KR101472737B1 - Apparatus for performing packet bypass through fault detection of an in-line equipment and the method thereof - Google Patents

Abstract

The present invention relates to an apparatus for bypassing a packet through detecting malfunction of in-line equipment and a method thereof. More specifically, in order to solve the typical problem of a service being interrupted when an application program of in-line equipment is down because the state of the application program of the in-line equipment cannot be identified at an existing bypass switch, the number of packets, which is inputted and outputted to/from the application program of the in-line equipment, is counted, and the inputted and outputted packet is bypassed when malfunction occurs in the application program of the in-line equipment, thus, the packet loss is prevented, making the network service smooth.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a packet bypass apparatus and a packet bypass apparatus,

[0001] The present invention relates to a packet bypass apparatus and method for detecting failure of an in-line apparatus, and more particularly, to a packet bypass apparatus and a method thereof for monitoring an in- The present invention relates to an apparatus and method for detecting occurrence of a failure.

A communication network has a function of allowing a plurality of devices (or nodes) to be connected to an electric or optical line to exchange various information. The device is an important network resource, and each device has a capacity to process. Therefore, a bottleneck occurs when an attempt is made to transmit an excessive amount of information in comparison with the performance of each device. In recent years, attacks on various types of communication network resources have led to the loss of both type and type. The traffic bottleneck caused by such an attack causes the communication network to be slowed down or suspended, and the service speed is suddenly slowed down or aborted, resulting in a loss.

In order to prepare for such a loss, it is necessary to install equipment in-line between network equipments in order to prepare for DDoS (Distributed Denial of Service) attacks and guarantee QoS (Quality of Service). The reason for this inline equipment is to allow all traffic to pass through in-line equipment, enabling control after analysis.

However, in-line equipment has a problem that the service can be stopped by itself due to hardware and software failure. In particular, in-line equipment is expensive and performs high-speed and complex functions to handle analytical and control functions, which can cause equipment to go down. In other words, in-line equipment is used to improve the quality of service, but the equipment may cause the service to be interrupted.

In order to solve this problem, conventionally, a bypass switch is used to receive a heartbeat signal from an in-line equipment even when an in-line equipment fails, thereby bypassing the traffic so that the service is not interrupted.

Because inline equipment is implemented using equipment such as a PC server, it is largely implemented as an application program on top of the operating system. Since the heartbeat uses the bridge function among the communication functions of the operating system, the operating system operates normally and can not detect when the actual application program is down. That is, if the application program is down, the service is stopped. However, since the heartbeat signal is sent from the operating system of the inline device, the inline device may not recognize that the inline device has failed.

In addition, since in-line equipment and bypass switch manufacturing companies are different from each other, it is difficult to add a program for notifying the outside of the occurrence of a failure in the application program of the in-line equipment manufactured by other companies, It is difficult to bypass the packet due to a failure of the equipment.

It is an object of the present invention to provide an apparatus and method for bypassing an input / output packet by sensing whether an application program of an inline device is down in a bypass switch.

The present invention has been made in order to solve the above problems, and it is an object of the present invention to provide a method and apparatus for analyzing input / output packets of an in-line device without direct assistance of the in- And to provide a method and a method for bypassing input / output traffic.

In a bidirectional communication network according to an exemplary embodiment of the present invention, a bypass switch for bypassing an input / output packet when a failure occurs and detects an in-line failure may include a packet input from one network device, A first packet counter to count; And a second packet counter input from the inline device and counting packets output to the other network device; A third packet counter that counts packets input from the other network device and output to the inline device; And a fourth packet counter input from the inline device and counting packets output to the one network device, wherein a heartbeat is generated using the values of the first packet counter and the second packet counter, To detect whether a failure has occurred in the application program of the in-line equipment or to generate a self-heartbeat by further using the values of the third packet counter and the fourth packet counter to determine whether an in- . Also, in the packet bypass apparatus through fault detection of the in-line equipment, the self-heartbeat accumulates the values of the first packet counter and the second packet counter for a predetermined first reference time, The difference between the counter and the second packet counter is greater than a predetermined first reference value is greater than a predetermined first reference number; Accumulates the values of the third packet counter and the fourth packet counter for a predetermined second reference time and determines whether the difference between the third packet counter and the fourth packet counter is greater than a predetermined second reference value The first reference time, the second reference time, the first reference value, the second reference value, the first reference time, and the second reference time, if the first reference time and the second reference time are greater than a predetermined second reference time, The two reference times may be set to be different from each other or set to be the same.

