KR101626279B1 - Apparatus and method of traffic storage, and computer-readable recording medium - Google Patents

Abstract

The method comprising: storing traffic data in a first virtual receive buffer designated by a first thread; activating a second thread waiting when a thread switch trigger occurs; and transmitting traffic data to a second virtual receive buffer designated by a second thread And storing traffic data stored in a first virtual receiving buffer in a hard disk designated by a first thread among a plurality of hard disks, wherein the traffic data is distributed to a plurality of hard disks .

Description

TECHNICAL FIELD [0001] The present invention relates to a traffic storing apparatus and method, and a computer readable recording medium.

And more particularly, to a traffic storing apparatus and method for efficiently storing traffic.

As the kinds of network related technologies and network related services become more diverse, the utilization range of the network becomes enormous and the network environment becomes complicated.

In addition, due to the development of information and communication technology, the introduction of various multimedia services has complicated the network, and the network and the service are integrated, and the traffic types are diversified.

Also, the introduction of high-quality communication services has caused unpredictable traffic, making traffic patterns more difficult to predict. When the problem of rapid increase of traffic and deterioration of the network due to this occurs, information about the traffic of the network is needed to analyze and improve the cause of the performance degradation.

In addition, various studies for improving the security of the network, such as network security policies or network forensics, are being conducted based on traffic patterns.

As described above, for stable and efficient management of the network, it is necessary to store the traffic generated in the network and analyze the pattern of the traffic based on the stored traffic.

However, due to the slow storage speed of an auxiliary storage device such as a hard disk, it is difficult to store all the network traffic of 1 Gbps or more.

A traffic storing device and method for efficiently distributing and storing traffic data, and a computer-readable recording medium.

According to an aspect of the present invention, there is provided a traffic storing method for distributing traffic in a plurality of hard disks, the method comprising: storing traffic data in a first virtual receiving buffer designated by a first thread; A step of activating a waiting second thread when a thread switching trigger occurs and storing traffic data in a second virtual receiving buffer specified by a second thread; And recording the traffic data stored in the first virtual receive buffer on the disk.

The storing in the first and second virtual receiving buffers may include receiving traffic data from a network and filtering traffic data.

Also, the step of activating the second thread may include the step of generating a transition trigger if the first virtual receive buffer is filled above the threshold.

Also, the traffic storing method may include a step of generating a switching trigger when traffic data is stored in the first virtual receiving buffer and a preset time elapses.

In addition, the traffic storing method may include a first thread determining a second thread to be activated among a plurality of waiting threads.

Also, the step of activating the second thread may include the step of activating the second thread using interprocessor communication (IPC).

In addition, the traffic storing method may include switching the first thread to a standby state when all traffic data stored in the first virtual receiving buffer is recorded.

The traffic storing method may include merging traffic data stored in a plurality of hard disks when the traffic data is lower than a preset reference value. Wherein the traffic data is stored on a hard disk in the form of a file having a unique identifier.

According to an aspect of the present invention, there is provided a computer readable recording medium storing a program for the traffic storing method.

According to an aspect of the present invention, there is provided a traffic storage device including a network interface for receiving traffic data from a network, a memory configured with a plurality of reception buffers, a plurality of hard disks provided corresponding to the plurality of reception buffers, A first thread for writing traffic data stored in a first receiving buffer to a first hard disk and activating a second thread in a waiting state in accordance with a switching trigger, A processor for setting a DMA controller such that the traffic data is stored in the second receiving buffer when activated and a second thread for executing the second thread for writing the traffic data stored in the second receiving buffer to the second hard disk.

Further, the network interface can filter and output the traffic data received from the network.

Further, the switching trigger may occur when the first receiving buffer is filled with a threshold value or more, or when a predetermined time has passed after the traffic data is stored in the first receiving buffer.

Also, the first thread can be switched to the standby state when all of the traffic data stored in the first reception buffer is written.

The system may further include an integrated storage device in which traffic data distributed and recorded on a plurality of hard disks are merged and stored.

