JPH1168821A - Data link frame scanner for network management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily analyze or manage data flowing through WAN and/or LAN by inputting the data link frame of a signal exchanged on a network connecting the WAN and/or LAN, and generating a packet for 'Ethernet(R)' while inserting prescribed information. SOLUTION: A data link frame scanner(DLFS) 10 for network management inputs a data link frame exchanged on the network connecting WAN 14 and/or LAN 20 for each frame and after a flag F is removed, the packet for 'Ethernet(R)' is constituted by adding prepared header and trailer to the other data including addresses. At the same time, the prescribed information is inserted to the header, the packet for 'Ethernet(R)' is outputted to an analytic node (WS) 32 and the WS 32 performs analysis so that the load of processing in the DLFS 10 can be reduced.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a data link frame scanner for network management, and more specifically, to a data link frame which inputs a data link frame flowing between a WAN and / or a LAN and outputs it to an analysis node. The present invention relates to an OSI reference model included in a frame, which can analyze or manage the second layer (data link layer) to the seventh layer (application layer).

[0002] Here, the term "data link frame scanner" is a term related to a term coined by the inventors, and is a signal transmitted / received over a network comprising a WAN and / or a LAN, more specifically, an OSI reference model. A data link signal (information separated by a flag: a frame) transmitted and received by the two data link layers is format-converted and converted into an Ethernet packet, more specifically, a packet conforming to the DIX-Ethernet specification. This means a device that outputs data to an analysis node provided separately so that the analysis node can analyze or manage data that flows on the network.

[0003]

2. Description of the Related Art In recent years, with the spread of computers to companies and general households, the scale of computer networks such as the Internet has been dramatically increased. On the other hand, as the number of network users increases, the necessity of investigating and analyzing the characteristics of traffic and data on network transmission lines has become more and more important.

In order to analyze data on a network transmission path and use the information for building a future network, the network traffic is managed and controlled.
There is a need for a device that can analyze.

Conventionally, such a technique is disclosed in
As is known from JP-A-327712, in a connection between a WAN (Wide Area Network) and a LAN (Local Area Network), an SNMP (Si) for network management of a LAN and a router or a bridge device.
mple Network Management Protocol) has been proposed.

[0006] SNMP is a communication protocol used between a computer of a network administrator for referring to management information of devices connected on the Internet and devices (computers, routers, etc.) connected to the network. is there. In this communication protocol, when a check request signal (inquiry) is sent from an administrator computer, each device notifies its own state, or each device changes its own state based on a setting request from the administrator computer. It is agreed to set the status.

The values that can be queried are:
It is defined in MIB (Management Information Base). SNMP is mainly used for collecting information from devices connected to a network based on MIB.

L such as a router, bridge or brouter
In general, the AN connection device is configured to detect a collision (collision) or an error packet generated on the LAN transmission path.
By storing the information and transmitting it to a device such as an SNMP manager device, statistical information generated on the LAN is managed.

[0009]

However, when the above-described SNMP is used, the value that can be queried is limited by the MIB, so that the information obtained from each node is also limited. Therefore, it could not be said that sufficient management information was obtained in managing and analyzing the network.

On the other hand, modems, I
An SDN-TA, a multiplexing device, or the like may be used. Such a terminal adapter performs network management based on information such as a line signal level and an SN ratio, and has a unique network management not based on SNMP. You are using the method. Therefore, in such a case, communication between the terminals cannot be monitored (or monitored) by the network management method using SNMP.

Further, when SNMP is used, each node analyzes and processes data, and all inquiries from the management station are delivered to each node using the network itself, so that the SNMP inquiry processing itself is performed. There were problems such as overloading the network.

Accordingly, an object of the present invention is to provide a network management data link frame scanner capable of easily analyzing or managing data flowing through a WAN and / or a LAN with the object of solving the above-mentioned disadvantages. The purpose is to:

Further, the WAN is reduced while reducing the processing load.
It is an object of the present invention to provide a data link frame scanner for network management that can easily analyze or manage data flowing through a LAN.

[0014]

In order to solve the above-mentioned problems, according to the first aspect of the present invention, a WAN and / or a wireless LAN (L) are provided.
A data link frame of a signal transmitted / received in a network connecting ANs is input, and predetermined information is inserted to generate an Ethernet packet.

[0015] Preferably, the predetermined information includes a time at which a data link frame is received is 1/1.
Information to be stamped in units of 000000 seconds, short frames detected during reception, abort, fractional bits, CRC status information, frame type information of data link frames, size information of data link frames, and capture size information of data link frames It was configured to include at least one of them.

