KR100458698B1 - System for number of ip address sharing client, method for performing the same, and computer readable medium stored thereon computer executable instruction for performing the method - Google Patents

Abstract

The present invention relates to a system for monitoring the number of IP sharing clients, a method thereof, and a computer-readable recording medium having the program recorded thereon. The present invention relates to a system for monitoring the number of IP sharing clients outside of a private network sharing an IP address, a method thereof, and a computer-readable recording medium having recorded thereon, the IP being transmitted from a private network. By analyzing the pattern of identification codes contained in the packet, the number of identification code increment sets having individual incremental patterns is found, and the number of clients sharing the monitoring target IP address is monitored.

Description

SYSTEM FOR NUMBER OF IP ADDRESS SHARING CLIENT, METHOD FOR PERFORMING THE SAME, AND COMPUTER READABLE MEDIUM STORED THEREON COMPUTER EXECUTABLE INSTRUCTION FOR PERFORMING THE METHOD}

The present invention provides a system, a method, and a computer-readable recording medium for programmatically recording the number of clients sharing IP in a private network using a predetermined IP sharing means. will be.

Recently, the information and communication technology has been rapidly developed and the Internet environment has been established worldwide, and the economic industry base is shifting from offline to online. Accordingly, the business environment is being integrated into one virtual space transcending time and space. Especially, with the spread of high speed internet, the internet has become an essential part of our daily life.

However, in the process of spreading the broadband Internet, it is illegal for high-speed Internet service providers to connect multiple clients to a single line, but the IP sharing solution company has raised the opinion that it violates users' autonomous use. It is true. In addition, the IP sharing solution company said, "When IP address shortage problem is on the rise, internet routers and programs can solve this problem and regulate it is the service provider's superior status. Violates rights. " The claims made by IP sharing solutions companies come from a sense of urgency to hand over the IP sharing market secured through years of development to high-speed Internet service providers.

For example, ADSL service aggregation equipment (DSLAM) currently supports 1300 subscriber ports in 155Mbps bandwidth, so the theoretical transmission rate per subscriber is only 199kbps (155Mbps / 133 people), but the probability of 1300 simultaneous users is 12. As it is only%, it guarantees transmission speed of 3-4Mbps for premium service subscribers. However, if the user connects two or more PCs through IP sharing, the theoretical transfer rate will be lowered below 59.9kbps. Therefore, the increase in the number of users, the speed of the bandwidth is reduced to damage the bona fide user, and the high-speed Internet access service provider causes a problem of making a huge capital investment to maintain the proper transmission speed. In addition, users who share an IP address through IP sharing (users who are not subscribed to the IP address, other than the IP address) can obtain anonymity while using the Internet. It is virtually impossible to regulate and crack down on illegal activities on the Internet, which hinders the development of a healthy Internet culture.

As for the problems caused by sharing an IP address as described above, the IP sharing solution company can solve the problem of IP address shortage using NAT (Network Address Transformation) technology developed for network security. In addition to NAT method, the temporary problem can be solved by CIDR method or Subnet method and ultimately solved when IPv6 is implemented. Therefore, it should be reviewed and solved by high speed internet service provider rather than IP sharing solution provider.

Accordingly, the present invention has been made to solve the above-described problems of the prior art, and the technical problem to be achieved by the present invention is to solve the problem caused by sharing an IP address in a conventional private network. To provide a system for monitoring the number of clients sharing IP addresses.

Another technical problem to be solved by the present invention is to provide a method for monitoring the number of clients sharing an IP address outside of a private network sharing an IP address, and to provide a computer-readable recording medium having recorded thereon. It is.

1 is a block diagram of a system for monitoring the number of IP sharing clients according to the present invention.

2 is a software module configuration diagram of a program mounted on the IP sharing monitoring means according to the present invention.

3 is a conceptual diagram illustrating the concept of fragmenting and transmitting an IP packet between a client and a server.

4 shows the format of an IP packet header according to RFC791 and RFC1122.

FIG. 5 is a conceptual diagram illustrating that when an IP is shared by clients in a private network, identification codes of IP packets are assigned to different groups for each of three clients.

6 is a conceptual diagram illustrating a principle of implementing a method for monitoring the number of IP sharing clients according to an embodiment of the present invention.

Figure 7 shows an embodiment of an algorithm that can be used in the method for monitoring the number of IP sharing clients according to the present invention.

8 illustrates another embodiment of an algorithm that may be used in the method for monitoring the number of IP sharing clients according to the present invention.

9 illustrates an embodiment of a network system including an IP sharing monitoring means according to the present invention.

The system for monitoring the number of IP sharing clients according to an aspect of the present invention for achieving the above technical problem is a system for monitoring the number of clients sharing IP in a private network, (a) a plurality of private networks Network management means for performing network connection management so that a client can communicate with a wide area network based on a TCP / IP protocol and collecting TCP / IP packets from the client; And (b) collecting the IP packets inputted to the network management means in parallel with the network management means, reading out the IP packet identification code contained in each IP packet, and time after time for each IP address to be monitored. And IP sharing monitoring means for comparing the successive IP packet identification codes with each other and calculating the number of identification code increment sets.

In the present invention, the IP sharing monitoring means includes a plurality of IP address groups grouped by a predetermined number so as to group IP addresses managed by the network management means to monitor IP sharing of the private network. It is preferable to connect in parallel.

In the present invention, the IP sharing monitoring means, comparing the consecutive identification code for each IP address to be monitored, each time the identification code reduction event occurs, the current identification code and the previous identification code on the basis of the occurrence of the reduction event It is possible to calculate the number of identification code increment sets by reflecting the IP in the IP share list assigned to the IP address to be monitored. At this time, the IP sharing monitoring means newly registers the current identification code and / or the previous identification code if the IP sharing list is empty, and if the IP sharing list is not empty, each of the recorded identification codes and Compared with each other, the identification code immediately before the recorded identification code with a large value is updated with the current identification code and / or the previous identification code.

In the present invention, the IP sharing monitoring means, in updating the identification code recorded in the IP sharing list by using the current identification code and the last identification code is recorded that the value is larger than the current identification code or the previous identification code If there is no identification code, it is preferable to update the identification code existing at the end of the IP sharing list to the current identification code or the immediately preceding identification code.

In the present invention, the IP sharing monitoring means, in updating the identification code recorded in the IP sharing list by using the current identification code and the last identification code, the current identification code or immediately preceding identification code in the first of the IP sharing list If the value is smaller than the included identification code, it is preferable to newly register the current identification code or the previous identification code before the first identification code of the IP sharing list.

In the present invention, the IP sharing monitoring means, the code between (last code value-ΔT) is assigned to the last identification code in the identification code value assignable section, which is a section of the value that can be assigned to the identification code, , If a code between (first code value + ΔT) is assigned as the current identification code, it is preferable not to reflect the current identification code or the immediately preceding identification code in the IP sharing list. In this case, the current identification code and the immediately preceding identification code are given by the client in which the operating system is loaded with the Windows 98 version of Microsoft Corporation, and ΔT may be 256.