A method for bypassing an input / output packet when a failure occurs in a bidirectional communication network according to another exemplary embodiment of the present invention detects failure of an inline device, A first packet counting step of counting; A second packet counting step of counting packets input from the inline equipment and output to another network equipment; A third packet counting step of counting packets input from the other network equipment and output to the inline equipment; And a fourth packet counting step of counting packets input from the inline equipment and output to the network equipment of the one side, wherein the first packet counting step and the second packet counting step count A heartbeat is generated to detect whether a failure has occurred in the application program of the in-line device, or a self-heartbeat is generated by further using the values counted in the third packet counting step and the fourth packet counting step, The control unit detects whether or not a fault has occurred.

[0001] The present invention relates to a packet bypass apparatus and method for detecting failure of an in-line apparatus, and more particularly, to a packet bypass apparatus and method thereof, So that it is possible to repair and replace the inline equipment without disconnecting the link. In particular, when the operating system of the in-line equipment is in operation or down in the application program, that is, when the in-line equipment can not be detected by the heartbeat signal from the in-line equipment, it analyzes the input / output traffic of the in- And bypasses the input / output traffic, thereby preventing a situation in which the service is interrupted between the network devices.

FIG. 1 is a diagram for explaining a concept of bypassing an input / output packet when a failure occurs in the in-line equipment in a bypass switch and an in-line equipment provided between network equipment according to the related art.
BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a method and apparatus for bypassing input /
3 is a diagram for explaining a concept for bypassing input / output traffic when a fault is detected in an application program of an in-line equipment according to an embodiment of the present invention;
FIG. 4 is a diagram for explaining a concrete fault detection method for an application program of an in-line equipment according to an embodiment of the present invention and a concept for bypassing input / output traffic at the time of sensing.
5 is a flowchart illustrating a method of detecting a failure of an inline device by analyzing (counting) input / output packets of an inline device according to an embodiment of the present invention.

Hereinafter, an embodiment of a packet bypass apparatus and method according to the present invention will be described with reference to the accompanying drawings.

FIG. 1 is a block diagram for explaining a concept of bypassing an input / output packet when an in-line equipment fails in a bypass switch and an in-line equipment provided between network devices according to the related art. And may include a router 100, a bypass switch 200, an in-line device 300, and a switch 400, as shown in FIG.

The router 100 and the switch 400 correspond to representative network equipment and an in-line equipment 300 is provided between the router 100 and the switch 400 to analyze a packet transmitted and received between the router and the switch, If the packet causes false traffic, it removes it. At this time, the in-line equipment 300 is added to remove packets that cause undesired traffic among the network equipment, but the in-line equipment may rather fail to cause packet transmission failure. In order to prevent this, bypass switch is set to bypass the packet when the in-line device is detected to be in failure, so that the network operates normally.

The bypass switch 200 has interface ports of the NET-A 210 and the NET-B 220 on the network equipment side and the interfaces of the IN-1 250 and the IN- Port. The bypass switch 200 may further include an optical switch 230 and an ASIC (CPU) 240.

The functions of the bypass switch 200 include a plug and play method that does not require any setting at the time of installation, a failure detection function for automatically detecting faults such as power, link, and software of an inline device, Active status, traffic Utilization, and traffic statistics using active devices that send and receive heartbeat packets, heartbeat methods that can be modified by users, traffic statistics using Telnet and HTTP, Operation modes, and all ports capable of transmitting and receiving 64 ~ 1518 Byte packets without loss. In the case of the built-in bypass switch 200, the FOD function is applied to the in-line equipment (firmware (F / W), intrusion prevention system (IPS), anti-DDoS, web application firmware (F / W) Even if it is included, there is a tendency to introduce an external bypass switch to ensure the stability of the network.

The NET-A 210 and the NET-B 220 connect the router 100 and the switch 400 as a communication port. If the power switch 230 is not suddenly supplied with power, (Passive Bypass) mode in which the transmission is performed.

The ASIC (CPU) 240 transmits a heartbeat to the in-line equipment and confirms whether the in-line equipment has failed in the form of confirming the heartbeat received from the in-line equipment. If a failure of the in-line equipment is detected through the heartbeat The active bypass mode is activated, and the input / output packet is bypassed. The IN-1 250 and the IN-2 260 are communication ports connected to the in-line equipment 300.