Since traffic data is distributed and stored, a large amount of traffic data can be efficiently stored.

1 is a schematic diagram of a network system including a traffic storage device according to an exemplary embodiment of the present invention.
2 is a control block diagram illustrating a traffic storage device according to an embodiment.
3 is a control block diagram for explaining a concrete application example of another traffic storage device according to an embodiment.
4 is a diagram for explaining multithreading for distributed storage of traffic.
FIG. 5 is a view for explaining a flow of traffic data in a traffic storing method according to an embodiment.
6 is a flowchart illustrating a method of storing a traffic according to an embodiment of the present invention.
7 is a flowchart for explaining step S530 of FIG. 6 in detail.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The terms used in this specification are terms selected in consideration of functions in the embodiments, and the meaning of the terms may vary depending on the user, the intention or custom of the operator, and the like. Therefore, the meaning of a term used in the following embodiments is defined according to the definition when it is specifically defined in this specification, and in the absence of a specific definition, it should be construed in a sense generally recognized by the ordinarily skilled artisans.

In addition, the configurations of the selectively described embodiments or selectively described embodiments of the present invention may be combined with each other in a single integrated configuration, if they are not obviously technically contradictory to the ordinary artisan unless otherwise stated. It should be understood.

Terms including ordinals such as " first, ""second," and the like can be used to describe various elements, but the elements are not limited by terms. Terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The term "and / or" includes any combination of a plurality of related items or any of a plurality of related items.

1 is a schematic diagram of a network system including a traffic storage device according to an exemplary embodiment of the present invention.

The user terminals VT1 and VT2 and the service providing apparatuses S1 and S2 are connected through the network 20 as shown in FIG. The user terminals VT1 and VT2 and the service providing units S1 and S2 can exchange data with each other via the network 20 and can exchange data between the user terminals VT1 and VT2 via the network 20 or between the user terminals VT1 and VT2, S1, and S2).

The network 20 may include a TAB device 21. The TAB device 21 collects the traffic generated in the network 20 and delivers the collected traffic to the traffic storage device 10. Here, traffic refers to information on the flow of communication, and for convenience of explanation, traffic is described as including at least one packet.

The set of traffic that is continuously transmitted to the traffic storage device 10 by the TAB device 21 is called traffic data.

The TAB device 21 may copy the packet and forward it to the traffic storage device 10. [ To this end, the TAB apparatus 21 is provided between the different routers constituting the network 20 and replicates packets transmitted between different routers, or constitutes the network 20 with the service providing apparatuses S1 and S2 It is possible to duplicate packets transmitted and received by the service providing apparatuses S1 and S2 and transmit the duplicated packets to the traffic storage apparatus 10. [

Further, the TAB device 21 may filter and replicate only packets satisfying predetermined conditions among all the packets. For example, the TAB device 21 can filter and replicate only packets corresponding to specific destinations or departure points of all packets, or filter and store only data packets among the entire packets.

In addition, the TAB device 21 can only replicate a part of the packet. For example, the TAB device 21 can replicate only the header portion of the packet necessary for judging the flow of the packet.

On the other hand, it should be understood that the TAB device 21 is an example of a device for collecting traffic generated in the network 20, and that the TAB device 21 can be replaced with any device capable of collecting traffic. For example, the TAB device 21 may be replaced with a switching mirroring port.

The traffic storage device 10 may distribute and store the traffic data transmitted from the TAB device 21. [ Hereinafter, each configuration of the traffic device will be described in detail with reference to FIG.

2 is a control block diagram schematically illustrating a traffic storage device according to an embodiment.

2, the traffic storage device 10 may include a network interface 11, a memory 12, a DMA controller 13, a distributed storage device 14, and a processor 15.

 The network interface 11 is a communication device for receiving traffic data from the TAB device 21. The network interface 11 stores the received traffic data in a direct memory access (DMA) ). ≪ / RTI >

In addition, the network interface 11 may filter the received traffic data. Specifically, the network interface 11 can filter and output the traffic data according to a specific condition under the control of the processor 15, so that only the traffic of interest to the administrator of the traffic storage device 10 can be stored have.

