JPH1198194A - Real time packet tracking method and packet matching system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To attain packet matching in real time. SOLUTION: The system has a masking device 11 and a matching device 12. The masking device 11 extracts part of packet data with respect to each packet of two packet streams to generate a retrieval key. The matching device 12 consists of an input. output module and a table management device and checks whether or not packets with an identical retrieval key have already been sent as to the two packet streams and provides an output of the packet pair when sent and provides an output of packets whose identical retrieval key is not received to other output port at a prescribed time after that.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a network for transmitting packets, and more particularly, to a packet tracking method.

[0002]

2. Description of the Related Art In a network (called a user network) for transmitting information (packets), as shown in FIG. 12, a probe (packet probe device 100) for probing a packet flowing on the network via a packet transfer device 101. At multiple locations. Each probe 100 copies a packet from the network and takes in the packet data. Further, each probe sends a large amount of captured packet data to the monitoring server 102 as a continuous stream through a user network or a dedicated network. Further, on the monitoring server 102, the same packet is searched for in real time from continuous data sent from a plurality of points,
Perform packet tracking. The operation of searching for the same packet is called packet matching.

Conventionally, to perform packet matching,
As shown in FIG. 13, the operation of temporarily storing the packet data copied by the probe 100 on the monitoring server 102 and performing packet matching collectively by using the same packet selection device 103 after a certain period of time is repeated. Was. Therefore, the same packet selection device 103 can perform packet matching only by comparing packet data stored on the monitoring server 102 regardless of the execution time.

[0004]

In the prior art, there are the following problems with respect to matching in real time.

[0005] Since processing is not performed in real time, continuous monitoring for a certain time or more is impossible.

Since the search is performed by matching the packet data, it takes a long time for the matching process.

If the size of the search table is small,
An efficient registration method for the search table is required.

[0008] Even if a search table is used, if the search key is long, the reference time of the search table may increase.

When the input rates to the two inputs are different, the amounts registered in the search table are different. If the search table is very small, packets from one side of the input may not be registered in the search table, and packet matching may not be performed properly.

[0010] The function of outputting a packet whose search has failed may not operate in real time. -To perform packet matching, prepare a small finite table, fetch packet stream fragments into that table, search for equal packets based on search keys, and always update the table at short intervals Is required. By the way, if the arrival time of the packet is different or a certain time is required, if this time is longer than the time for updating the table, the packet to be packet-matched is not taken in all tables, Matching does not work properly.

An object of the present invention is to provide a real-time packet tracking method and a packet matching device capable of real-time packet matching.

[0012]

SUMMARY OF THE INVENTION A real-time packet tracking method according to the present invention extracts a part of data of a packet from each packet of each packet stream to create a search key, and performs two packet streams. Check if a packet with the same search key has already been sent, and if so, output those packet pairs. Output to the output port.

[0013] The packet matching apparatus of the present invention includes a masking means for extracting a part of the packet data for each packet of each packet stream to create a search key, and a search key for two packet streams. Check if an equal packet has already been sent,
If it has been sent, it has a matching means for outputting those packet pairs and outputting to another output port a packet to which no packet with the same search key is sent even after waiting for a certain period of time.

Therefore, by using the present apparatus on a monitoring server, packet tracking can be performed in real time based on continuous data sent from a plurality of points.

When using the packet matching device, the matching means uses a hash,
Packet matching in real time becomes possible.

If hash is used when a large amount of search tables cannot be obtained, the possibility of collision occurring at the time of registration in the table increases, and the matching speed may be affected. In such a case, by registering in a table using a Patricia tree, packet matching can be performed in real time. If the search key is long, the possibility of collision occurring during registration in the table increases, and the matching speed may be affected. In such a case, by registering in a table using a Patricia tree, packet matching can be performed in real time.

In the matching means, a search database is created by using a Patricia tree for the input port, so that when both input rates are different with time, packets to be packet-matched to the search table are surely determined. It becomes possible to register in the table.

In the matching means, using one table on one side and three tables on the other side using a hash or a Patricia tree at two input ports, when the input rate on one side is very large, Packets to be subjected to packet matching can be reliably registered in the search table.

Since the matching means holds, besides the search database, an array consisting of a set of search keys and attributes indicating whether the search was successful or unsuccessful, packet data can be deleted from the search table. When it is very costly, it becomes possible to operate a function of outputting a packet whose search has failed in real time.

If the matching means succeeds in the search using the search key, the data is deleted from the search table, and if it is very costly to delete the entire search table all at once, the packet which failed in the search may be deleted. Can be operated in real time.

When a data string composed of a set of a packet and a time stamp is given, the matching means compares the time stamps of the matched packets, that is, calculates a difference or the like, thereby forming a stream. For the two packet data sent,
It is possible to examine the time difference of the same packet data and the fluctuation of the time difference.

Changing the number of search tables means that
That is, the number of data registered in the search table in a certain time is increased. In order to perform accurate packet matching, all packets to be matched need to be registered in a finite search table. For this reason, a stream synchronization device is incorporated, but even if this device is used, if the search tables are updated one after another within the generation interval of the SIQV header, all the packets to be matched may not be registered in the search table. is there.
For this reason, the problem is solved by increasing the size of the search table corresponding to both inputs (one side input in some cases) (claims 5 and 6).

When the search table is updated, it is necessary to output data remaining in the search table as a result of a failed matching (that is, data for which no equivalent key was found). Therefore, unless the search table is cleared, old packet data always remains, and that data is always output as data for which matching has failed. In order to avoid such an error, a method of deleting all the packet data from the search table and a method of referring to information on the packet data registered in the search table can be considered. The choice is a trade-off.

By providing a stream synchronizer,
When the delay variation or delay difference from each probe to the monitoring server is large, the delay error is minimized, the packets to be packet-matched are fetched into all tables, and packet matching can be performed normally.

[0025]

Next, embodiments of the present invention will be described with reference to the drawings.