According to a third aspect of the present invention, the apparatus further comprises a function of shaving an input data link frame in the apparatus in order to suppress the output packet length.

According to a fourth aspect of the present invention, when the data link frame is not received from the WAN for a certain period of time, an Ethernet packet for notifying that the apparatus is operating normally is generated. did.

According to a fifth aspect of the present invention, further, the WAN
When an abnormality is detected in the interface on the side, an Ethernet packet for notifying that the interface is abnormal is generated.

[0019]

According to the first aspect, without performing complicated processing such as data analysis in the present apparatus (scanner),
Since a part or all of the data link frame and predetermined information are transmitted as an Ethernet packet to an analysis node (workstation) provided separately, the administrator can connect the WAN and / or the LAN at the analysis node. It is possible to easily obtain a data link frame on a connected network or information on the frame. Further, since the analysis of the data link frame is performed by an analysis node provided separately, the processing load in the scanner can be reduced.

It is to be noted that how the analyzing node processes the data after reception depends on the specifications of the analysis application.

According to another aspect of the present invention, the predetermined information to be inserted into the Ethernet frame output to the analysis node includes information on a time when the data link frame is received, a short frame detected when the data link frame is received. , Abode, Fractional bits, CRC status information,
Frame type information included in the data link frame,
Since the configuration is made up of the data link frame size information and the data link frame capture size information, the administrator can simplify the data link frame reception time of this apparatus (scanner) or the formal data of the received data link frame at the analysis node. Therefore, traffic analysis at the analysis node can be performed on at least the time or other formal information of the data link frame.

According to the third aspect of the present invention, since information necessary for management and analysis in the analysis node is in the first half of the data link frame, by performing shaving to an arbitrary capture size in the present apparatus, the necessary minimum is obtained. Data can be generated and output packets can be suppressed and the memory capacity of the analysis node device can be reduced.

According to a fourth aspect of the present invention, in the apparatus, the interface on the WAN side of the apparatus is normal, and the data link frame is not received from the WAN side for a certain period of time and output to the analysis node. When there is no packet to be transmitted, an Ethernet packet (hereinafter referred to as a keep-alive packet) for notifying that the apparatus is operating normally is generated and output to the analysis node. Side) can be notified at regular intervals that the apparatus is operating normally even when there is no data (packets) to output.

According to a fifth aspect of the present invention, when the apparatus detects an abnormality in the WAN interface of the apparatus,
Since the configuration is such that an Ethernet packet (hereinafter, referred to as a trap packet) for notifying the analysis node that an error has occurred in the interface has been generated, the administrator needs to generate an error in the interface of this device (scanner) in the analysis node. Can be detected promptly.

[0025]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is an explanatory diagram showing the entire network including a network management data link frame scanner (referred to as “DLFS” in the figure and hereinafter referred to as such) 10 according to the present invention. For ease of understanding, the DLFS 10 according to the present invention will first be described in connection with a network.

As shown, this network includes a dedicated line, a public line (such as a telephone line or an ISDN line) 12.
And a DSU (Data
(Service Unit) 16 and a LAN 20 mutually connected via a router 18. The LAN 20 is connected to a plurality of users 22.

The transmission line 26 connecting the DSU 16 and the router 18 has a second transmission line 2 such as a Y-shaped cable.
8, the input interface of the DLFS 10 according to the present invention is connected. The output side interface of the DLFS 10 is a LAN with the analysis node (FDDI (Fiber Distributed Digital Interface) in this embodiment).
WS (Work Station) to actually analyze via 30
32. The reference numeral 34 indicates Proxy Ag.
ent.

The configuration of the DLFS 10 and the FDDI 30, etc. is provided for each LAN, two in the illustrated example. The DLFS 10 is not integrated with the DSU 16 but is separated from the DSU 16 and connected with the signal line 28. With such a configuration, even when the DLFS 10 freezes, there is no effect on the WAN-LAN communication.

FIG. 2 is a block diagram functionally showing the configuration of the DLFS 10. As shown in FIG.

As shown, the DLFS 10 includes an input interface 100, a first serial controller 1 and a second serial controller 1.
02, 104, first and second dual-port SRAM1
06, 108, a CPU 110, a direct memory access (DMA) controller 112, a LAN controller 114, an output interface, and the like.