The memory 12 stores various data necessary for operation of the traffic storage device 10. [ In addition, the memory 12 may be virtualized and configured as a plurality of virtual buffers, and the traffic data received through the network interface 11 may be divided and stored in a virtual buffer.

At this time, each virtual buffer may be statically allocated in advance, but may be allocated dynamically.

The DMA controller 13 manages data input / output under the control of the processor 15. The DMA controller 13 can store the received traffic data in the address of the designated memory 12 according to an instruction from the processor 15. [ Hereinafter, the DMA controller 13 is described as being provided separately from the network interface 11, but the DMA controller 13 may be included in the network interface 11.

On the other hand, the DMA controller 13 can generate a trigger related to input / output processing in the traffic data. For example, the DMA controller 13 can generate a trigger when the specified memory 12 is filled with a predetermined reference or more. The trigger generated by the DMA controller 13 may be passed to the processor 15. Since the traffic data is stored without going through the processor 15 according to the DMA scheme, a large amount of traffic data can be efficiently stored.

The distributed storage device 14 may distribute and store the received traffic data. The distributed storage device 14 may include at least one storage device for distributed storage of traffic data.

Here, the storage device is an apparatus for storing a large amount of traffic data, and may be implemented by, for example, a magnetic tape, a hard disk, an optical disk, a flash memory, or the like.

However, for convenience of explanation, it is assumed that the storage device is a hard disk, and the distributed storage device 14 is implemented as a plurality of hard disks.

The processor 15 manages the overall operation of the traffic storage device 10. Specifically, the processor 15 can control each configuration so that successively received traffic data is stored without loss.

To this end, the processor 15 can manage overall movement of traffic data in a plurality of virtual receiving buffers and a plurality of storage devices. In order to efficiently distribute the traffic data, the processor 15 may be driven in a multi-threading manner.

The traffic storage device 10 may further include an integrated storage device 16. In order to analyze the traffic data, it is necessary to merge the dispersed traffic data, and the processor 15 can merge the traffic data distributed and stored in the distributed storage device 14 when the reception amount of the traffic data is small.

The merged traffic data may be stored in the integrated storage device 16. At this time, the integrated storage device 16 may be implemented as a storage device having a relatively larger storage capacity than each storage device of the distributed storage device 14, but is not limited thereto.

In addition, although the following description is made on the assumption that the merged traffic data is stored in the integrated storage device 16, the present invention is not limited thereto. E.g. The merged traffic data may be stored in a specific storage device of the distributed storage device 14 or may be transferred to a device other than the traffic storage device 10. [

The traffic storage device 10 may be implemented by various general purpose servers. Hereinafter, the traffic storage device 10 according to the embodiment will be described in detail with reference to FIG.

3 is a control block diagram for explaining a concrete application example of another traffic storage device according to an embodiment. As described above, the traffic storage device 10 may distribute and store traffic data based on multithreading. Hereinafter, one application example of the traffic storage device 10 in which four threads are executed in the four cores 151 to 154 to distribute and store the traffic data will be described in detail.

As shown in FIG. 3, a network interface card (NIC) 110 includes at least one port 111 for receiving traffic data and a driver 112 for inputting / outputting NIC 110 . At this time, the NIC 110 can filter and output the received traffic data. That is, the NIC 110 can output only specific traffic data among the received traffic data under the control of the processor 150. [ The traffic data may be filtered according to various criteria.

Specifically, the traffic data may be filtered according to a transmission format (e.g., FTP format), filtered based on the direction of traffic movement (e.g., destination MAC address, destination MAC address) Can be filtered.

In addition, the NIC 110 may browse the header of each packet for filtering and perform filtering based on the header information.

In addition, the NIC 110 can output only a part of the packet received from the TAB device 21. [ For example, the NIC 110 may replicate only the header portion of the packet needed to determine the flow of the packet.