According to the real-time packet tracking method of the present invention, a packet data stream sent from a packet probe device is directly received, packet matching is performed in real time, and data that has succeeded in packet matching and data that has failed are output.

In order to realize this, as shown in FIG. 1, the present embodiment has a stream synchronization device 30 and a packet matching device 10.

"Packet matching apparatus 10" (claims 2, 3, 4, 5, 6, 7, 8): An apparatus that executes the packet matching method is called a packet matching apparatus. This apparatus has four inputs (IA, IB, M) as shown in FIG.
A, MB) and three output (OM, OIA, OIB) data ports. In the present device, for each packet of the data stream input to the input ports IA and IB,
The result of the matching is output to the data port OM. Regarding the unmatched packet, the input from the input port IA is output to the output port OIA, and the input from the input port IB is output to the output port OIB. Also,
The data ports MA and MB are used as mask input terminals for enabling packet matching by referring to a part of the packet.

As shown in FIG. 3, the packet matching device 10 includes a masking mechanism 11, a matching mechanism 12, and a time stamp processing mechanism 13. Each mechanism is described below. The time stamp processing mechanism 13
Is a mechanism that is enabled when individual data in a data stream is given as a set of a time stamp and packet data, and is provided when processing of the time stamp is necessary.

"Masking mechanism 11" (Claim 2): In packet matching, it is necessary to refer to a part that is not rewritten in the packet data area in order to find an equal packet. For this reason, a mechanism for cutting out a part of the packet data is called a masking mechanism.

In FIG. 5, taking an IP packet as an example,
An operation example of the masking mechanism 11 will be described. Here, "1"
And don't care. A packet (input data) A is at the head of the input data stream to the IA, and a packet B is at the head of the input data stream to the IB. MA
Are shown as mask A, and the mask for MB is shown as mask B. At this time, the masking mechanism 11
Creates mask data with reference to each mask, and passes the data to the matching mechanism 12. The packet data is also passed to the matching mechanism 12.

"Matching mechanism 12"
4, 5, 6, 7, 8): The matching mechanism 12 includes an input / output module 21 and a table management module 22, as shown in FIG. The mechanism 12 has a function of searching for the same packet by referring to a search table using masked data as a key.

Hereinafter, HIA indicates a retrieval table constituted by a hash table (or Patricia tree) corresponding to an input port on the IA side. HIA (key) is the key
Indicates the data retrieved by. HIA (key) →
When described as (a, b, c), it indicates that the data pointed by the key is a data set of a, b, c. Each data is HIA
(Key): a, HIA (key): b, HIA (ke
y): expressed as c. Here, HIA (key): A
Indicates that the data is A searched by the HIA (key).

The input / output module 21 (Claim 2): Here, the input / output module IA will be described below as an example. Note that the input port IB operates similarly by exchanging IA and IB in the following text.

1. The first packet data a of the data stream input to the input port IA and the key of a are acquired.

2. Assuming that an attribute indicating input data from the input port IA is IA, (a, key, I
The data consisting of A) is sent to the table management module 22.

3. When A returns from the table management module 22 and A = NULL, 1
Return to At this time, the operation is performed by exchanging IA and IB.

When A = b (= packet data of HIB (key)) returns, a (or b) is output if the packet does not pass through the time stamp processing mechanism 13. When passing through the time stamp processing mechanism 13, (a,
b) to the time stamp processing mechanism 13.

Return to step 1. At this time, the operation is performed by exchanging IA and IB.

Table management module 22 (Claims 2, 3, 4, 5, 6, 7, 8): Here, an example in which a hash is used for a search table will be described, but the same processing is performed when a Patricia tree is used. Is possible.

Table management module 22 (Claims 2, 3, 4, 5, 7): Table management module 22
Manages a search table HIA1 for the input port IA for each input terminal to the packet matching apparatus 10,
The search table HIB1 corresponding to the input port IB is managed. Further, for input ports IA and IB, DIA and DIB having a key array are provided, respectively. The individual data registered in the search tables HIA1 and HIB1 is HIA1 (key) → (packet data, Mbi
t).

Mbit indicates the attribute of the packet corresponding to the key. The initial value of Mbit is off. When a packet corresponding to the key is found, Mbit is turned on. Therefore, by referring to Mbit, k
It is possible to know whether or not a packet corresponding to ey has been found.

The input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the IA side or IB
Indicates input from the side.

The search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Search table HIB1 based on key
Search for.

When data is obtained from the search table HIB1: * HIB1 (key): when Mbit == OFF: "HIB1 (key): packet data"
Output to T. 2. HIB1 (key): Mbit = ON.

HIB1 (key): When Mbit == ON, outputs NULL to TOUT.

When data cannot be obtained from the search table HIB1: Output NULL to TOUT.

2. Data consisting of (packet data, Mbit = off) is stored in HIA1 (key).

3. Save the key in DIA1.

Next, the table management module 22 manages the search tables HIA1, HIB1 and the arrays DIA, DIB. This function reads the deletion condition T after securing the areas of the search tables HIA1 and HIB1 and the arrays DIA and DIB as an initial operation, and reads tIA = 0, tIB
= 0. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. Although the operation on the input port IA side is described below, the operation on the input port IB side is the same if A and B are exchanged.

When tIA = T: The keys are sequentially referenced from the array DIA, and HIA1 (k
eye): When Mbit == off, “HIA1 (k
ey): The packet data "is output to the OIA.

2. Search table HIA1 and array DIA1
Clear the contents of.

3. It is assumed that tIA = 0.

When tIA <T: This function does not work.

Table management module 22 (claims 2, 3, 4, 8): The table management module 22 manages the search table HIA1 corresponding to the input port IA, and manages the search table HIB1 corresponding to the input port IB. I do. The individual data registered in the search table is
HIA (key) → (packet data), which is composed of only packet data.

The input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the input port IA side or input port IB side.

The search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Based on the key, a search table HI
Search for B1.