In the present invention, the IP sharing monitoring means, even if the IP packet containing the previous identification code and the current identification code whose value is larger by ΔP than this value is transmitted out of order, even if the identification code reduction event is Even if it is generated, it is preferable not to reflect the current identification code or the previous identification code in the IP sharing list. In this case, the current identification code and the immediately preceding identification code are given by a client on which a Windows 98 version of a Microsoft company is installed, and ΔP may be an integer multiple of 256.

In the present invention, the IP sharing monitoring means, after newly registering or updating the current identification code in the IP sharing list, each identification code existing after the newly registered or updated identification code and If the remainder is 0 after applying the formula, it is preferable to delete the identification code existing after the newly registered or updated identification code to which the formula is applied from the IP share list.

[Equation 1]

[(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256

In the present invention, the IP sharing monitoring means, after newly registering or updating the previous identification code in the IP sharing list, each identification code existing after the newly registered or updated identification code and If the remainder is not calculated after applying the formula, it is preferable to delete the identification code existing after the newly registered or updated identification code to which the formula is applied from the IP share list.

[Equation 2]

[(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256

In the present invention, the IP sharing monitoring means calculates the number of clients sharing the corresponding IP address by referring to the IP sharing list for each IP address obtained at a current point in time at a predetermined period and sends the calculated information to the IP sharing monitoring server. It is desirable to make it database by sending. At this time, the IP sharing monitoring server performs socket communication with a subscriber server managing an IP address subscriber to query a database that stores user information for each IP address, and provides the user's personal information that has been agreed to use the shared IP address. An IP address for acquiring and then IP sharing; Number of clients sharing IP; User identification information assigned an IP address; And database the final monitoring time information.

According to another aspect of the present invention, there is provided a system for monitoring the number of IP sharing clients in a private network, the system comprising: (a) a plurality of private networks; (b) a number of clients sharing one IP in the private network; (c) IP sharing means for allowing the plurality of clients to share one IP; switching means for load balancing switching TCP / IP packets input and output in the plurality of private networks; (e) connection and management of the plurality of private networks by routing TCP / IP packets connected to the switching means and output from or input to the private networks to form a network interface with the wide area network; Network management means; And (f) collecting the IP packets inputted to the network management means in parallel with the network management means, reading out the IP packet identification codes contained in the respective IP packets, and time after time for each IP address to be monitored. And IP sharing monitoring means for comparing the successive IP packet identification codes with each other and calculating the number of identification code increment sets for each monitoring IP address.

In another aspect of the present invention, the IP sharing monitoring means compares consecutive identification codes for each IP address to be monitored, and each time an identification code reduction event occurs, the current identification code is based on a time point at which a reduction event occurs. The number of identification code increment sets can be calculated by reflecting the identification code immediately before and on the IP sharing list assigned to the IP address to be monitored. At this time, the IP sharing monitoring means newly registers the current identification code and / or the previous identification code if the IP sharing list is empty, and if the IP sharing list is not empty, each of the recorded identification codes and Compared with each other, the identification code immediately before the recorded identification code with a large value is updated with the current identification code and / or the previous identification code.

According to another aspect of the present invention for achieving the above technical problem, the monitoring system of the number of IP sharing clients, (a) a private network for IP sharing and TCP / IP packets output from the client of the end user is transmitted on the line A communication unit which receives the TCP / IP packet from a predetermined line connected in parallel; (b) a storage medium containing a program for monitoring an IP sharing client; (c) a memory in which work data is temporarily stored while the program is driven to perform a monitoring operation of an IP sharing client; And (d) When the IP sharing client monitoring request is made, the program stored in the storage medium is driven to read the identification code from successive IP packets with time after each monitoring target IP address, thereby increasing the number of identification code increasing sets for each IP address. A control unit for calculating a; characterized in that it comprises a.

In another aspect of the present invention, the control unit generates an IP share list for each monitoring target IP address in the memory, and then collects the IP packets inputted through the communication unit and stores the IP packets contained in the respective IP packets. After reading the identification code and storing it in the memory and comparing consecutive IP packet identification codes for each IP address to be monitored, each time a reduction event occurs, the current identification code and the immediately preceding identification code correspond to the reduction event occurrence time. The number of identification code increment sets can be calculated by reflecting on the IP share list of IP addresses. At this time, if the IP sharing list is empty, the control unit newly registers the current identification code and / or the immediately preceding identification code, and if the IP sharing list is not empty, compares with each of the recorded identification codes. The identification code immediately before the large recorded identification code is updated with the current identification code and / or the previous identification code.

The method for monitoring the number of IP sharing clients according to the present invention for achieving the above another technical problem is a method for monitoring the number of clients sharing IP in a private network, (a) TCP / IP transmitted from the client Collecting an IP packet for each monitoring target IP address through a communication unit connected in parallel to a line through which the packet is transmitted; And (b) reading the identification codes contained in the IP packets collected for each IP address, and comparing the successive identification codes over time to calculate the number of identification code increment sets. do.

In the present invention, the step (b), (b1) to create a processing queue in which the data to be processed is sequentially stored in the memory for monitoring the IP sharing list and the number of clients sharing IP for each monitoring target IP address Doing; (b2) The identification code and the IP address are read from each IP packet collected for each monitoring target IP address, and the continuous identification code of IP packets having the same IP address is continuously compared with each other, and the identification code increases and decreases. When an identification code reduction event occurs, matching the current identification code and the immediately preceding identification code with corresponding IP address information based on a time point at which the event occurs, and sequentially storing the identification code as a data node in the processing queue; And (b3) searching and specifying an IP share list while sequentially reading data nodes from the processing queue, and reflecting the current identification code and the immediately preceding identification code in the data node to the specified IP share list. At this time, if the specified IP sharing list is empty, the current identification code and / or the immediately preceding identification code is newly registered. If the specified IP sharing list is not empty, the value of the large IP value is compared with each of the recorded identification codes. The identification code immediately before the recorded identification code is updated with the current identification code and / or the identification code immediately before.

The other technical problem may be achieved by a computer-readable recording medium that includes a program and monitoring method for monitoring the number of IP sharing clients. Such recording media includes all types of recording media on which programs and data are stored so that they can be read by a computer system. Examples include ROM (Read Only Memory), RAM (Random Access Memory), Compact Disk (CD) -Rom, Digital Video Disk (DVD) -Rom, magnetic tape, floppy disk, hard disk, optical data storage device, and the like. have. In addition, these recording media can be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

DETAILED DESCRIPTION Hereinafter, the present invention will be described with reference to embodiments in order to specifically describe the present invention, and the present invention is described in detail with reference to the accompanying drawings. However, embodiments according to the present invention may be modified in many different forms, and the scope of the present invention should not be construed as being limited to the embodiments described below. Embodiments of the present invention are provided to more clearly and easily describe the present invention to those skilled in the art. Like reference numerals in the drawings refer to like elements.