The processor 150 may include a plurality of cores 151 through 154 for multithreading. At least one thread may be executed in each of the cores 151 to 154, but one thread is executed in one core for convenience of explanation.

The plurality of cores 151 to 154 may exchange data or control signals by interprocessor communication (IPC) between the processors 150.

A plurality of virtual receiving buffers 121 to 124 may be set in the memory 120 for a thread to be executed in each of the cores 151 to 154. [ The virtual receiving buffers 121 to 124 are space for temporarily storing the traffic data received from the NIC 110. The virtual receiving buffers 121 to 124 may be previously set for each thread, .

In addition, the sizes of the virtual reception buffers 121 to 124 may be set to be different from each other. For example, the size of the virtual receiving buffers 121 to 124 may be determined based on factors affecting the recording of the hard disk on which the traffic data stored in the virtual receiving buffers 121 to 124 is to be stored (for example, The buffer size of the disc) to minimize the recording time.

In the following description, one virtual buffer is allocated to one thread. However, a plurality of virtual receiving buffers 121 to 124 may be allocated to one thread, or one virtual receiving buffer 121 to 124 may be allocated to a plurality of Threads can also be shared.

The DMA controller 130 can control input / output of traffic data according to a control signal of a thread. Specifically, when the traffic data received from the NIC 110 is output, the DMA controller 130 can control the bus 170 such that the output traffic data is input to the designated virtual receiving buffers 121 to 124.

Further, the DMA controller 130 can generate a trigger according to the condition set by the thread. For example, the DMA controller 130 may generate a trigger when a particular receive buffer is filled by the condition set by the thread.

Meanwhile, the DMA controller 130 may be included in the NIC 110 as described above.

Each configuration of the traffic storage device 10 transfers data to each other via a bus 170. [ At this time, the bus 170 may include a data bus used for data transmission between the respective structures, an address bus for transmitting an address where data is stored, and a control bus used for transmitting a control signal.

The distributed storage of the traffic data received by the NIC 110 will be described in detail with reference to FIGS. 4 and 5. FIG.

FIG. 4 is a diagram for explaining multithreading for distributed storage of traffic, and FIG. 5 is a view for explaining a flow of traffic data in a traffic storing method according to an embodiment.

Referring to FIGS. 3 to 5, a thread for managing distributed storage of traffic data is performed in each of the plurality of cores 151 to 154. [ The thread can manage the virtual receive buffer of one of the plurality of virtual receive buffers 121 to 124 and the hard disk of one of the plurality of hard disks 141 to 144. [

For example, the first thread (Thread # 1) manages the first virtual receive buffer 121 and the first hard disk 141, and the nth thread manages the nth virtual receive buffer and the nth hard disk .

As shown in FIG. 4, the thread can be switched from the standby state to the active state, or from the active state to the standby state, the continuously received traffic data can be distributed to the plurality of hard disks 141 to 144 have.

Specifically, the traffic data received from the NIC 110 is sequentially stored in the first virtual receive buffer 121 by the DMA controller 130. At this time, the traffic data stored in the first virtual receiving buffer 121 is sequentially written to the first hard disk 141 by the first thread (Thread # 1). In addition, new traffic data may be input to the first virtual receiving buffer 121 where the recorded traffic data is stored in the first hard disk 141.

A first transition trigger ST 1 is generated while traffic data is stored in the first virtual reception buffer 121 to prevent an overflow in the first virtual reception buffer 121.

The transition trigger prevents the receive buffer from overflowing. In general, the data input / output speed of a storage device such as a hard disk is constant.

Therefore, the amount of traffic data stored in the reception buffer per unit time increases due to an increase in traffic generation, and overflow occurs when traffic data is input to the memory at a speed faster than the data input / output speed of the hard disk.

That is, if traffic data is input to the memory at a speed higher than the data input / output speed of the hard disk, new traffic data is input before the traffic data stored in the receiving buffer is stored in the hard disk, and some traffic data is lost.