The interface 100 has an input 100a for inputting a data link frame sent from the LAN 20 to the WAN 14 for each frame, and an input 100b for inputting a frame flowing in the opposite direction. These inputs 100a, 100b are both 35 (or may be X.21, etc.).

The DLFS 10 further stores various memories, that is, EPROM 116, FROM 118, and EEPROM.
120, PROGARM RAM 122 and WORK
It has a RAM 124 and time stamps 126 and 128 for writing input times.

These components are connected to a bus 130 as shown in FIG.
Through the CPU 110, as will be described later.
Receives a data link frame, which is input from the interface 100 and conforms to a plurality of protocols, for each frame in accordance with a command stored in the EPROM 116 or the like. Then, information for marking the time at which the data link frame was received in units of 1/100000 seconds, the short frame detected at the time of reception, the abort (continuation of logical value “1” of 7 bits or more), fraction bits, CRC (Cyclic
Redundancy Check: a header into which information of an error detection code is inserted and a trailer are inserted (added), an Ethernet packet is generated, and analyzed or managed by the WS 32 as the analysis node via the FDDI (LAN) 30. Output (send).

Next, the operation of the DLFS 10 will be described.

FIG. 3 shows a data link frame input by the DLFS 10 and the WS
4 shows an output data link frame to be sent to the (analysis node).

That is, the DLFS 10 receives a signal transmitted and received on the network as an input frame, more specifically,
An OSI reference model described below reads a data link frame (a frame partitioned by a flag F) transmitted and received by the data link layer of the second layer, inserts predetermined information into a header, and outputs it as an output packet (a packet for Ethernet). Send to the analysis node side.

OSI (Open Systems Interconnection =
An open system interconnection) reference model is an ISO
(International Organization for Standardization =
A communication protocol set by international organizations such as the International Standards Organization, and there is a standard model that can be applied to all computers from different manufacturers. In the OSI reference model, the communication protocol is divided into seven sections (physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer). A unit of meaningful information, that is, an agreement for transmitting and receiving as a frame, defines the delimitation and configuration of one frame, and is composed of bits on one link (connection path) between two nodes. Forwarded frame.

In this specification, a frame specified and transmitted / received in the data link layer of the OSI reference model is called a data link frame.

As shown in the figure, the DLFS 10 removes a flag from the input data link frame, and uses predetermined information as a header, that is, a destination MAC address de.
st (the MAC address of the analysis node in this device: 6 octets), the source MAC address src (D in this device
MAC address of LFS 10: 6 octets, type tp (IP is always inserted in this device: 2 octets), timestamp timesp (this device is the exact time when data link frame was received from built-in clock (1 / 1,000,000 seconds): 8
Octet), ID (I that differs for each DLFS product)
D: 2 octets), original length oln (data link frame size information: 2 octets), status Sts (short frame detected at reception, abort, fractional bid, CRC status information: 2 octets), captured length cln ( Packet length suppression size information provided in the device for suppressing the output packet length: 2 octets, frame type P (received data link frame information: 1 octet), and reserved Rsv (for future extension. In the embodiment, Always 0 × 0
0: 3 octets).

Further, a frame check sequence FCS (error detection) is added (inserted) as a trailer and converted into an Ethernet packet as a whole. More specifically, proposals by Digital Equipment Corporation, Intel Corporation, Xerox Corporation, etc. The format is converted into a format conforming to the Ethernet (data link protocol) of the DIX specification according to the above standard, and the packet is output.

By performing such format conversion, the DLFS 10 analyzes all or a part of the data link frame according to a plurality of protocols on the transmission path connecting the WAN and / or the LAN as it is as the data of the Ethernet packet. Can be sent to the node.

Hereinafter, the format conversion will be described in detail.

In FIG. 1, data link frames (information delimited by flags: frames) transmitted and received between the WAN 14 and the LAN 20 are transmitted to respective destinations via the router 18, specifically, the user 22 on the LAN side. Or WA
It is sent to another router on the N side. DLFS 10 inputs those traffic.

FIGS. 4 to 6 show the frame format of the data link frame. In the embodiment, one of these three types of frames is input.

FIG. 4 shows an HDLC (High Level Data Link Control) similar to the input data link frame shown in FIG.
l Procedure: High level data link control means). H
In the DLC, an address A (when the most significant bit is 0, the next one octet is also an address), a control C (the format differs depending on the type of frame), a data, and a frame check sequence FCS (a sequence for a control error. Is 2 octets, but due to the promise between sending and receiving,
(Extended to 4 octets) and a flag F.