When data is obtained from the search table HIB1: "HIB1 (key): packet data"
Output to T. 2. "HIB1 (key): packet data" is deleted from HIB1.

When data cannot be obtained from the search table HIB1: Output NULL to TOUT.

[0062] 2. (Packet data) is stored in HIA1 (key).

Next, the table management module 22 manages the search tables HIA1 and HIB1. This function is
As an initial operation, after securing the areas of the search tables HIA1 and HIB1, the deletion condition T is read and tIA =
0, tIB = 0. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. Although the operation on the input port IA side is described below, the operation on the input port IB side is the same if A and B are exchanged.

When tIA = T: If there is packet data in the search table HIA1, the data is output to the OIA.

2. Clear the contents of the search table HIA1.

3. It is assumed that tIA = 0.

When tIA <T: This function does not work.

Table management module 22 (Claims 2, 3, 4, 5, and 7): Table management module 22
Are search tables HIA1 and HIA corresponding to the input port IA for each input terminal to the packet matching apparatus 10.
2 and a search table H corresponding to the input port IB
IB1 and HIB2 are managed. In addition, for input ports IA and IB, an array DIA consisting of keys is provided, respectively.
1, DIA2, DIB1 and DIB2. Assuming that n = 1, 2 for each data registered in the search table, HIAn (key) → (packet data, Mbi
t).

Mbit indicates the attribute of the packet corresponding to the key. The initial value of Mbit is off. When a packet corresponding to the key is found, Mbit is turned on. Therefore, by referring to Mbit, k
It is possible to know whether or not a packet corresponding to ey has been found.

The input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the IA side or IB
Indicates input from the side.

The search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Based on the key, HIBn (n =
Search for 1,2).

When data can be obtained from -HIBm (m: arbitrary n): * HIBm (key): Mbit == OFF: “HIBm (key) packet data” is output to the OM.

2. HIBm (key): Mbit = ON.

* HIBm (key): When Mbit == ON, outputs NULL to TOUT.

When data cannot be obtained from HIBm (m: arbitrary n): Output NULL to TOUT.

2. Data consisting of (packet data, Mbit = off) is stored in HIA1 (key).

3. Save the key in DIA1.

Next, the table management module 22 manages the search tables HIA1, HIA2, HIB1, HIB2 and the arrays DIA1, DIA2, DIB1, DIB2. This function performs HA0, HA1, H1 as an initial operation.
After allocating areas for B0, HB1, DA0, DA1, DB0, and DB1, read the deletion condition T, and if a is a value that satisfies a <T, tIA = 0, tIB = T−a: Initial state 1 (or , TIA = T−a, tIB = 0: initial state 2), hia = 0, hib = 0. Also, H
IA1 → HA0, HIA2 → HA1, HIB1 → HB
0, HIB2 → HB1, DIA1 → DA0, DIA
2 → DA1, DIB1 → DB0, DIB2 → DB1. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. Hereinafter, the operation of the IA will be described.
The operation on the B side is the same if A and B are exchanged.

When tIA = T: -1-1. The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): Output bucket data "to OIA.

2. HA2 → HAhia, DIA2 →
DAhia.

3. hia = 1-hia, HIA1 →
HAhia, DIA1 → DAhia.

4. Clear the contents of HIA1 and DIA1.

5. It is assumed that tIA = 0.

-1-2. HIA2 → HAhia, DIA2 → DAhia
And

2. hia = 1-hia, HIA1 →
HAhia, DIA1 → DAhia.

3. The keys are sequentially referenced from DIA1 and H
IA1 (key): When Mbit == off, “H”
IA1 (key): Outputs packet data "to the OIA.

4. Clear HIA1 and DIA1.

5. It is assumed that tIA = 0.

-Part 2 1. The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): The packet data "is output to the OIA.

2. Clear the contents of HIA2 and DIA2.

3. HIA2 → HAhia and DIA2
→ Set to DAhia.

4. hia = 1-hia.

5. HIA1 → HAhia, DIA1
→ Set to DAhia.

6. It is assumed that tIA = 0.

-3-1. The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): The packet data "is output to the OIA.

2. HIA2 → HAhia and DIA2
→ Set to DAhia.

3. hia = 1-hia, and HAhia
And DAhia are cleared.

4. HIA1 → HAhia, DIA1 → D
Ahia.

5. It is assumed that tIA = 0.

-Part 3-2 1. HIA2 → DAhia, DIA2 → DAhia
And

2. hia = 1-hia.

3. Refer to the key sequentially from DAhia,
HAhia: When Mbit == off, “HAhi
a (key): Outputs the packet data "to the OLA.

4. Clear HAhia and DAhia.

5. HIA1 → HAhia, DIA1 → D
Ahia.

6. It is assumed that tIA = 0.

In the case of tIA <T: This function does not work.

Table management module 22 (Claims 2, 3, 4, 5, and 8): Table management module 22
Is a search table HIA1 corresponding to the input port IA.
HIA2 is managed, and search tables HIB1 and HIB2 corresponding to the input port IB are managed. The individual data registered in the search table is HIA, where n = 1, 2.
n (key) → (packet data), and is composed of only packet data.

The input to the table management module 22 is given from the input module 21 through TIN, and (ke
y, data, attr). ke
y indicates a search key, data indicates packet data, and attr indicates whether data is input from the input port IA side or input port IB side.

A search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Based on the key, HIBn (n =
Search for 1,2).

When data can be obtained from HIBm (m: arbitrary n): "HIBm (key): packet data"
Output to T.

[0113] 2. "HIBm" from HIBm (key)
(Key): The packet data "is deleted.

When data cannot be obtained from HIBm (m: arbitrary n): Output NULL to TOUT.

[0115] 2. (Packet data) is stored in HIA1 (key).