The function of the inline device 300 is to control the packet. The packet analysis is performed and the result is controlled. The bypass device performs a function of bypassing the in-line equipment 300 and allowing the packet to flow normally when the in-line equipment 300 fails.

FIG. 2 is a block diagram for explaining a concept for bypassing input / output traffic when failure detection of an inline device due to a heartbeat according to the related art. As shown in the figure, when the inline device is detected as having a failure through the heartbeat, the active bypass mode is performed, and the detection is performed by the operating system (bridge function).

The operating system 310 performs a bridge function, receives the heartbeat packet from the bypass switch 200, and returns the received heartbeat packet to the bypass switch 200. If an in-line device fails, the I / O packet is directly bypassed without going through the inline device. If the in-line device is normal, the I / O packet is bypassed to the inline device 300. However, in the case of the conventional technology, if an application program of the inline equipment fails, the failure is not detected. The application program 320 analyzes and controls input / output packets in the in-line equipment 300. Accordingly, even if the application program is down, the heartbeat is transmitted through the operating system 310, so that the service can be notified normally. That is, there is a problem that the state of the in-line equipment 300 may be misrecognized.

3 is a block diagram for explaining a concept for bypassing input / output traffic when a fault is detected in an application program of an in-line equipment according to an embodiment of the present invention. As shown in the figure, W1 241, W2 242, E1 243, and E2 244 are input / output ports through which the ASIC transmits and receives data. The packet path of the bidirectional communication is the application 320 program of the inline device 300 and the application program 320 of the inline device 300 when W1 -> W2 -> W2 -> W1 -> W2 -> W1 - > E2 -> E1, we can see that the actual I / O packet goes through the inline device application program.

Therefore, it is impossible to monitor packets in the area passing through the application program with the heartbeat according to the prior art.

Although there may be a difference depending on the characteristics of the inline device 320, there may be a packet dropping due to the analysis and control of the packet input / output through the inline device. However, if the entire packet is repeatedly dropped over a long period of time The case is very unusual and almost impossible to occur.

4 is a block diagram for explaining a concrete fault detection method for an application program of an inline device according to an embodiment of the present invention and a concept for bypassing input / output traffic at the time of sensing. As shown in the figure, the WC1 245 and the EC2 248 are input counters for counting packets input from the network equipment to the bypass switch 200. The WC2 246 and the EC1 247 are connected to the bypass switch 200, Is an output counter for counting packets output from the network device 200 to the network equipment.

For example, the difference between the input counter value of WC1 245 and EC2 248 and the output counter value of EC1 247 and WC2 246 in the ASIC (CPU) 240 is calculated and compared with the user-specified values D1 and D2 If it is small, it is possible to control the in-line device 300 to pass through the input / output packet, and otherwise control the input / output packet to be bypassed. Here, the values of D1 and D2 may be the same or different and may be set according to the judgment of the user.

FIG. 5 is a flowchart illustrating a method of detecting a failure of an inline device by analyzing (counting) input / output packets of an inline device according to an embodiment of the present invention. As shown in the figure, when the in-line equipment 300 is connected between the network equipment through the bypass switch 200 to perform bidirectional communication, the ASIC (CPU) 240 sets a counter value The input / output counter values WC1 245, WC2 246, and EC1 247 are initialized to 0 (positive integer), which is the number of times when the user exceeds the values (D1, D2) (Step S102), and outputs the packet counter value WC1 (245), which is input from the router 100 serving as one network equipment, to the switch 400 which is another network equipment A packet counter value EC2 248 inputted from a switch 400 which is the other side network equipment and a packet counter value EC2 248 outputted to a router 100 serving as a network equipment of the other side, (S103), the user's designated d (S104). After accumulating the counter values, if the difference values WC1 EC1 and EC2 WC2 of the counter values are larger than D1 and D2 respectively designated by the user (S105), the number of times is accumulated (S106) , And if the number of times is larger than the number of times designated by the user (n), bypass S108 is performed. If T is smaller than d, the check of the time interval T for counting the input / output counter values WC1 245, WC2 246, EC1 247, and EC2 248 continues.