FIG. 5 is an explanatory diagram showing an input frame format when conforming to the Cisco HDLC. Ci
In scoHDLC, a data type (IP, SLARP, etc.) is inserted between control C and data.

FIG. 6 shows a PPP (Point-to-point protocol).
l) It is explanatory drawing which shows the input frame format in the case of following. LCP, IPCP, I
P and the like are inserted.

The data link frame input to the DLFS 10 as described above is transmitted to the interface 100 (V.3).
5), the serial controller 102 (or 1)
04). The CPU 110 recognizes an input data link frame in response to an interrupt request from the serial controller 102 (or 104), and also detects an I / F abnormality / recovery.

When the CPU 110 recognizes the input of the data link frame, the dual port SRAM 106 (or 108) is transmitted via the DMA controller 112.
The incoming data link frame to the dual port SRA via time stamp 126 (128)
The input time is written to M106 (or 108).

Time stamp 126 (or 128)
Input time by the serial controller 1
02 (or 104) detects that the first data of the input data link frame has been DMA-transferred to the buffer,
When the transfer is detected, the transfer is performed by transferring the data to the time stamp storage area in the buffer. It should be noted that the time stamp indicates the time at which the data link frame was received by 1 /.
It is imprinted every 1,000,000 seconds.

If an abnormality is detected in the interface or the like, the trap packet initially generated from the dual port SRAM 106 (108) is transferred to the LAN controller 114 and output.

FIGS. 7 to 9 show the format of an Ethernet packet (output packet) output from the DLFS 10 to the analysis node side. There are three types of output packets from the DLFS 10, as shown in FIGS.
Although the format of the header of each packet is common to all the packets, the contents are slightly different.

The output shown in FIG. 7 is in the format of a normal Ethernet packet. The DLFS 10 adds the following information (predetermined information described above) as a header.

That is, the destination MAC address dest, transmission source MAC address src, type tp, time stamp timesp, ID, original length oln, status Sts, captured length cln, packet type P, and reserved Rsv are added (inserted). .

Further, the DLFS 10 adds a frame check sequence FCS to the end of the data. FIG.
Is the buffer format of the header described above.

As shown in FIGS. 7 to 9, the DLFS 10
When sending (outputting) an input data link frame to the analysis node side, information necessary for network management is added to the header (head side) of the packet. Also, the analysis node such as WS32 does not always need all or a part of the input data, and if all the input data of the data link frame is sent to the analysis node, the DLFS1
0 may increase the memory capacity, and may cause unnecessary load on transmission lines, analysis nodes, and the like to transmit unnecessary information.

Therefore, the capture size can be set in the DLFS 10, and when the input data link frame length is larger than the set capture size, the frame is transmitted to the analysis node by the set data size from the beginning of the frame. As a result, the configuration can be simplified, the memory capacity and the like can be reduced, and output packets can be suppressed.

The output Ethernet packet is transferred from the dual port SRAM 106 (108) to the LAN controller 114 via the DMA controller 112, and when a transmission request command is issued to the LAN controller 70, it is output via the output interface. You.

Here, when there is no data link frame input for a certain period of time, the DLFS 10 outputs a previously created keep-alive packet (normal signal) from the LAN controller 114 to the analysis node side, and the DLFS 10
Informs the administrator (analysis node) that is operating normally.

FIG. 8 is an explanatory diagram showing a packet format when a keep-alive packet (normal signal) is output. For keep-alive packets, oln, St
Let s be a dummy, and insert K (: KeepAlive) as an identifier of the transmission packet into the packet type P.

FIG. 9 is an explanatory diagram showing a packet format when a trap packet (abnormal signal) is output. In the trap packet, oln is set to dummy and St
s, an identifier corresponding to each abnormality of the interface (for example, -1: line abnormality, -2: line restoration, 2: Li
nkDown, 3: Defined as LinkUp). In the frame type P, T (Trap) is inserted as a transmission packet identifier.

In the data link frame scanner 10 for network management according to this embodiment, as described above, a data link frame transmitted / received on the network connecting the WAN 14 and / or the LAN 20 is input, and predetermined information is inserted. Output to the analysis node (WS32).

More specifically, a data link frame transmitted / received on a network connecting between WAN 14 and / or LAN 20 (a frame transmitted / received on the data link layer of the second layer of the OSI reference model) is input for each frame, After removing only the flag F, a header and a trailer prepared in advance are added to other data including an address to form an Ethernet packet (based on the DIX specification), and predetermined information is inserted into the header. The Ethernet packet is configured to be output to the analysis node (WS32).