Next, the table management module 22 manages the search tables HIA1, HIA2, HIB1, and HIB2. In this function, as an initial operation, after securing the areas of the search tables HA0, HA1, HB0, and HB1, the deletion condition T is read, and assuming that a is a <T, tIA = 0, tIB = T−a: Initial state 1 (or tIA = Ta, tIB = 0: initial state 2)
hia = 0 and hib = 0. Also, HIA1 → HA
0, HIA2 → HA1, HIB1 → HB0, HIB2 →
HIB1. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. Although the operation on the input port IA side is described below, the operation on the input port IB side is A
And B are interchanged.

When tIA = T: -1-1. If there is packet data in the search table HIA2, it outputs it to the OIA.

[0118] 2. It is assumed that the search table is HIA2 → HAhia.

3. HIA = 1-hia and HIA1
→ Set to HAhia.

[0120] 4. Clear the contents of the search table HIA1.

5. It is assumed that tIA = 0.

-1-2. Search table HIA2 → HAhia.

2. hia1−hia, and HIA1
→ Set to HAhia.

[0124] 3. If packet data exists in the search table HIA1, it outputs it to the OIA.

[0125] 4. Clear the contents of the search table HIA1.

5. It is assumed that tIA = 0.

-2. If the search table HIA2 packet data exists, it outputs it to the OIA.

[0128] 2. Clear the contents of the search table HIA2.

3. It is assumed that the search table is HIA2 → HAhia.

[0130] 4. HIA = 1-hia and HIA1
→ Set to HAhia.

[0131] 5. It is assumed that tIA = 0.

-3-1. Search table HIA2 → HAhia.

2. hia = 1-hia.

3. If there is packet data in HAhia, it outputs it to OIA.

4. Clear HAhia.

[0136] 5. It is assumed that the search table is HIA1 → HAhia.

6. It is assumed that tIA = 0.

-Part 3-2 1. If there is packet data in the search table HIA2, it outputs it to the OIA.

[0139] 2. It is assumed that the search table is HIA2 → HAhia.

3. HAhia is cleared by setting the search table hia = 1-hia. 4. It is assumed that the search table is HIA1 → HAhia.

[0141] 5. It is assumed that tIA = 0.

In the case of tIA <T: This function does not work.

Table management module 22: Part 2
(Claims 2, 3, 4, 5, 7): The table management module 22 retrieves the search tables HIA1 and HIA1 corresponding to the input port IA for each input terminal to the packet matching apparatus 10.
HIA2 is managed, and search tables HIB1 and HIB2 corresponding to the input port IB are managed. In addition, for input ports IA and IB, an array D composed of keys
IA1, DIA2, DIB1, and DIB2. Assuming that n = 1 and 2 for each data registered in the search table, HIAn (key) → (packet data, Mbi
t).

Mbit indicates the attribute of the packet corresponding to the key. The initial value of Mbit is off. When a packet corresponding to the key is found, Mbit is turned on. Therefore, by referring to Mbit, ke
It is possible to know whether or not the packet corresponding to y has been found.

The input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the IA side or IB
Indicates input from the side.

The search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Based on the key, HIBn (n =
Search for 1,2).

When data can be obtained from -HIBm (m: arbitrary n): HIBm (key): Mbit == OFF: "HIBm (key): packet data"
Output to T.

[0149] 2. HIBm (key): Mbit = ON.

When HIBm (key): == ON, NULL is output to TOUT.

When data cannot be obtained from -HIBm (m: arbitrary n): Output NULL to TOUT.

2. HIA1 (key) stores (packet data, data consisting of Mbit: = ON. 1
See the next paragraph.

3. Save the key in DIA1. 1 is
See next paragraph.

Next, the table management module 22 manages the search tables HIA1, HIA2, HIB1, HIB2 and the arrays DIA1, DIA2, DIB1, DIB2. This function operates as a search table HA as an initial operation.
0, HA1, HB0, HB1, array DA0, DA1, D
After securing the areas B0 and DB1, the deletion condition T and the condition t (t <= T / 2) are read, and tIA = tIB = 0. It is assumed that hia = 0 and hib = 0. further,
HIA1 → HA0, HIA2 → HA1, HIB1 → HB
0, HIB2 → HB1, DIA1 → DA0, DIA
2 → DA1, DIB1 → DB0, DIB2 → DB1. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. In the following, the operation on the IA side is described.
The operation on the side becomes the same when A and B are exchanged.

(1) In the case of -tIA <t: 1.1 = hia + 1

In the case of -t ≦ tIA <T: 1.1 = 1 Both values of 1 and 2 are set.

When -tIA = T: The keys are sequentially referenced from DAhia, and HAhia
(Key): When Mbit == off, “HAhi
a (key): Outputs the packet data "to the OIA.

[0158] 2. Clear the contents of HAhia and DAhia.

[0159] 3. hia = 1-hia.

4. It is assumed that tIA = 0.

(2) In the case of -tIA <t: 1.1 = 1.

In the case of -t <= tIA <T: 1.1 = 1 Both values of 1 and 2.

When -tIA = T: * Part 2-1-1 The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): The packet data "is output to the OIA.

[0164] 2. HIA2 → HAhia and DIA2
→ Set to DAhia.

[0165] 3. hia = 1-hia, HIA1 →
HAhia, DIA1 → DAhia.

4. Clear the contents of HIA1 and DIA1.

[0167] 5. It is assumed that tIA = 0.

* Part 2-1-2 1. HIA2 → HAhia, DIA2 → DAhia
And

2. hia = 1-hia, HIA1 →
HAhia, DIA1 → DAhia.

[0170] 3. The keys are sequentially referenced from DIA1 and H
IA1 (key): When Mbit == off, “H”
IA1 (key): Outputs packet data "to the OIA.

[0171] 4. Clear HIA1 and DIA1.

[0172] 5. It is assumed that tIA = 0.

* Part 2-2 1. The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): The packet data "is output to the OIA.

[0174] 2. Clear the contents of HIA2 and DIA2.

[0175] 3. HIA2 → HAhia and DIA2
→ Set to DAhia.

4. hia = 1-hia.

[0177] 5. HIA1 → DIhia, and DIA1
→ Set to DAhia.