1 schematically illustrates a system for monitoring the number of IP sharing clients according to an embodiment of the present invention.

Referring to FIG. 1, the monitoring system of IP sharing clients according to the present invention uses an IP sharing solution implemented in a private network 10 using an IP sharing means, for example, an IP sharing solution implemented by a router or software that performs an IP sharing function. This is for a system for monitoring the number of clients sharing the network outside of the private network (10).

More specifically, the monitoring system of the number of IP sharing clients is a large area network based on the TCP / IP protocol of the client of the normal user 20 who does not share IP with the clients belonging to a large number of IP sharing private network (10) Network management means (40) for performing network connection management to communicate with a wide area network (WAN) such as the Internet and collecting TCP / IP packets from the clients; It is connected in parallel with the network management means 40 to collect the IP packets input to the network management means 40 to extract the IP packet identification code contained in each IP packet, and continuously for each IP address to be monitored It includes; IP sharing monitoring means (50) to find the number of increasing number of IP identification code increase set to monitor the number of clients using the IP address.

In the present invention, the IP sharing monitoring means 50 is preferably connected in parallel to a position capable of acquiring all packets of the network to monitor and detect IP sharing. In addition, the IP sharing monitoring means 50 is an IP of a private network that performs IP sharing by grouping IP addresses managed by the network management means 40 in order to more efficiently monitor the number of clients sharing the IP address. Preferably, the network management means 40 is connected in parallel to a plurality of IP address groups grouped by a predetermined number so that sharing can be monitored. For example, when the network management means 40 manages a total of 100,000 IP addresses from IP addresses 211.187.000.000 to 211,187.100.000, IP sharing monitoring means according to the present invention connected in parallel to the network management means 40. 50 may be set to monitor 10,000 IP addresses, and a total of 10 IP sharing monitoring means 50 may be connected to the network management means 40 and operated in parallel.

The IP sharing monitoring means 50 is an embodiment for finding the number of IP identification code increase set for each IP address to be monitored in the IP packets collected from the network management means 40. Each consecutive IP identification code is compared with each other, and each time a reduction event of the identification code occurs, the current identification code and the previous identification code are added to the IP sharing list assigned to the IP address to be monitored based on the time when the reduction event occurs. Reflect. At this time, the IP sharing monitoring means 50 newly registers the current identification code and / or the previous identification code if the IP sharing list is empty, and each identification code recorded if the IP sharing list is not empty. Compared with each other, the identification code immediately before the recorded identification code with a large value is updated with the current identification code and / or the previous identification code.

In the present invention, the IP sharing monitoring means 50 is a kind of computer system in which a program designed to monitor the number of clients sharing IP in the private network 10 is mounted. More specifically, the IP sharing monitoring means 50 is a predetermined line connected in parallel to the line through which the TCP / IP packet output from the client of the private network 10 and the normal user 20 sharing the IP address is transmitted. A communication unit for receiving the TCP / IP packet from the network; A storage medium containing a program for monitoring a client sharing an IP address; A memory in which work data is temporarily stored while the program is driven to perform a monitoring operation of the number of IP sharing clients; When the IP sharing client monitoring request is received, the control unit which executes the program stored in the storage medium, reads the identification code from the IP packet collected through the communication unit, and calculates the number of incrementally increasing identification code sets for each monitoring target IP address. It includes;

In one embodiment of the present invention, the control unit calculates the number of continuously increasing identification code increments for each IP address to be monitored. After generating an IP sharing list for each IP address to be monitored in a memory, Collects IP packets inputted through the communication unit, reads out the IP packet identification code contained in each IP packet, stores them in the memory, compares consecutive IP packet identification codes for each IP address to be monitored, and then decreases the event. Each time is generated, the current identification code and the previous identification code are reflected in the IP sharing list of the corresponding IP address based on the time of occurrence of the reduction event. More specifically, the control unit newly registers the current identification code and / or the immediately preceding identification code if the IP sharing list is empty, and if the IP sharing list is not empty, each of the recorded identification codes and their values are different from each other. In comparison, the immediately preceding identification code having the larger value is updated with the current identification code and / or the previous identification code.

The technical idea that the IP sharing monitoring means 50 described above reflects the identification code in the IP sharing list in order to calculate the number of the identification code increase set included in the IP packet is merely an embodiment of the present invention. It will be apparent that various modifications and applications may be made by those skilled in the art to which the present invention pertains.

The program mounted on the IP sharing monitoring means 50 according to the present invention and performing a monitoring operation of the number of IP sharing clients may have a software module structure as shown in FIG. 2, according to an embodiment of the present invention. Thought is not limited to this.

More specifically, referring to FIG. 2, the program extracts an identification code from an IP packet collected through a communication unit 65 (for example, a network interface card), and continuously compares consecutive identification codes for each monitoring IP address, and then identifies the identification code. When the decrease occurs, generates an event and the current identification code on the basis of the time when the decrease event of the identification code is generated in the processing queue allocated to the shared memory area 60; Previous identification code; And an IP packet collection thread (70) configured to sequentially store data including the corresponding IP address into one data node and store the data. Data nodes sequentially stored in the processing queue are sequentially extracted in the order of their storage order to specify the IP share list allocated to the shared memory area 60 for each monitoring target IP address (refer to the IP address of the data node), and the current time point. An IP packet analysis thread (80) for reflecting the current identification code and / or the immediately preceding identification code of the data node processed in the specified IP share list; An IP address by analyzing IP sharing lists stored for each monitoring target IP address in the shared memory area 60 at regular intervals; Number of clients using (shared) an IP address; And an IP packet monitoring result transmission thread 100 that calculates a monitoring last time and transmits the IP packet monitoring result to the IP sharing monitoring server 90 through the network communication socket.

When the IP packet monitoring result transmission thread 100 transmits data to the IP sharing monitoring server 90, the IP sharing monitoring server 90 may provide the personal information (at least the subscriber's information) of the high-speed Internet subscriber that has agreed to use the IP address. Name; social security number / business registration number / or corporate registration number; address; and registered IP address information matched with each other) After inquiring, the IP sharing monitoring result is stored in the database 120 provided by itself. At this time, the IP sharing monitoring results are shared IP address; Number of clients; Identification information of a subscriber who has agreed to use the IP address; And monitoring final time information.

As described above, in the present invention, in monitoring the number of clients in the private network 10 used by the IP sharing monitoring means 50 sharing an IP address, the identification code contained in the IP packet is used. Therefore, before describing the technical idea according to the present invention in detail, the identification code contained in the IP packet will be described in detail with reference to FIGS.