Thus, the WAN and / or LA
It is possible to easily analyze or manage data passing on a network connecting N nodes. Further, since the analysis is performed by the analysis node, the processing load in the scanner can be reduced.

The predetermined information includes information on the time at which the data link frame was received, short frame, abort, fraction bits detected at the time of reception, CRC status information, frame type information of the data link frame, data link frame , And at least one of the data link frame capture size information.

Further, in order to suppress the output packet length, the data link frame input in the apparatus is configured to be shaved to an arbitrary capture size so that the required minimum data length is added to the Ethernet packet.

When the interface on the WAN side is normal and no data is received from the WAN side for a certain period of time, a normal signal (keep-alive packet) is output to the analysis node.

Further, when an abnormality is detected in the WAN interface, an abnormality signal (trap packet) is output to the analysis node.

Note that, in the above, in the embodiment, the WAN
Shows a network that interconnects a LAN and a LAN.
A network consisting of only one of the LAN from the AN may be used. In that sense, it is described as “WAN and / or LAN” in the claims.

[0071]

According to the first aspect, the WAN and / or
Alternatively, traffic (data) of a network connecting LANs can be easily analyzed or managed. Further, since the analysis is performed by the analysis node, the processing load in the scanner can be reduced.

According to the second aspect, the administrator can easily obtain the data link frame reception time of this apparatus (scanner) or the formal data of the received data link frame at the analysis node. The traffic analysis at the analysis node can be performed on at least the time or other formal information of the data link frame.

According to the third aspect, the output packet can be transferred to the analysis node more quickly than the present apparatus, and the memory capacity of the device on the analysis node side can be reduced.

According to the present invention, the apparatus (scanner) is notified to the analysis node that the apparatus (scanner) is operating normally without outputting data (packet) for a predetermined time. be able to.

According to the fifth aspect, when an abnormality occurs in the input interface 100 of the apparatus (scanner), the analysis node can detect the abnormality.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram showing a data link frame scanner for network management according to the present invention in a network.

FIG. 2 is a functional block diagram showing a configuration of a DLFS of FIG. 1 in detail.

FIG. 3 is an explanatory diagram showing input / output information of the DLFS of FIG. 1;

FIG. 4 is an explanatory diagram showing a format example of information input by the DLFS of FIG. 1;

FIG. 5 is an explanatory diagram showing another format example of information input by the DLFS of FIG. 1;

FIG. 6 is an explanatory diagram showing still another format example of information input by the DLFS of FIG. 1;

FIG. 7 is an explanatory diagram showing a format example of information output by the DLFS of FIG. 1;

FIG. 8 is an explanatory diagram showing another format example of information output by the DLFS of FIG. 1;

FIG. 9 is an explanatory diagram showing still another format example of information output by the DLFS of FIG. 1;

FIG. 10 is a buffer format diagram showing details of output information of FIGS. 7 to 9;

[Explanation of symbols]

10 Data Link Frame Scanner (DLFS) 14 WAN 18 Router 20 LAN 22 User 30 FDDI (LAN) 32 WS (Analysis Node) 100 Interface 102, 104 Serial Controller 106, 108 Dual Port SRAM 110 CPU 112 Direct Memory Access (DMA) Controller 114 LAN controller 116 EPROM 122 PROGRAM RAM

Claims (5)

[Claims] 1. Network management data, wherein a data link frame of a signal transmitted / received in a network connecting a WAN and / or a LAN is input, and predetermined information is inserted to generate an Ethernet packet. Link frame scanner. 2. The predetermined information includes: a. Time when data link frame was received is 1/100
Information stamped in 0000 second units, b. Short frames, abode,
Fractional bits, CRC status information, c. Frame type information of the data link frame, d. Data link frame size information, and e. 2. A data link frame including at least one of: capture size information of a data link frame.
The data link frame scanner for network management according to the item. 3. The data link frame scanner for network management according to claim 1, further comprising a function of shaving an input data link frame in the apparatus to suppress an output packet length. 4. An Ethernet packet for notifying that the device is operating normally when a data link frame is not received from the WAN for a predetermined period of time. The data link frame scanner for network management according to any one of the above items. 5. An Ethernet packet notifying that the interface is abnormal when an abnormality is detected in the interface on the WAN side is generated. 2. A data link frame scanner for network management according to item 1.