6. It is assumed that tIA = 0.

* Part 2-3-1 The keys are sequentially referenced from DIA2 and HIA2 (key
y): When Mbit == off, “HIA2 (ke
y): The packet data "is output to the OIA.

2. HIA2 → HAhia and DIA2
→ Set to DAhia.

3. hia = 1-hia, and HAhia
And DAhia are cleared. 4. HIA1 → HAhia, DIA1 → DAhia.

5. It is assumed that tIA = 0.

* Part 2-3-2 HIA2 → DIhia, DIA2 → DAhia
And

2. hia = 1-hia. 3. The keys are sequentially referred to from DAhia, and HAhia:
When Mbit == off, “HAhia (ke
y): Output the packet data "to the OIA. 4. Clear HAhia and DAhia. 5. Make HIA1 → HAhia, DIA1 → DAhia 6. Set tIA = 0. , 3,4
5, 8): The table management module 22 manages the search tables HIA1 and HIA2 corresponding to the input port IA, and searches the search tables HIB1 and HIB1 corresponding to the input port IB.
Manages HIB2. The individual data registered in the search table is HIAn (key) →, where n = 1, 2.
(Packet data), and is composed of only packet data.

The input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and “atter” indicates whether data is input from the IA side or not.
Indicates whether the input is from the B side.

The search operation when attr = IA is described. In addition, when attr = IB, the operation is such that A and B are interchanged.

Based on the key, HIBn (n =
Search for 1,2).

When data can be obtained from HIBm (m: arbitrary n): "HIBm (key) packet data" is TOUT
Output to

[0189] 2. From HIBm (key), "HIBm
(Key): The packet data "is deleted.

When data cannot be obtained from -HIBm (m: arbitrary n): Output NULL to TOUT.

[0191] 2. Data consisting of (packet data, Mbit = off) is stored in HIA1 (key). 1
See the next paragraph.

Next, the table management module 22 manages the search tables HIA1, HIA2, HIB1, and HIB2. This function performs HA0, HA
After securing the areas of 1, HB0 and HB1, the deletion condition T and condition t (t <= T / 2) are read, and tIA = tI
B = 0. It is assumed that hia = 0 and hib = 0.
Further, HIA1 → HA0, HIA2 → HA1, HIB
1 → HB0, HIB2 → HB1. Where tI
A and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. The operation on the input port IA side will be described below, but the operation on the input port IB side is the same if A and B are exchanged.

(1) In the case of -tI <t: 1.1 = hia + 1

In the case of -t <= tIA <T: 1.1 = hia + 1,2-hia.

When -tIA = T: If there is packet data in HAhia,
Output it to OIA.

2. Clear the contents of HAhia.

[0197] 3. hia = 1-hia.

4. It is assumed that tIA = 0.

(2) When -tIA <t: 1.1 = 1 is set.

When -t <= tIA <T: 1.1 = 1,2

When -tIA = T: * 2-1-1. If there is packet data in the search table HIA2, it outputs it to the OIA.

2. It is assumed that the search table is HIA2 → HAhia.

3. It is assumed that the search table hia = 1-hia, and HIA1 → HAhia.

4. Clear the contents of the search table HIA1.

5. It is assumed that tIA = 0.

* Part 2-1-2 1. Search table HIA2 → HAhia.

2. hia = 1-hia, HIA1 →
HAhia.

[0208] 3. If packet data exists in the search table HIA1, it outputs it to the OIA.

[0209] 4. Search table HIA1 and array DIA1
Clear

[0210] 5. It is assumed that tIA = 0.

* Part 2-2 1. If there is packet data in the search table HIA2, it outputs it to the OIA.

[0212] 2. Clear the contents of the search table HIA2.

[0213] 3. It is assumed that the search table is HIA2 → HAhia.

[0214] 4. hia = 1-hia.

[0215] 5. It is assumed that the search table is HIA1 → HAhia.

[0216] 6. It is assumed that tIA = 0.

* Part 2-3-1 1. If there is packet data in the search table HIA2, it outputs it to the OIA.

[0219] 2. It is assumed that the search table is HIA2 → HAhia.

[0219] 3. hia = 1-hia, and HAhia
Clear

[0220] 4. It is assumed that the search table is HIA1 → HAhia.

5. It is assumed that tIA = 0.

* Part 2-3-2 1. Search table HIA2 → HAhia.

[0224] 2. hia = 1-hia.

[0224] 3. If there is packet data in HAhia, it outputs it to OIA.

[0225] 4. Clear HAhia.

[0226] 5. It is assumed that the search table is HIA1 → HAhia.

(6) It is assumed that tIA = 0.

Table management module 22 (Claims 2, 3, 4, 6.7): Table management module 22
Manages a search table HIA1 corresponding to the input port IA for each input terminal to the packet matching apparatus 10,
Search table HIB1, HI corresponding to input port IB
B2 and HIB3 are managed. Also, input ports IA and I
For B, an array DIA1, consisting of keys, respectively
DIB1, DIB2 and DIB3. The individual data registered in the search table is (packet data, Mbi
t).

Mbit indicates the attribute of the packet corresponding to the key. The initial value of Mbit is off. When a packet corresponding to the key is found, Mbit is turned on. Therefore, by referring to Mbit, ke
It is possible to know whether or not the packet corresponding to y has been found.

An input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the IA side or IB
Indicates input from the side.

The search operation when attr = IA is described. n is an integer such that n = 1, 2, 3,. Note that when attr = IB, n = 1, and A and B
Is replaced.

HIBn is searched based on the key (when n> 1, all n are checked).

When data can be obtained from -HIBm (m: arbitrary n): * HIBm (key): When Mbit == OFF: "HIBm (key): packet data"
Output to T.

[0234] 2. HIBm (key): Mbit = ON.

* HIBm (key): When Mbit == ON, outputs NULL to TOUT.

When data cannot be obtained from -HIBm (m = arbitrary n): Output NULL to TOUT.