In general, when the IP packet is exchanged between the client 130 and the server 140 through the Internet, the IP packet is segmented into an IP diagram and transmitted as shown in FIG. 3. At this time, since the fragmented IP packet is received at the client 130 or the server 140 and then needs to be recombined as an original, the transmitting party (server or client) starts with an initial value and starts identifying an identification code. Sequentially assigned fragmented IP packets. 3 illustrates an example in which the client 130 fragments the IP packet into three in transmitting the predetermined IP packet to the server 140 or the server 140 to the client 130, wherein the client 130 is fragmented. When fragmenting the IP packet and transmitting it to the server 140, 110 is increased by 1 with the start value of the identification code assigned to the fragmented IP packet, and the identification packet is transmitted to the fragmented IP packet, and the server 140 transmits the IP packet. In the case of fragmentation and transmission to the client 130, the number is increased by 1 with 3007 as a starting value, and the identification code is transmitted to the fragmented IP packet.

The unique identification code assigned to the fragmented IP packet is stored in a predetermined area of the IP header, that is, the identification code field (see I) as shown in FIG. The identification code contained in the identification code field (see I) of the IP header is a number uniquely set for each fragmented IP packet, and the identification code is used to identify that the fragmented IP packet belongs to a specific original IP packet. The IP header format shown in FIG. 4 is based on RFC 791 and RFC 1122. Since the ID code field allocated is 16 bits, the ID code assigned to the fragmented IP packet has a value from 0 to 65535. A range of values that can be assigned may be referred to as 'identification code value assignable section' in the following).

In the private network 10, each client sharing IP using a hardware IP sharer or a software IP sharing solution is not an exception. In the case of Internet communication, the IP packet is fragmented and each fragmented IP is used. You must give the packet a unique identification code. At this time, since the clients will sequentially assign an identification code to each fragmented IP packet, starting from one of 65536 different values (if the identification code field is 16 bits), the shared code is shared. By analyzing the identification codes contained in all fragmented IP packets transmitted from the private network 10 using the IP address to the outside, analyzing whether there are an increase group of several different identification field values, You can even find out how many clients are sharing your IP.

For example, as shown in FIG. 5, there are first to third clients 170a to 170b in the private network 10 sharing one IP address through the IP sharing means 160, and each client The first and second clients 170a through 170b are simultaneously communicating with the Internet based on the TCP / IP protocol, and the first client 170a starts from 3001; The second client 170b from 25600; Assume that the third client 170c transmits the identification code to the fragmented IP packet from 43200 and transmits it to the outside. In this case, IP fragmented using IP sharing monitoring means 50 according to the present invention on a transmission line capable of obtaining all the TCP / IP packets transmitted from the private network 10 outside the IP sharing means 160. After collecting the packet and analyzing the increase pattern of the identification code according to an embodiment of the present invention to be described later to find the number of the identification code increase set can be derived the number of clients sharing the IP address.

6 shows the number of sets of identification codes for a given IP address in order to find the number of clients sharing a predetermined IP address using the IP sharing means 160 in the private network 10 in the present invention. As a conceptual diagram schematically showing an embodiment of a calculation process, the process described with reference to FIG. 6 is commonly applied to all IP addresses to be monitored. In the following, with reference to Fig. 6, the IP sharing monitoring means 50 finds the number of identification code increment sets using the identification code of the fragmented IP packet and calculates the number of clients sharing the IP address. An embodiment of the present invention will be described in detail.

Referring to Fig. 6, identification codes extracted from fragmented IP packets sent out from predetermined monitoring target IP addresses are listed in the order of their extraction time. The IP monitoring means 50 compares all the identification codes in relation to each other in time, and then increases and decreases the identification codes so that an identification code decrease event occurs (see ①: 102 → 5; 104 → 53; 55 → 8). ), The current identification code and the immediately preceding identification code are configured as data nodes with corresponding IP addresses based on the time when the reduction event occurs, and are sequentially stored in the processing queue allocated to the memory (see ②).

Apart from the above process, the IP sharing monitoring means 50 reads the data nodes stored in the processing queue in the order in which they are stored, and refers to the IPs to be monitored by referring to the IP addresses in the data nodes for each read data node. From the IP share lists allocated to the memory for each address, the IP share list that should reflect the current identification code and / or the immediately preceding identification code in the read data node is specified (see ③). Then, it is determined whether there is a node previously stored in the specified IP sharing list, and if the node does not exist, the current identification code and / or the immediately preceding identification code are registered as a new node in the IP sharing list; If there is a node, the current identification code and / or the immediately preceding identification code are compared with the recorded identification code, and the current identification code or the previous identification code is updated at the node immediately before the recorded identification code with a large value. At this time, in the latter condition, that is, when the IP sharing list is not empty, the IP sharing list reflection principle that can be applied to the current identification code and the immediately preceding identification code as an embodiment is as follows.

[ General reflection principle ]

① Principle of Reflection 1

The identification code (current or previous identification code) to be reflected is sequentially compared with the identification codes already registered in the IP sharing list, and if an identification code larger than the identification code to reflect the value is found, immediately before the identification code Update the identification code of.

② Principle 2

The identification code (current or previous identification code) to be reflected is sequentially compared with the identification codes already registered in the IP sharing list, but the last node is found if the identification code whose value is larger than the identification code to be reflected is not found. Update the identification code in.

③ Principle of Reflection 3

If the identification code (current or previous identification code) to be reflected is smaller than the identification code of the minimum value in the first node among the identification codes already registered in the IP share list, insert the new identification code to be reflected in front of the first node. Register.

In Fig. 6, the general reflection principle described above by the identification code pair (the previous identification code and the current identification code pair) where the identification code reduction event occurs (102, 5), (104, 53), and (55, 8). Will be described in more detail below. The IP sharing monitoring means 50 extracts data nodes corresponding to the identification code pairs 102 and 5 among the data nodes in the processing queue from the processing queue. Next, the IP share list that should reflect the identification code is specified among the IP share lists allocated to the memory by referring to the IP address information among the data in the extracted nodes (here, the IP share list specified for convenience of explanation). Is assumed that no identification code is recorded before the identification code pair (102, 5) is reflected). Since there are no data nodes listed in the specified IP share list, the current identification code 5 and the previous identification code 102 are registered as new data nodes in the IP share list (see ④).

Subsequently, the IP sharing monitoring means 50 extracts the data node corresponding to the identification code pairs 104 and 53 from the processing queue, and then refers to the identification code pairs 104 and 53 by referring to the IP address information stored in the data node. The IP share list to reflect this is specified among the IP share lists allocated to the memory for each IP address to be monitored. Since the specified IP share list has an already registered identification code, the current identification code, the previous identification code and the previously registered identification code to be reflected at the present time are prepared.

Specifically, in the case of the previous identification code 104, when compared with the previously registered identification codes 5 and 102, since the value is not larger than the previous identification code 104, the identification code 102 at the last node is replaced. Update to 104 (applies to Principle 2: Apply ⑤)). In the case of the current identification code 53, since the value is larger than 5 and smaller than the identification code 104 compared with the previously registered identification codes 5 and 104, the identification code 5 in the node immediately before 104 is updated to 53. (Apply Principle 1: See ⑥).