Accordingly, the change trigger may occur before the overflow of the receive buffer occurs, and may change the receive buffer where the traffic data output from the NIC 110 is stored.

To this end, the transition trigger may occur if a predetermined condition is met. For example, the transition trigger may occur when the receiving buffer in which the traffic data received from the NIC 110 is stored is filled to a certain degree or more, and the processor 150, if the receiving buffer in which the traffic data is stored is filled to a certain degree or more, You can set the DMA controller to trigger.

Specifically, when the first virtual receive buffer 121 is filled with a specific size together with the setting of the address of the first virtual receive buffer 121 for storing traffic data in the DMA controller 130, the first thread (Thread # 1) Can be set to generate the first switching trigger (ST 1). The DMA controller 130 may generate and deliver a first transition trigger ST 1 to the first thread (Thread # 1) when the first virtual receive buffer 121 is filled to a certain size or more.

For example, if the DMA controller 130 is set so that the first thread (Thread # 1) generates the first switching trigger (ST 1) when the first virtual receiving buffer 121 is filled with 90% or more, As shown in FIG. 5A, when the first virtual receiving buffer 121 is filled with 90% or more, the first conversion trigger ST1 is generated.

When the first switching trigger ST1 occurs, the second thread (Thread # 2) in the standby state of the first thread (Thread # 1) can be activated. At this time, the second thread (Thread # 2) to be activated by the first thread (Thread # 1) may be a predetermined one, but is not limited thereto.

For example, the first thread (Thread # 1) may determine a thread that satisfies a preset criterion among a plurality of waiting threads as a second thread to be activated (Thread # 2).

The first thread (Thread # 1) may generate the first active event (AE 1) to activate the second thread (Thread # 2). The first active event AE 1 generated by the first thread (Thread # 1) may be transmitted to the second thread (Thread # 2) through the IPC.

The second thread (Thread # 2) receiving the first activity event (AE 1) generates a predetermined control signal to the DMA controller (130) and transmits a control signal to the memory (120) in which the traffic data received from the NIC You can change the location.

Specifically, the second thread (Thread # 2) may send a control signal to the DMA controller 130 to store the traffic data in the second virtual receiving buffer 122. At this time, the second thread (Thread # 2) may send a control signal to the DMA controller to generate a second switching trigger (ST 2) when 90% of the second virtual receiving buffer 122 is filled.

That is, according to the control signal of the second thread (Thread # 2), the traffic data received at the NIC 110 is stored in the second virtual receiving buffer 122, and the traffic data stored in the second virtual receiving buffer 122 Is recorded in the second hard disk 142 under the control of the second thread (Thread # 2). Meanwhile, the first thread (Thread # 1) that has generated the first activity event (AE 1) can continuously record the traffic data stored in the first virtual receiving buffer 121 to the first hard disk 141.

On the other hand, the first thread (Thread # 1) may record the traffic data stored in the first hard disk 141 as a file having an identifier. At this time, the identifiers may be assigned so as not to overlap each other. For example, an identifier may be assigned based on the occurrence time of a conversion trigger that can not occur at the same time.

By assigning such a unique identifier to each traffic data file, it is possible to store the traffic data file so as to facilitate merging of traffic data stored at the shortest time. This will be described in detail below.

That is, when the first transition trigger ST 1 occurs in the step of storing the traffic data as shown in FIG. 5A, the storage flow of the traffic data changes as shown in FIG. 5B.

On the other hand, if more than 90% of the traffic data is stored in the second virtual receiving buffer 122, the DMA controller 130 can generate the second switching trigger ST 2.

When the second switching trigger ST2 occurs, the second thread Thread # 2 generates a second active event AE2 and the third active thread AE 2).

At this time, the second active event (AE 2) may be transferred to the third thread (Thread # 3) through the IPC.