[0237] 2. Data consisting of (bucket data, Mbit = off) is stored in HIA1 (key).

[0238] 3. Save the key in DIA1.

Next, the table management module 22 manages the search tables HIA1, HIB1, HIB2, HIB3 and the arrays DIA, DIB1, DIB2, DIB3. This function performs a search table HIA as an initial operation.
1, HB0, HB1, HB2, array DIA, DB0, D
After securing the areas of B1 and DB2, the deletion condition T is read, and tIA = 0. It is assumed that tIB = 0. Also, HIB1 →
HB0, HIB2 → HB1, HIB3 → HB2, and D
IB1 → DB0, DIB2 → DB1, DIB3 → DB2
And Here, tIA and tIB are timers (or
(Counter = number of packets). Then, it operates as follows. Note that hib starts at 0, and this value is a 2-bit counter (0, 1, 2, 2,
0, 1, 2, ...).

When tIA = T: 1. The keys are sequentially referenced from DIA1, and HIA1 (key
y): When Mbit == off, “HIB3 (ke
y): The packet data "is output to the OIA.

[0241] 2. Clear the contents of HIA1 and DIA1.

[0242] 3. It is assumed that tIA = 0.

In the case of tIA <T: This function does not work.

When tIB = T: -1-1. The keys are sequentially referenced from DIN3, and HIB3 (key
y): When Mbit = off, “HIB3 (ke
y): The packet data "is output to the OIA.

[0245] 2. If a = hib + 1, HIB2 →
HBhib, HIB3 → HBa, DIB2 → HBh
ib, DIB3 → DBa.

[0246] 3. hib = hib-1 and HIB0 →
HBhib, DIB0 → DBhib.

[0247] 4. Clear the contents of HIB0 and DIB0.

[0248] 5. It is assumed that tIB = 0.

-1-2. If a = hib + 1, HIB2 → HBhib,
HIB3 → HBa, DIB2 → HBhib, DIB
3 → DBa.

[0250] 2. hib = hib-1 and HIB0 →
HBhib, DIB0 → DBhib.

[0251] 3. Referring to the key sequentially from DIB0, H
IB0 (key): When Mbit = off, “HI”
B0 (key): Outputs the packet data "to the OIA.

[0252] 4. Clear the contents of HIB0 and DIB0.

[0253] 5. It is assumed that tIB = 0.

-Part 2 1. The keys are sequentially referenced from DIB3, and HIB3 (key
y): When Mbit = off, “HIB3 (ke
y): The packet data "is output to the OIA.

[0255] 2. Clear the contents of HIB3 and DIB3.

[0256] 3. If a = hib + 1, HIB2 →
HBhib, HIB3 → HBa, DIB2 → DBh
ib, DIB3 → DBa.

[0257] 4. hib = hib-1 and HIB0 →
HBhib, DIB0 → DBhib.

[0258] 5. It is assumed that tIB = 0.

-3-1. The keys are sequentially referenced from DIB3, and HIB3 (key
y): When Mbit = off, “HIB3 (ke
y): The packet data "is output to the OIA.

[0260] 2. If a = hib + 1, HIB2 →
HBhib, HIB3 → HBa, DIB2 → DBh
ib, DIB3 → DBa.

[0261] 3. hib = hib-1 and HBhib
And DAhib are cleared.

[0262] 4. HIB0 → HBhib, DIB0 → D
Bhib.

[0263] 5. It is assumed that tIB = 0.

-Part 3-2 1. If a = hib + 1, HIB2 → HBhib,
HIB3 → HBa, DIB2 → DBhib, DIB
3 → DBa. 2. hib = hib-1.

[0265] 3. Refer to the key sequentially from DBhib,
HBhib (key): When Mbit = off,
“HBhib (key): packet data” is output to OIA.

[0266] 4. Clear HBhib and DAhib.

[0267] 5. HIB0 → HBhib, DIB0 → D
Bhib.

[0268] 6. It is assumed that tIB = 0.

In the case of tIB <T: This function does not work.

Table management module 22 (Claims 2, 3, 4, 6, and 8): Table management module 22
Manages the search table HIA1 corresponding to the input port IA, and searches the search table HIB corresponding to the input port IB.
1, HIB2, and HIB3. Each piece of data registered in the search table is packet data, and is composed of only packet data.

An input to the table management module 22 is given from the input / output module 21 through TIN, and (k
ey, data, attr). k
ey indicates a search key, data indicates packet data, and attr indicates whether data is input from the IA side or IB
Indicates input from the side.

A search operation when attr = IA is described. In the case where attr = IB, n = 1 and the operation is such that A and B are interchanged.

Search for HIBn based on key (if n> 1, check for all n). If data could be obtained from HIBm (m: arbitrary n): HIBm (key): Outputs packet data to TOUT.

[0274] 2. From HIBm (key), HIBm
(Key): The packet data is deleted.

When data cannot be obtained from -HIBm (m: arbitrary n): Output NULL to TOUT.

[0276] 2. (Packet data) is stored in HIA1 (key).

Next, the table management module 22 manages the search tables HIA1, HIB1, HIB2, and HIB3. This function performs a search table H as an initial operation.
After securing the areas IA1, HB0, HB1, and HB2, the deletion condition T is read, and tIA = 0 and tIB = 0. HIB1 → HB0, HIB2 → HB1, H
IB3 → HB2. Here, tIA and tIB indicate a timer (or a counter = the number of packets). Then, it operates as follows. Note that hib starts with 0,
This value is a 2-bit counter (when incremented,
0, 1, 2, 0, 1, 2,...).

When tIA = T: 1. If there is packet data in HIA1, it outputs it to OIA.

[0279] 2. Clear the contents of HIA1.

[0280] 3. It is assumed that tIA = 0.

In the case of tIA <T: This function does not work.

When tIB = T: -1-1. If there is packet data in HIB3, it outputs it to OIB.