Subsequently, the IP sharing monitoring means 50 extracts the data node corresponding to the identification code pairs 55 and 8 from the processing queue, and then refers to the identification code pairs 55 and 8 by referring to the IP address information stored in the data node. The IP share list to reflect this is specified among the IP share lists allocated to the memory for each IP address to be monitored. Since there are already registered identification codes 53 and 104 in the specified IP sharing list, the current identification code, the immediately preceding identification code, and the previously registered identification codes to be reflected at the present time are compared with each other.

Specifically, in the case of the previous identification code 55, the value of the previous identification code of 104 is updated to 55 since the value is smaller than 104 and greater than 53 when compared with the previously registered identification codes 53 and 104 (principle of principle). 1 Application: ⑦). In the case of the current identification code 8, since the value is the smallest in comparison with the identification codes 104 and 55 recorded in the IP sharing list, it is inserted and registered as a new node in front of the first node 55 (principle 3 applies). : See ⑧).

Through the above process, the IP sharing list is newly registered or updated, and according to the result, the number of nodes (corresponding to the increasing number of identification codes of the corresponding IP address) in the IP sharing list corresponds to the number of clients sharing IP. By increasing, it is possible to monitor and calculate the number of clients sharing the IP address through the IP sharing means 160 in the private network 10 through the number of nodes in the IP sharing list. In fact, in the identification codes of the IP packets shown in FIG. 6, although the order is reversed, three sets of identification codes assigned by three different clients, that is, (2,3,4,5,6,7,8) (9); (100, 101, 102, 103, 104); (53, 54, 55) are strictly included and the number of such identification code sets is determined by the IP sharing monitoring means 50 of the node in the IP sharing list according to one embodiment of the present invention. By reflecting the number, we can find out the number of clients sharing IP.

On the other hand, to reflect the current identification code and the immediately preceding identification code in the corresponding IP share list on the basis of the time when the identification code reduction event occurs to find the number of sets of identification code increase for each IP address to be monitored as described above In this case, the following exception handling should be considered.

[ Exceptions ]

①. Exception 1 and its treatment

For example, when the identification code field of the IP packet is 16 bits, a section between 0 and 65535 is a section to which an identification code can be assigned. Thus, even after a given client assigns an identification code 65535 to a fragmented IP packet, a situation may occur in which a fragmented IP packet to be transmitted next still remains, which gives a 0 to the next IP packet. In this case, the IP sharing monitoring means 50 generates an identification code reduction event (65535 → 0) while monitoring the IP packet. In this case, the identification code of the IP packet given by another client is not intervened. The identification code pair (65535, 0) is not reflected in the IP share list.

②. Exception 2 and its processing

If the operating system mounted on the client is Microsoft's Windows 98, when the operating system communicates with the Internet according to the TCP / IP protocol, when the identification code is assigned to the IP packet, the increment (ΔT) is not 1, that is, 256 The identification code is incremented by time and assigned to the IP packet (for example, 0. 256, 512 ...). Thus, the identification code has a value between (65535-ΔT: ΔT = 256 for Windows 98) and 65535, and the next consecutive identification code is 0 to (0 + ΔT: ΔT = 256 for Windows 98. A situation can be monitored that has a value between). In this case, the IP sharing monitoring means 50 generates an identification code reduction event while monitoring the IP packet. In this case, since the identification code of the IP packet given by another client is not intervened, the identification code pair (A , B) is not reflected in the IP share list (here, 65535-ΔT ≦ A ≦ 65535, 0 ≦ B ≦ 0 + ΔT, and ΔT = 256 when the operating system of the client is Windows 98).

③. Exception 3 and its handling

When the operating system mounted on the client is Microsoft's Windows 98, a client sharing IP may be assigned out of order instead of sequentially increasing the identification code (for example, 512, 256, and the like). 756 ...: The order of identification codes is reversed by experience and the specific reason is not explained here in detail). In this case, when the IP sharing monitoring means 50 monitors the identification code of the IP packet for the predetermined IP address, the identification code reduction event may be generated at the portion where the identification code is reversed (in the example, 512 → 256). have. However, even if an identification code reduction event occurs, this means that the identification code assigned by another client is not intervened, so that the current identification code and the previous identification code are applied to the IP share list based on when the identification code reduction event occurs. Do not reflect on the IP share list.

In the above-described embodiment, the IP sharing monitoring means 50 according to the present invention finds the number of ID code increasing sets of the IP packet. Conceptually, the general principles, exceptions, and treatments that can be applied to reflecting code in IP share lists are explained conceptually. Hereinafter, a process in which the identification codes are reflected in the IP sharing list will be described in more detail with reference to FIG. 7, which illustrates the process performed by the IP sharing monitoring means 50 as an algorithm. The algorithm according to FIG. 7 is based on the premise that a client whose operating system is Microsoft's Windows 98 among clients sharing IP is not limited to the technical idea according to the present invention. Therefore, the process that simply resides in that the operating system of the client is Windows 98 may be omitted when the time point at which Windows 98 is rarely used as the operating system of the client comes.

(One). Occurrence and Treatment of ID Code Reduction Events

As described above, the IP sharing monitoring means 50 compares the consecutive identification codes contained in the fragmented IP packets with respect to the IP addresses to be monitored and compares them with each other. Monitoring the increase / decrease status of the identification codes, and when the identification code increases and decreases and the identification code decrease event occurs, the data node along with the IP address information corresponding to the current identification code and the previous identification code based on the time when the event occurred It is stored in the processing queue. However, the IP sharing monitoring means 50 does not proceed with the process of adding or updating the data node including the identification code to the IP sharing list allocated to the memory for each IP address to be monitored unless the identification code reduction event occurs ( See S10).

(2). Extraction and identification code of data nodes in processing queue

The IP sharing monitoring means 50 processes separately from the step of sequentially storing the current identification code and the immediately preceding identification code as data nodes in the processing queue with the corresponding IP addresses based on the time when the identification code reduction event occurs in the processing queue. Check whether there is an event to be processed in the queue, that is, a data node (see S20). If there is a data node to be processed, the first data node stored among the data nodes stored in the processing queue is extracted (see S30). At this time, the data node has a current identification code on the basis of when the identification code reduction event occurs; Last identification code; And a corresponding IP address. Then, the IP sharing list allocated to the memory for each monitoring target IP address is searched and specified by referring to the IP address of the data node extracted at the present time and reflecting the current identification code and the immediately preceding identification code (S40). Reference).

(3). Determine if exception 3 occurred between identification codes when IP share list is empty

When the IP sharing list to reflect the identification code is specified, the IP sharing monitoring means 50 first checks whether the IP sharing list specified at the present time point is empty (see S50). If it is determined that the specified IP sharing list is not empty (see N in S50), the process branches to updating the node of the IP sharing list. However, if it is determined that the specified IP sharing list is empty (see Y in S50), it is checked whether the current identification code and the immediately preceding identification code correspond to exception 3 (see S60). This check can be done by subtracting the previous identification code from the current identification code and seeing if the difference is -256, -512 or -768, which is a negative integer multiple of 256. If the difference between the two identification codes is found to be one of -256, -512 or -768, which is a negative integer multiple of 256, then the two identification codes are the identification codes given by the client whose operating system is Windows 98, and the order of the identification codes is Branching the reporting process to S85 and registering either the current identification code or the previous identification code to the IP share list newly, and to the data node extracted from the processing queue at the present time. Terminate the process of reflecting the identification code in the IP share list.