When the difference values of the counter values WC1 EC1 and EC2 WC2 are smaller than D1 and D2 respectively designated by the user, the input / output counter values WC1 245, WC2 246, EC1 247 and EC2 248 are counted The time interval T is initialized and a check is made of the time interval T for counting the input / output counter values WC1 245, WC2 246, EC1 247 and EC2 248 during the time interval d.

When N is smaller than n designated by the user (S107), a time interval T counting the input / output counter values WC1 245, WC2 246, EC1 247, and EC2 248 is initialized. A check is made of the time interval T for counting the input / output counter values WC1 245, WC2 246, EC1 247 and EC2 248, and then the number of times N is accumulated (S106).

Here, D1 and D2 may be designated as the same value or different values, and the values of d and n may be set to values predetermined by the user.

This procedure solves the problem of not detecting the failure of the application program of the inline device 300, which has been a problem in the related art, thereby preventing the network service from being interrupted, thereby making the network service more smooth.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I will understand the point. Accordingly, the technical scope of the present invention should be defined by the following claims.

100: Router 200: Bypass switch
230: Optical switch 240: ASIC (CPU)
300: inline equipment 310: operating system (bridge function)
320: Application program

Claims (10)

A bypass switch for bypassing an input / output packet when a failure occurs in a bidirectional communication network by detecting a failure of an in-line equipment,
A first packet counter for counting packets input from one network device and output to the inline device; And
And a second packet counter input from the inline device and counting packets output to the other network device,
Detecting a failure of the application program of the in-line equipment by generating a heartbeat of itself using the values of the first packet counter and the second packet counter,
Wherein the self heartbeat accumulates the values of the first packet counter and the second packet counter for a predetermined first reference time so that the difference between the first packet counter and the second packet counter is smaller than a predetermined value And detects that a fault has occurred in the application program of the in-line equipment, if the number of times that the number of times is larger than one reference value is larger than a predetermined first reference number of times. The method according to claim 1,
A third packet counter that counts packets input from the other network device and output to the inline device; And
And a fourth packet counter input from the inline device and counting packets output to the one network device,
Wherein the first packet counter and the fourth packet counter are further used to generate a self heartbeat to detect whether an error has occurred in the application program of the inline device. Bypass device. delete The system of claim 2, wherein the self-
Accumulates the values of the third packet counter and the fourth packet counter for a predetermined second reference time and determines whether the difference between the third packet counter and the fourth packet counter is greater than a predetermined second reference value Wherein the inline device detects that a failure has occurred in the application program of the in-line equipment if the number of times of the in-line equipment is greater than a predetermined second reference number. The method of claim 4,
Wherein the first reference time and the second reference time, the first reference value and the second reference value, and the first reference time and the second reference time may be set to be different from each other or set to be the same. A packet bypass device through sensing. A method for bypassing an input / output packet when a failure occurs by detecting a failure of an inline device in a bidirectional communication network,
A first packet counting step of counting packets input from one network equipment and outputted to the inline equipment; And
And a second packet counting step of counting packets input from the inline device and output to another network device,
The method comprising: generating an internal heartbeat using the counted value in the first packet counting step and the second packet counting step to detect whether a failure has occurred in the application program of the inline device,
Wherein the self heartbeat is generated by accumulating the value counted in the first packet counting step and the second packet counting step for a predetermined first reference time and determining whether the difference value between the first packet counter and the second packet counter Wherein the inline device detects that an error has occurred in the application program of the in-line device if the number of times larger than a predetermined first predetermined reference value is greater than a predetermined first predetermined number of times. The method of claim 6,
A third packet counting step of counting packets input from the other network equipment and output to the inline equipment; And
And a fourth packet counting step of counting packets input from the inline equipment and output to the one network equipment,
Counting the third packet counting step and the fourth packet counting step to generate a self-heartbeat to detect whether a failure has occurred in the application program of the in-line equipment. A method of packet bypassing through detection. delete The method of claim 7, wherein the self-
Counts the values counted in the third packet counting step and the fourth packet counting step for a predetermined second reference time, and calculates a difference between the third packet counter and the fourth packet counter by a predetermined second reference value And if it is determined that a larger number of times is greater than a predetermined second predetermined number of times, it is detected that a failure has occurred in the application program of the in-line equipment. The method of claim 9,
Wherein the first reference time and the second reference time, the first reference value and the second reference value, and the first reference time and the second reference time may be set to be different from each other or set to be the same. A method of packet bypassing through detection.

Images