[0283] 2. HIB2 → HBhib, a = hib +
If it is set to 1, HIB3 → HBa.

[0284] 3. hib = hib-1 and HIB0 →
HBhib.

[0285] 4. Clear the contents of HIB0.

[0286] 5. It is assumed that tIB = 0.

-Part 1-2 1. If HIB2 → HBhib, a = hib + 1,
HIB3 → HBa.

[0288] 2. hib = hib-1 and HIB0 →
HBhib.

[0289] 3. If there is packet data in HIB0, it outputs it to OIB.

[0290] 4. Clear the contents of HIB0.

[0291] 5. It is assumed that tIB = 0.

-Part 2 1. If there is packet data in HIB3, it outputs it to OIB.

[0293] 2. Clear the contents of HIB3.

[0294] 3. HIB2 → HIBhib, a = hib
If +1 is set, HIB3 → HBa.

[0295] 4. hib = hib-1.

[0296] 5. It is assumed that tIB = 0.

-Part 3-1 If there is packet data in HIB3, it outputs it to OIB.

[0298] 2. HIB2 → HBhib, a = hib +
If it is set to 1, HIB3 → HBa.

[0299] 3. hib = hib-1 and HBhib
And DAhib are cleared.

[0300] 4. HIB0 → HBhib.

[0301] 5. It is assumed that tIB = 0.

-Part 3-2 1. If HIB2 → HBhib, a = hib1, then H
IB3 → HBa.

[0303] 2. hib = hib-1.

[0304] 3. If the packet data exists in the HBhib, it outputs it to the OIB.

[0305] 4. Clear HBhib.

(5) HIB0 → HBhib.

[0307] 6. It is assumed that tIB = 0.

In the case of tIB <T: This function does not work.

[0309] "Time stamp processing mechanism 13" (Claim 9): It is assumed that a packet data stream composed of a pair (a, b) is transmitted from the input / output module 21 of the matching mechanism 12. Further, a has a time stamp Ta and data a such as (Ta, a), and b has
It has a time stamp Tb such as (Tb, b) and data b. In this case, when (a, b) is given as an input, (Ta, Tb, a) (or (Ta, Tb,
b)) output data consisting of a set as a packet data stream.

[0310] Stream synchronizer 30 (Claim 10):
The stream synchronizer 30 includes a firing mechanism 31 and an SIQV header reproducing mechanism 32, as shown in FIG. In order to perform synchronization control using this device, when a packet is copied by a probe and the data is sent to a monitoring server as stream data, a packet including a sequence number needs to be periodically inserted. . Suppose that S
Called IQV header.

The SIQV header is generated at regular intervals by the packet probe device, and the sequence number is
Incremented each time a header is created. In the stream synchronizer 30, the SIQs having the same sequence numbers
By performing the execution in units of streams delimited by the V header, synchronous execution control that absorbs errors in the packet data stream collection time becomes possible.

[0312] Fig. 7 shows the basic operation of the firing mechanism 31 of the stream synchronizer 30. As shown in FIG. 7, firing occurs when SIQV headers having the same sequence number are available on both sides of the input. Thereafter, data after the SIQV header is read as needed. SI for only one side input
When the QV header appears, the input side is locked and data reading is stopped. In addition, performing the execution in units of streams divided by the SIQV header has an advantage that the maximum amount of each link buffer can be calculated.

FIG. 8 shows an operation example in which the firing mechanism 31 controls execution in the following manner.

When there is a synchronization packet only at the head of one input (FIGS. 8 (1), (3), (6)): Wait for a synchronization packet to arrive at the other input.

When synchronous packets having a sequence number equal to the head of both inputs are prepared (FIG. 8 (2),
(4)): The synchronous packet is removed, the subsequent data stream is read, and sent to the search table. This is called firing. At this time, the sequence number of the synchronization packet is set to Se.
Save it in a variable called the quence register.

When there is a synchronization packet having a different sequence number at the beginning of both inputs (FIG. 8 (5)): The data stream following the synchronization packet having the smaller sequence number is removed from the data stream after the synchronization packet is removed. Read into stream and send to lookup table.

When there is a synchronous packet having a sequence number smaller than the value of the Sequence register: the synchronous packet is removed, and the subsequent data stream is read.
Send to search table.

[0318] The stream synchronizer 30 uses the SIQ
It has a V header reproducing mechanism 32. The SIQV header reproduction mechanism 32 is a mechanism for reproducing the synchronization packet removed by the firing mechanism 31. This mechanism generates a synchronization packet and outputs it to all the output ports when the firing is performed by the firing mechanism 31. At this time, the sequence number of the fired synchronization packet is used as the sequence number of the synchronization packet newly generated by the present mechanism. If the firing is not performed, the packet stream output from the search table is output.

FIG. 9 illustrates a quality monitoring network and a monitored network.
The monitored network is composed of a host 40, a router 41, and a test packet generating host 42, and these are IP-connected using Ethernet and frame relay. The quality monitoring network includes a packet probe device 43 and a monitoring station 44.
(Monitoring server), these are Ethernet and I
IP connection is performed using SDN. Further, the clock of the packet probe device 43 is synchronized using the ISDN, and the clock of the packet probe device 43 and the monitoring station 44 are very accurately synchronized.

[0320] The packet probe device 43 has a probe interface for probing Ethernet and frame relay of the monitored network (O in the figure). This probe monitors IP packets flowing through the Ethernet and frame relay of the monitored network. The probed result is sent to the monitoring station 44, and the monitoring station 44
, Real-time packet tracking is performed.

In the network quality monitoring network as shown in FIG. 9, analysis programs (Harumoto Fukuda, Satoshi Ono, Naohisa Takahashi,
"Design and Realization of Internet QoS Visualizer"
An example is the use of mpf nodes in IEICE Transactions on Multimedia Networks / Quality of Service Special Issue, Jul., 1997). The SIQV header necessary for the synchronization of the packet data stream is inserted into the packet data stream by the packet collection device, and at the Pin node,
Changed to SIQV header format.