(4). Determination of exception 1 and 2 occurrence between identification codes and reflection of IP sharing list of identification codes

If it is determined in S60 that exception 3 has not occurred between the current identification code and the immediately preceding identification code (see N in S60), then it is determined whether exceptions 1 and 2 have not occurred between the identification codes (see S70). If it is determined that exception 1 and 2 have not occurred between the identification codes, the current identification code and the immediately preceding identification code are included as data nodes in the IP sharing list specified at the present time, but the current identification code is higher than the previous identification code. Because it is small, it is newly registered and stored so as to be in a priority (see S80). However, if it is determined in S70 that exceptions 1 and 2 have occurred between the identification codes, either the current identification code or the previous identification code is included as a data node in the IP share list specified at the present time, and the processing queue is processed at the current time. The reflection process to the IP share list for the identification code in the extracted data node is terminated. Here, if the number of nodes included in the IP share list is calculated, the number of clients using the corresponding IP address can be calculated. If the number of nodes in the IP share list is 1, the ID code increment set is 1 because it is one. If the number of nodes in the IP share list is 2 or more, the IP address is set to 2 or more. Is being shared.

On the other hand, if the data node already exists in the IP sharing list to reflect the identification code as determined in S50, the process of updating the existing node or optionally adding a new node to the existing node IP sharing monitoring means ( 50), which will be described in detail below.

(6). Setting of identification code discriminator

As a result of determining whether the IP sharing list is empty in S50 to reflect the current identification code and the previous identification code extracted from the processing queue to the IP sharing list, one or more identification codes are already present in the IP sharing list specified at the present time. If it is determined that is stored in (see N in S50), IP sharing monitoring means 50 sets 0 (if 0 determines the identification code to be reflected in the IP sharing list as the previous identification code) to the identification code discriminator. (See S90). Then, the IP sharing monitoring means 50 checks whether the identification code discriminator is 0 (see S100). However, initially, since the value of the identification code discriminator is set to 0, the process proceeds to the next, and the IP sharing monitoring means 50 determines the identification code to be reflected in the IP sharing list at the current time point as the previous identification code (S110). Reference).

(7). Incorporate last identification code into IP share list

If the IP sharing monitoring means 50 determines the identification code to be reflected in the IP sharing list at the present time as the previous identification code, then exceptions 1 to 3 are generated between the current identification code and the previous identification code. Determine (see S120). If, as a result of the determination in S120, if an exception occurs in any one of the exceptions 1 to 3, the IP sharing monitoring means 50 and the current identification code extracted at the present time since the identification code should not be reflected in the IP sharing list. The reflection process to the IP share list for the last identification code is terminated.

However, if the exception 1 to 3 does not occur between the current identification code and the previous identification code as a result of the determination in S120, IP sharing monitoring means 50 sequentially extracts the identification code to be compared with the previous identification code from the IP sharing list (see S130). By comparing the values, the previous identification code is reflected in the IP sharing list according to the general principles 1 to 3 described above.

More specifically, the IP sharing monitoring means 50 first extracts the nodes from the IP sharing list sequentially in a predetermined order (see S130), and compares the extracted nodes with the immediately preceding identification codes to reflect the identification codes in general principles 1 to 3. Accordingly, the last identification code is reflected in the IP sharing list, but the following identification process is performed for each identification code of the node extracted from the IP sharing list to reflect the last identification code in the IP sharing list.

▶ When the ID code of the extracted node is the first node of the IP share list (see Y in S140)

If the immediately preceding identification code is smaller than the identification code of the first node (see Y in S150), the immediately preceding identification code is newly registered at the front of the IP sharing list. If the previous identification code is larger than the identification code of the first node (see N in S150), it is determined whether the number of nodes in the IP sharing list is 1 (see S170), and if it is 1 (see Y in S170), Update the identification code to the last identification code (see S180); If not 1 (see N in S170), the process returns to S130 after increasing the position of the node to be extracted from the IP share list by one.

▶ When the ID code of the extracted node is not the first node of the IP share list (see N of S140)

If the extracted node is not the first node of the IP share list (see N in S140), it is determined whether the immediately preceding identification code is smaller than the identification code of the extracted node (see S200), and if it is small (see Y in S200), the extracted node is extracted. Updating the identification code of the immediately preceding node of the node with the immediately preceding identification code (see S210); If it is not small (see N in S200), it is determined whether the extracted node is the last node of the IP share list (see S220). As a result of the determination in S220, if the extracted node is the last node (see Y in S220), the last node of the IP sharing list is updated with the last identification code (see S230); If the extracted node is not the last node (see N in S220), the process returns to S130 after increasing the position of the node to be extracted by one.

As described above, when the process of reflecting the last identification code to the IP sharing list by comparing the value of the last identification code with the value of the identification code stored in the node of the IP sharing list through S130 to S230 is terminated, the IP sharing monitoring means. 50 increases the value of the identification code discriminator by 1 (see S240) and returns the process to S100.

(8). Reflect current identification code to IP share list

As a result of the determination in S100, the IP sharing monitoring means 50 proceeds to S250 because the identification code discriminator at the present time is not zero. In S250, the IP sharing monitoring means 50 determines whether the identification code discriminator is less than 2 (see S250), and if it is small (the process is branched to S260 since the current identification code discriminator is 1), the IP sharing list at the present time. Determining the identification code to be reflected in the current identification code (see S260), and then proceeding in the same process to perform the previous identification code to reflect the IP sharing list; If it is not small (the identification code discriminator will be 2 after the current identification code is reflected in the IP sharing list), the process of reflecting the identification code extracted from the processing queue to the IP sharing list at this point is terminated.

(1) as described above. To (8). If the IP sharing monitoring means 50 continuously performs the node stored in the processing queue, the number of clients of the private network 10 sharing the IP address is added to the IP sharing list. (The number of nodes is the number of clients sharing the IP address).

On the other hand, in the above, after the value is set in the identification code discriminator, after checking whether exceptions 1 to 3 occurred between the current identification code and the immediately preceding identification code in S120, the current identification code and the immediately preceding identification code on the IP sharing list. The reflecting embodiment has been described. However, in some cases, as shown in FIG. 8, the S120 examines only whether an exception 1 has occurred between the current identification code and the immediately preceding identification code, and after the current identification code or the immediately preceding identification code is reflected in the IP sharing list, Exception 2 and Exception 3, caused by the operating system of Windows 98, can eliminate nodes that should not be reflected in the IP share list (called Windows 98 remnant nodes).

More specifically, referring to FIG. 8, after the current identification code or the immediately preceding identification code is reflected in the IP sharing list, the IP sharing monitoring means 50 is as follows for the identification code of each node existing after the updated node. The remainder is calculated by applying the same equation. If the remainder is 0, the node existing after the updated node to which the equation is applied is deleted from the IP share list.