The third thread (Thread # 3) receiving the second active event AE 2 generates a predetermined control signal to the DMA controller 130 so that the traffic data received from the NIC 110 is transmitted to the third virtual receiving buffer 123 As shown in Fig. The third thread (Thread # 3) may send a control signal to the DMA controller 130 to generate a third switching trigger (ST 3) if more than 90% of the third virtual receiving buffer 123 is filled.

5B, when the second switching trigger ST2 is generated, the traffic data received from the NIC 110 is stored in the third virtual receiving buffer 123 as shown in FIG. 5C , The traffic data stored in the third virtual receiving buffer 123 is written to the third hard disk 143 under the control of the third thread (Thread # 3).

The traffic data stored in the first and second virtual receiving buffers 121 and 122 by the first thread (Thread # 1) and the second thread (Thread # 2) are stored in the first and second hard disks 141 and 142, respectively. .

On the other hand, if all the traffic data stored in the first virtual receiving buffer 121 is stored in the first hard disk 141, the first thread (Thread # 1) is switched to the standby state. At this time, if all the traffic data stored in the first virtual receiving buffer 121 is stored in the first hard disk 141, a first end trigger ET 1 may occur.

At this time, the first end trigger ET 1 may be generated by a controller (not shown) that manages each hard disk 141 to 144 of the distributed storage device 140 as a whole, but the first thread (Thread # 1) Lt; / RTI >

When the first end trigger ET 1 is generated in this way, the first thread (Thread # 1) is switched to the standby state. Therefore, when the first end trigger ET 1 occurs, the first thread (Thread # 1) is switched to the standby state as shown in Fig. The flow of the traffic data changes as shown in Fig. 5D.

Thereafter, when the third switching trigger ST 3 occurs, the fourth thread (Thread # 4) is activated in accordance with the third active event (AE 3) of the third thread (Thread # 3) Is stored in the fourth virtual receiving buffer 124. [0064]

In addition, each of the second thread (Thread # 2), the third thread (Thread # 3), and the fourth thread (Thread # 2) And stores the data in the second, third, and fourth hard disks 142, 143, and 144, respectively,

When the second end trigger ET 2 is generated, the second thread (Thread # 2) is switched to the standby state as shown in FIG. 4, and the flow of the traffic data changes as shown in FIG. 5E.

On the other hand, although it has been described that the switching trigger occurs when the virtual receiving buffers 121 to 124 are filled up to a predetermined threshold value or more, the switching trigger is for preventing overflow in the virtual receiving buffers 121 to 124, Lt; / RTI >

For example, a transition trigger may occur when the time at which the traffic data is transmitted to the receive buffer exceeds a predetermined threshold time. At this time, the threshold time point may be calculated based on the difference between the transmission rate of the traffic data and the traffic data input / output rate of the hard disk. In other words, the threshold time point can be set based on the difference between the input speed at which data is stored in the reception buffer and the output speed at which data is output to the hard disk.

As described above, the traffic storage device 10 can distribute and store traffic to a plurality of hard disks 141 to 144 according to a multithreading scheme. Specifically, as shown in FIG. 5, traffic data is stored in a plurality of hard disks 141 to 144 at a time.

Due to the distributed storage of the traffic data, the slow data recording speed of the hard disks 141 to 144 is compensated to minimize the traffic loss due to the storage delay of the hard disks 141 to 144.

Meanwhile, the size of the hard disk of the traffic storage device 10 may be different from each other as shown in FIG. 5, so that the traffic storage device 10 can be easily configured.

That is, since the data stored in the respective virtual reception buffers 121 to 124 are stored in different hard disks according to the multithreading scheme, it is possible to freely combine hard disks in comparison with a distributed storage method such as RAID.

In addition, according to the selection of the thread to be activated, the hard disk on which the traffic data is to be stored can be determined, and the load on the specific hard disk can be prevented from being concentrated, thereby extending the service life of the hard disk.

The processor 150 may integrate the traffic data distributed and stored in the plurality of hard disks 141 to 144 as described above.

