is excluded from the header sample transfer packet, and the format is included in the analysis header sample. a converting step of storing correspondence information between the inner header and the excluded outer header;
a first output step in which a first output unit transfers the header sample transfer packet converted by the conversion unit to the first analysis device ;
a statistical analysis data generation step in which the statistical analysis data generation unit generates statistical analysis data based on the header sample transfer packets converted by the conversion unit obtained in a predetermined period;
a second output step in which a second output unit stores the statistical analysis data generated by the statistical analysis data generation unit in a statistical analysis data transfer packet and transfers the packet to the second analysis device; ,
and a correspondence information output step in which the correspondence information output unit outputs the correspondence information saved by the conversion unit to an output destination device of the analysis results of the first and second analysis devices. Format conversion method. 3. A format conversion program for causing a computer to function as each part of the format conversion device according to claim 1 or 2 .

Images