[Equation]

[(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256. Here, identification code is assigned The last possible value is 65535 if the identification code is represented by 16 bits and the first value is 0.

The IP sharing monitoring system according to the present invention may be constructed and operated to be included in a network system as shown in FIG.

9, a network system equipped with an IP sharing monitoring system according to the present invention includes a plurality of private networks 200a and 200b; A plurality of clients 220a and 220b sharing one IP in the private networks 200a and 200b; A client 230 that normally uses an IP address separately from the private networks 200a and 200b; IP sharing means (210a and 210b) implemented in hardware or software to allow the plurality of clients (200a and 200b) to share a single IP; Switching means, for example, FES (240a and 240b: FAST ETHERNET SWITCH) for switching and load-balancing TCP / IP packets input and output from the plurality of private networks (200a and 200b) and the clients 230 of normal users; High-capacity switching means for load-balancing by switching TCP / IP packets input and output through a plurality of switching means, for example, GES 250 (Giga Bit Switch); The plurality of private networks are connected to the high-capacity switching means by routing a TCP / IP packet output from the plurality of private networks 200a and 200b or input to the private network to form a network interface with the Internet 260 which is a wide area network. Network management means, such as a router 270, for performing connection and management for the clients 200a and 200b of the user 230; IP sharing monitoring means 280 according to the present invention may be included.

The terms used to describe the embodiments of the present invention are used for the purpose of describing the present invention, but are not used to limit the scope of the present invention as defined in the claims or the claims.

According to one aspect of the present invention, the number of clients sharing an IP address can be monitored even without entering into a private network sharing the IP address.

According to another aspect of the present invention, by monitoring the number of clients in a private network sharing an IP address, by accurately calculating the number of illegal users who are not allowed to use the IP address and subscriber identity information of the shared IP address, On the basis of this, the IP address can be prevented from being illegally shared.

According to another aspect of the present invention, a culture in which only a legitimately licensed user uses an IP address is established, thereby contributing to the development of the Internet industry, and of course, stabilizing business when entering the high-speed Internet business overseas. To contribute.

According to another aspect of the present invention, by preventing users of IP sharing to perform illegal activities such as hacking on the Internet based on anonymity, it is possible to promote the healthy development of the Internet culture.

According to another aspect of the present invention, the IP sharing monitoring result data can be used as a basic data when analyzing the business feasibility of the high-speed Internet business, and can be used as a data development product for diversifying the rate of high-speed Internet access products.

Claims (33)