The mpf is configured as exemplified in FIG. It is assumed that the analysis program is given as FIG. The data stream delimited by the SIQV header generated at Pin arrives at the input of mpf. The firing mechanism 31 of the stream synchronizer 30 performs firing control according to the sequence number of the SIQV header, and the data is taken in. Further, the packet matching device 10 performs a matching process. The data processed in this way is unmatch, unmatch, matc
h are output to a total of three output destinations. An SIQV header is added by the SIQV header reproducing mechanism 32 and output from the mpf.

When a packet is copied by a probe, a data stream may be sent to a monitoring server with a time stamp added. The input to mpf is (t,
The stream is composed of a set of packet data and a time stamp indicating time as in p). In this case,
The input by the time stamp processing mechanism 13 is (t1,
p), (t2, p), the matched data is
(T1, t2, p) is output. The time difference is calculated by comparing t1 and t2.

As described above, by performing the processing of the mpf node in real time, the fluctuation such as the one-way delay can be calculated in real time. Further, by manipulating the time stamp of the data output in this way, packet tracking in real time, that is, the operation of the packet on the network can be observed.

[0325]

【The invention's effect】

Claims 1 and 2: By using the present invention on a monitoring server, it is possible to obtain continuous data transmitted from a plurality of points.
Packet tracking in real time becomes possible. Furthermore, by applying the present invention to a packet network and performing packet tracking in real time, it is possible to grasp quality fluctuations in real time. By using the packet matching device that realizes the second aspect, it is possible to select the same packet data from packet data sent in a stream and perform packet matching in real time.

[0327] Claim 3: When using a packet matching apparatus, a matching mechanism can use real time packet matching by using a hash.

Claim 4: By registering input data in a search table using a Patricia tree, real-time packet matching becomes possible.

Claim 5: When both input rates differ depending on time, it is possible to reliably register a packet to be subjected to packet matching in a search table.

Claim 6: When the input rate on one side is very high, it is possible to reliably register a packet to be subjected to packet matching in the search table.

Claim 7: When it is very costly to delete packet data from the search table, it becomes possible to operate the function of outputting a packet whose search failed in real time.

Claim 8: When it is very costly to delete the entire search table, it becomes possible to operate the function of outputting a packet whose search failed in real time.

Claim 9: By calculating a difference or the like,
With respect to two packet data transmitted in a stream, it is possible to examine the time difference between the same packet data and the fluctuation of the time difference.

Claim 10: When delay fluctuation or delay difference from each probe to the monitoring server is large, delay matching should be minimized and packet matching should be performed without modifying the inventions of claims 3 to 8. Packets are loaded into all tables, allowing packet matching to be successful. Furthermore, when considering the network configuration from each probe to the monitoring server, it is not necessary to consider the transfer delay of the data stream.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a real-time packet tracking method of the present invention.

FIG. 2 is a diagram showing input / output ports of a packet matching device.

FIG. 3 is a configuration diagram of a packet matching device.

FIG. 4 is a configuration diagram of a matching mechanism 12.

FIG. 5 is a diagram showing an example of execution of masking.

FIG. 6 is a configuration diagram of a stream synchronization device.

FIG. 7 is a diagram illustrating an example of a method of synchronizing a packet data stream.

FIG. 8 is a diagram showing a sequence number and early control.

FIG. 9 is a diagram showing a network quality management network.

FIG. 10 is a configuration diagram of an mpf node.

FIG. 11 is a diagram showing an analysis program.

FIG. 12 is a diagram showing a packet network and a probe.

FIG. 13 is a diagram showing a conventional packet tracking method.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Packet matching apparatus 11 Masking mechanism 12 Matching mechanism 13 Time stamp mechanism 21 I / O module 22 Table management module 30 Stream synchronizer 31 Firing mechanism 32 SIQV header reproducing mechanism 40 Host 41 Router 42 Host for test packet generation 43 Packet probe device 44 Monitoring station

Claims (11)

[Claims] In a system for receiving two packet streams in which packets as data blocks are continuously transmitted, a part of packet data is extracted from each packet in each packet stream. Create a search key and, for the two packet streams,
Checks if a packet with the same search key has already been sent, and if so, outputs those packet pairs and outputs another packet for which a packet with the same search key is not sent even after waiting for a certain period of time. Real-time packet tracking method to output to mouth. 2. In a system for receiving two packet streams in which packets as data blocks are continuously transmitted, a part of packet data is extracted from each packet of each packet stream. Masking means for creating a search key, and for two packet streams, check whether packets with the same search key have already been sent, and if so, output those packet pairs and wait for a certain time for equality A packet matching apparatus having matching means for outputting a packet to which a packet of a search key is not sent to another output port. 3. The packet matching apparatus according to claim 2, wherein said matching means creates a search database for the input port using a hash table. 4. The apparatus according to claim 2, wherein the matching means creates a search database for the input port using a Patricia tree. 5. The apparatus according to claim 3, wherein said matching means uses two tables for each of two input ports. 6. The matching means uses one table on one side and three tables on the other side using a hash or a Patricia tree at two input ports.
An apparatus according to any one of the preceding claims. 7. The method according to claim 3, wherein the matching unit holds, in addition to the search database, an array including a set of a search key and an attribute indicating whether the search has succeeded or failed. Equipment. 8. The apparatus according to claim 3, wherein the matching unit deletes data from the search table when the search is successfully performed using the search key. 9. The apparatus according to claim 2, wherein said matching means has a function of comparing time stamps of the matched packets when a data string composed of a packet and a time stamp is provided. 10. A stream synchronizer for synchronizing data provided to two input ports of the packet matching apparatus according to claim 2 so that matching is performed correctly. 11. A control device according to claim 10, further comprising: firing means for performing control for loading stream data as a continuous packet sequence into a search table and removing a synchronization packet; and header reproducing means for playing back the synchronization packet removed by the firing means. A stream synchronizer as described.