The merging of the traffic data may be performed using a unique identifier assigned to the hard disks 141 to 144 when the data is recorded in the hard disks 141 to 144. The merge of the traffic data may be performed when the amount of traffic is relatively small.

For this, the processor 150 monitors the amount of traffic data transmission and, if the amount of traffic data transmission is lower than a preset reference value, merges the traffic data and stores it in the integrated storage disk 160.

3 to 4, traffic data is distributed and stored by the four cores 151 to 154, but the present invention is not limited thereto. For example, a plurality of threads may be executed in one core so that traffic data may be distributed and stored.

In the above description, traffic data is distributed and processed by four threads. However, it should be understood that the number of threads executed at the same time may vary depending on the amount of traffic data to be transmitted.

Hereinafter, a method of storing traffic data will be described in detail with reference to FIGS.

FIG. 6 is a flowchart for explaining a traffic storing method according to an embodiment, and FIG. 7 is a flowchart for explaining step S530 of FIG. 6 in detail.

As shown in FIG. 6, the traffic storage device 10 may receive traffic data (S510). Specifically, a network interface card (hereinafter NIC 110) can receive traffic data from the TAB device 31. At this time, the TAB device 31 can filter only the packets satisfying the predetermined condition among all the packets and transmit them to the NIC 110. The TAB device 31 may also copy a portion of the packet and transmit it to the NIC 110. [

Meanwhile, the received traffic data may be filtered by the NIC 110 (S520). That is, the NIC 110 may filter the received traffic data under the control of the processor 150 to output only specific traffic data.

The filtered traffic data may be distributedly recorded (S530). That is, the traffic data is stored in the specific virtual receiving buffers 121 to 124 among the plurality of virtual receiving buffers 121 to 124 specified by the activated thread, and the traffic data stored in the virtual receiving buffers 121 to 124 is stored in the activated May be distributed and recorded in the hard disks 141 to 144 mapped with the virtual reception buffers 121 to 124 by the thread.

At this time, the traffic data recorded in each of the hard disks 141 to 144 may be stored as a file having a unique identifier according to a preset reference.

The distributed recorded traffic data may be merged (S540). The merging of the traffic data may be performed using a unique identifier assigned to the hard disks 141 to 144 when the data is recorded in the hard disks 141 to 144. The merge of the traffic data may be performed when the amount of traffic is relatively small.

Hereinafter, step S530 of FIG. 6 will be described in more detail with reference to FIG.

Traffic data is recorded on the first hard disk (S531). At this time, the filtered traffic data may be stored in the first virtual receive buffer designated by the activated first thread, and the first thread may write the traffic data stored in the first virtual receive buffer to the first hard disk.

Meanwhile, the traffic data may be directly stored in the first virtual receive buffer without being processed by the processor 150 according to the DMA scheme. To this end, the first thread may send a control signal to the DMA controller 130 to specify the location and size of the first virtual receive buffer in which the traffic data is to be stored.

If the storage amount of the first virtual receiving buffer is smaller than the threshold value (NO in S532), the traffic data input through the NIC is continuously stored in the first virtual receiving buffer, and the traffic data stored in the first virtual receiving buffer is stored in the first thread And then recorded on the first hard disk (S531).

On the other hand, if the speed at which traffic data is stored in the first virtual receiving buffer becomes faster than the recording speed of the first hard disk. The storage amount of the first virtual reception buffer becomes larger than the threshold value (YES in S532).

When the storage amount of the first virtual receiving buffer is larger than the threshold value (YES in S532), a switching trigger is generated (S533). Here, it should be understood that the switching trigger does not cause an overflow in the first virtual receiving buffer as described above, and that the step S531 may vary depending on the generation condition of the switching trigger.

For example, the step S532 may be replaced with a step of determining the elapse of a predetermined time.

In addition, when the switching trigger occurs, the second thread to be activated among the waiting threads may be determined (S534). For example, the first thread may determine a thread that meets a predetermined criterion among a plurality of waiting threads as a second thread to be activated.