For a system that monitors the number of clients sharing IP within a private network, (a) A network that manages network connection so that clients constituting a plurality of private networks can communicate with a wide area network based on the TCP / IP protocol and collects TCP / IP packets from the clients. Management means; And (b) collects IP packets inputted to the network management means in parallel with the network management means, reads out the IP packet identification code contained in each IP packet, and advances the time after each IP address to be monitored; And IP sharing monitoring means for comparing the successive IP packet identification codes with each other and calculating the number of identification code increment sets according to a change pattern of the identification code. The method of claim 1, The IP sharing monitoring means compares successive identification codes for each IP address to be monitored, and monitors the current identification code and the immediately preceding identification code on the basis of the occurrence of the reduction event whenever an identification code reduction event occurs. A system for monitoring the number of IP sharing clients, characterized in that reflected in an IP sharing list assigned to an IP address. The method of claim 2, The IP sharing monitoring means registers the current identification code and / or the immediately preceding identification code if the IP sharing list is empty, and compares each identification code recorded if the IP sharing list is not empty. The system of monitoring the number of IP sharing clients, characterized by updating the identification code immediately before the identification code having a large value to the current identification code and / or the previous identification code. The method of claim 1, The IP sharing monitoring means may be connected in parallel to the network management means in plural number of IP address groups grouped by a predetermined number so as to monitor IP sharing of the private network by grouping IP addresses managed by the network management means. Features monitoring system of IP sharing clients. The method of claim 3, The IP sharing monitoring means, in updating the identification code recorded in the IP sharing list by using the current identification code and the immediately preceding identification code, there is no recorded identification code whose value is larger than the current identification code or the previous identification code. Otherwise, the identification code existing at the end of the IP sharing list is updated with the current identification code or the previous identification code. The method of claim 3, The IP sharing monitoring means uses the current identification code and the immediately preceding identification code to update the identification code recorded in the IP sharing list. And if the value is small, newly register the current identification code or the previous identification code before the first identification code of the IP sharing list. The method of claim 3, In the IP sharing monitoring means, a code between (last code value-ΔT) is assigned to the immediately preceding identification code in an identification code value assignable section, which is a section of values that can be assigned as an identification code, and the first code value. + (DELTA) T) is assigned as the current identification code, the system for monitoring the number of IP sharing clients, characterized in that the new node is not registered in the IP sharing list. The method of claim 7, wherein The current identification code and the immediately preceding identification code are given by a client equipped with a Windows 98 version of Microsoft Corporation, and ΔT is 256. The system for monitoring the number of IP sharing clients. The method of claim 3, The IP sharing monitoring means, if the IP packet containing the previous identification code and the current identification code whose value is larger by ΔP than this value is transmitted out of order, even if the identification code reduction event occurs, the IP sharing list The system of monitoring the number of IP sharing clients, characterized in that not newly registered in the current identification code or the previous identification code. The method of claim 9, Wherein the current identification code and the immediately preceding identification code are assigned by a client on which a Windows 98 version of Microsoft Corporation is installed, and ΔP is an integer multiple of 256. The method of claim 3, The IP sharing monitoring means, after newly registering or updating the current identification code in the IP sharing list, after applying each of the identification code existing after the newly registered or updated identification code and the following equation (1) Is 0, the identification code existing after the newly registered or updated identification code to which the formula is applied is deleted. [Equation 1] [(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256 The method of claim 3, The IP sharing monitoring means, after newly registering or updating the previous identification code in the IP sharing list, after applying each identification code existing after the newly registered or updated identification code and the following equation (2) If is not calculated, the identification code existing after the newly registered or updated identification code to which the formula is applied, the monitoring system of the number of IP sharing clients, characterized in that for deleting from the IP sharing list. [Equation 2] [(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256 The method of claim 1, The IP sharing monitoring means can be databaseized by calculating the number of clients sharing the corresponding IP address with reference to the IP sharing list for each IP address obtained at a current point in time and transmitting the calculated information to the IP sharing monitoring server. System for monitoring the number of IP sharing clients. The method of claim 13, The IP sharing monitoring server performs socket communication with a subscriber server that manages an IP address subscriber, and inquires a database storing user information for each IP address to obtain user profile information that has been agreed to use the shared IP address. An IP address for IP sharing; Number of clients sharing IP; User identification information assigned an IP address; And a final monitoring time information database. For a system that monitors the number of clients sharing IP within a private network, (a) multiple private networks; (b) a number of clients sharing one IP in the private network; (c) IP sharing means for allowing the plurality of clients to share one IP; switching means for load balancing switching TCP / IP packets input and output in the plurality of private networks; (e) connection and management of the plurality of private networks by routing TCP / IP packets connected to the switching means and output from or input to the private networks to form a network interface with a wide area network; Network management means; And (f) Collecting IP packets inputted to the network management means in parallel with the network management means, reading out the IP packet identification code contained in each IP packet, and successive IP packets for each IP address to be monitored. And IP sharing monitoring means for comparing the identification codes with each other and calculating the number of sets of identification code increments for each monitoring IP address according to a change pattern of the identification code. The method of claim 15, The IP sharing monitoring means compares successive identification codes for each IP address to be monitored, and monitors the current identification code and the immediately preceding identification code on the basis of the occurrence of the reduction event whenever an identification code reduction event occurs. A system for monitoring the number of IP sharing clients, characterized in that reflected in an IP sharing list assigned to an IP address. The method of claim 16, The IP sharing monitoring means registers the current identification code and / or the immediately preceding identification code if the IP sharing list is empty, and compares each identification code recorded if the IP sharing list is not empty. The system of monitoring the number of IP sharing clients, characterized by updating the identification code immediately before the identification code having a large value to the current identification code and / or the previous identification code. (a) a communication unit for receiving the TCP / IP packet from a predetermined line connected in parallel to a line through which a TCP / IP packet outputted from a private network and an end user client sharing IP is transmitted; (b) a storage medium containing a program for monitoring a client sharing IP; (c) a memory in which work data is temporarily stored while the program is driven to perform a monitoring operation of an IP sharing client; And (d) When an IP sharing client monitoring request is made, the program stored in the storage medium is run to read the identification code from successive IP packets with time after each monitoring target IP address and compare the IP packet identification codes with each other. And a control unit for calculating the number of identification code increment sets for each IP address according to a change pattern of the IP sharing client. The method of claim 18, After generating the IP sharing list for each monitoring target IP address in the memory, the controller collects the IP packets inputted through the communication unit, reads out the IP packet identification code contained in each IP packet, and stores them in the memory. After comparing consecutive IP packet identification codes for each IP address to be monitored, each time a reduction event occurs, the current identification code and the immediately preceding identification code are reflected in the IP sharing list of the corresponding IP address based on the time when the reduction event occurs. The monitoring system of the number of IP sharing clients, characterized in that. The method of claim 19, If the IP sharing list is empty, the controller newly registers the current identification code and / or the immediately preceding identification code. If the IP sharing list is not empty, the controller compares each identification code recorded with a larger value. The system of monitoring the number of IP sharing clients, characterized in that for updating the identification code immediately before the recorded identification code with the current identification code and / or immediately before the identification code. How to monitor the number of clients sharing IP in a private network, (a) collecting IP packets for respective monitoring target IP addresses through a communication unit connected in parallel to a line through which TCP / IP packets transmitted from a client are transmitted; And (b) reading the identification codes contained in the IP packets collected for each IP address, comparing successive identification codes with each other over time, and calculating the number of identification code increment sets according to a change pattern of the identification code; The monitoring method of the number of IP sharing clients, characterized in that it comprises. The method of claim 21, wherein step (b) (b1) generating a processing queue in memory to sequentially store data to be processed for monitoring the IP sharing list and the number of clients sharing IP for each monitoring target IP address; (b2) The identification code and the IP address are read from each IP packet collected for each monitoring target IP address, and the continuous identification code of IP packets having the same IP address is continuously compared with each other, and the identification code increases and decreases. When an identification code reduction event occurs, matching the current identification code and the immediately preceding identification code with corresponding IP address information based on a time point at which the event occurs, and sequentially storing the identification code as a data node in the processing queue; And (b3) searching and specifying an IP share list by sequentially reading the data nodes from the processing queue and reflecting the current identification code and the immediately preceding identification code present in the data node to the specified IP sharing list; How to monitor the number of IP sharing clients. The method of claim 22, If the specified IP sharing list is empty, newly register the current identification code and / or the immediately preceding identification code. If the specified IP sharing list is not empty, the identification code containing the larger value is compared with each of the listed identification codes. And updating the immediately preceding identification code with the current identification code and / or the immediately preceding identification code. The method of claim 23, wherein In updating the identification code recorded in the IP sharing list by using the current identification code and the immediately preceding identification code, if there is no recorded identification code whose value is larger than the current identification code or the previous identification code, Monitoring the number of IP sharing clients, wherein the existing identification code is updated with the current identification code or the previous identification code. The method of claim 23, wherein In updating the identification code recorded in the IP sharing list by using the current identification code and the immediately preceding identification code, if the value of the current identification code or the previous identification code is smaller than the identification code recorded in the first part of the IP sharing list, the IP sharing list. And registering the current identification code or the previous identification code before the first identification code of the IP sharing client. The method of claim 23, wherein In the identification code value assignable section, which is the section of the value that can be assigned as the identification code, a code between (last code value-ΔT) is assigned as the previous identification code, and a code between (first code value + ΔT) is Monitoring the number of IP sharing clients, wherein the new node is not registered in the IP sharing list if the current identification code is assigned. The method of claim 26, Wherein the current identification code and the immediately preceding identification code are assigned by a client in which an operating system is installed with a Windows 98 version of Microsoft Corporation, and ΔT is 256. The method of claim 23, wherein If an IP packet containing a previous identification code and a current identification code larger than ΔP by this value is sent out of order, the new node is not registered in the IP share list even if an identification code reduction event occurs. The method of monitoring the number of IP sharing clients, characterized in that. The method of claim 28, Wherein the current identification code and the immediately preceding identification code are assigned by a client on which a Windows 98 version of Microsoft Corporation is installed, and ΔP is an integer multiple of 256. The method of claim 23, wherein After applying the current identification code to the IP share list, after applying the respective identification code and the following calculation code such as Equation 3 below the reflected identification code, if the remainder is 0, the identification code existing after the reflected identification code is applied The method of monitoring the number of IP sharing clients, characterized in that to delete from the IP sharing list. [Equation 3] [(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256 The method of claim 23, wherein After applying the previous identification code to the IP share list, after applying each identification code existing after the reflected identification code and a calculation formula such as Equation 4 below, if the remainder is not calculated, the identification existing after the reflected identification code to which the calculation formula is applied A method for monitoring the number of IP sharing clients, characterized in that the code is deleted from the IP sharing list. [Equation 4] [(Identification code existing after newly registered or updated identification code + last value of value to which identification code can be assigned-initial value)-newly registered or updated identification code] / 256 The method of claim 21, Calculate the number of clients using the IP address for each IP address to be monitored at regular intervals, and search the database where the subscriber's personal information is matched and stored for each IP address to search the database for each IP address monitored. And matching the database with the personal information of the subscriber to which the IP address has been assigned. A computer-readable recording medium that records and programs a method for monitoring the number of IP sharing clients according to any one of claims 15 to 24.