At this time, the first thread can transmit the activation event via the IPC to the determined second thread.

The first thread may write the traffic data stored in the designated first virtual receive buffer to the first hard disk (S535). At this time, the first thread can be switched to the standby state when all the traffic data stored in the first virtual receiving buffer is written to one hard disk.

The activated second thread writes the filtered traffic data to the second hard disk (S536). Specifically, the activated second thread may send a control signal to the DMA controller 130 to specify a second virtual receive buffer 122 in which the filtered traffic data is to be stored.

Thus, the filtered traffic data is stored in the second virtual receive buffer by the DMA controller, and the traffic data stored in the second virtual receive buffer can be written to the second hard disk by the second thread.

The traffic storing method according to an exemplary embodiment of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. The computer readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination, and includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include an optical recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, a compact disk read only memory (CD-ROM), and a digital video disk (ROM), random access memory (RAM), flash memory, and the like, such as a magneto-optical medium such as a magneto-optical medium and a floppy disk, And hardware devices that are specifically configured to perform the functions described herein.

100: traffic storage device 110: NIC
111: Port 112: Driver
120: memory 130: DMA controller
140: Distributed storage device 150: Integrated storage disk

Claims (15)

A traffic storing method for distributing and storing traffic on a plurality of hard disks,
Wherein the received traffic data is stored in a first virtual receive buffer specified by a first thread and the traffic data stored in the first virtual receive buffer is recorded in a first hard disk;
Determining a second thread to be activated among the plurality of standby threads when a thread change trigger occurs;
An active stage in which the determined second thread is activated; And
Wherein the traffic data is stored in a second virtual receive buffer specified by the second thread, and traffic data stored in the first and second virtual receive buffers are respectively recorded in first and second hard disks;
Lt; / RTI > The method according to claim 1,
The recording step includes:
Receiving the traffic data from a network; And
Filtering the traffic data;
Lt; / RTI > The method according to claim 1,
Wherein the activating step comprises:
Generating the transition trigger if the first virtual receive buffer is filled above a threshold;
Lt; / RTI > The method according to claim 1,
Wherein the activating step comprises:
Generating the switch trigger when traffic data is stored in the first virtual receive buffer and a preset time elapses;
Lt; / RTI > delete The method according to claim 1,
Wherein the activating step comprises:
The first thread activating the second thread using interprocessor communication (IPC);
Lt; / RTI > The method according to claim 1,
Wherein the dispersion recording step comprises:
When the traffic data stored in the first virtual receiving buffer is all written to the first hard disk, switching the first thread to a standby state;
Lt; / RTI > The method according to claim 1,
And merging the traffic data distributed and stored in the plurality of hard disks when the traffic data becomes lower than a preset reference value. The method according to claim 1,
Wherein the traffic data is stored in the hard disk in the form of a file having a unique identifier. A computer-readable recording medium storing a program for a method according to any one of claims 1 to 4, 6 to 9. A network interface for receiving traffic data from a network;
A memory in which a plurality of reception buffers are set;
A plurality of hard disks corresponding to the plurality of reception buffers;
A DMA controller for storing the traffic data in a first receiving buffer specified by a first thread;
And
The first thread writes the traffic data stored in the first receiving buffer to the first hard disk and activates the second thread in the waiting state according to the switching trigger, A second thread for setting the DMA controller to store the traffic data in the second receiving buffer when the second thread is activated and a second thread for writing the traffic data stored in the second receiving buffer to the second hard disk, A processor to be executed;
Lt; / RTI > 12. The method of claim 11,
Wherein the network interface comprises:
A traffic storage device for filtering and outputting traffic data received from a network. 12. The method of claim 11,
Wherein the switching trigger occurs when the first receiving buffer is filled with a threshold value or more, or when traffic data is stored in the first receiving buffer and a predetermined threshold time elapses. delete 12. The method of claim 11,
And an integrated storage device in which traffic data distributedly recorded on a plurality of hard disks are merged and stored.

Images