KR102076861B1 - Network performance diagnosis method and apparatus, and system - Google Patents

Abstract

One aspect of the present invention discloses a method for diagnosing network performance in a network performance diagnosis apparatus connected to a switching device provided between a first entity and a second entity. The method is based on mirroring from the switching device, obtaining at least one mirrored packet for at least one packet transmitted and received between the first entity and the second entity, and the at least one mirrored Calculating a performance-related indicator indicating performance of a service of a network associated with the first entity and the second entity based on at least some of the information included in the packet of and storing the calculated performance-related indicator. Includes.

Description

NETWORK PERFORMANCE DIAGNOSIS METHOD AND APPARATUS, AND SYSTEM

The present invention relates to a method of diagnosing the performance of a network service, and more particularly, to a method of diagnosing the performance of a network service in order to detect a quality problem of the service in a network including a client terminal and a server.

The network generally includes a communication link and various devices having communication capabilities connected to the communication link. Here, devices related to the network include computers, peripherals, routers, storage devices, and various electrical appliances having a communication interface with a processor. Here, the term "device" typically includes logical devices or other devices having functionality and the ability to process and exchange data, and may include general purpose computers as well as household devices.

Traditional network systems include client devices used by users and various server devices associated with a web site. In general, a client device requests a connection to a server having a specific IP address to use a web site, and then connects through a waiting time. At this time, when a plurality of client devices are accessed by a plurality of users at a specific point in time to access the server, performance of network services associated with the server may be degraded due to a bottleneck. In the event of a service performance or quality problem, the user increases the waiting time due to delays, and the utilization rate of the service decreases, which leads to a decrease in productivity and sales. In addition, an increase in IT operating costs may occur, and server operators and / or managers of related businesses may face unfavorable results, such as a decrease in corporate competitiveness.

Therefore, it is necessary to quickly identify the cause of performance degradation and respond to it as quickly as possible. However, there is no appropriate service to clearly understand where the cause of the performance degradation is, and thus, an appropriate response is not achieved.

1 is a conceptual diagram illustrating a process of performing conventional network service management.

Referring to FIG. 1, for IT management, the IT team leader commands a command related to quality management to a network operation part, a server operation part, a database development part, and an application development part, respectively.

When a specific service problem occurs, the representatives of each part individually determine the problem of the IT device that they manage and report it. That is, due to the independent access to the problem of a specific service, such as "It is not an application problem", "It is not a network problem" and / or "There is nothing wrong with the server", it is not possible to quickly identify the cause of the problem and decrease the Failure to respond appropriately to the problem. That is, there is a problem of missing the golden time of performance improvement.

An object according to an aspect of the present invention for solving the above-described problem is to provide a method for diagnosing network performance in a network performance diagnosis apparatus for managing a business / user-oriented network service.

A network performance diagnosis method in a network performance diagnosis apparatus connected to a switching device provided between a first entity and a second entity according to an aspect of the present invention for achieving the above object is to mirror from the switching device. Based on the above, obtaining at least one packet that is mirrored, for at least one packet transmitted and received between the first entity and the second entity, at least some of the information contained in the at least one mirrored packet The method may include calculating a performance-related indicator indicating performance of a service of a network associated with the first entity and the second entity based on the step of storing the calculated performance-related indicator.

Information included in the at least one mirrored packet may include source IP, destination IP, and time information.

The first entity may include a client, and the second entity may include a server.

The calculating of a performance-related indicator indicating the performance of a network service based on at least some of the information included in the at least one mirrored packet may include: in a mirrored packet for a first packet transmitted from the client to the server. , Extracting information about a first time (T1) when the first packet arrives at the network diagnostic apparatus from the client, in a mirrored packet of a first response packet from the server for the first packet, the Extracting information about a second time (T2) when the first response packet arrives at the network diagnostic apparatus from the server; and information about the extracted first time (T1) and the second time (T2). And calculating a server round trip time (sRTT) based on the information.

The step of calculating a performance-related indicator indicating the performance of a network service based on at least some of the information included in the at least one mirrored packet is mirroring of the second response packet from the client to the first response packet Extracting information about the third time T3 when the second response packet arrives at the network diagnostic apparatus from the client, and information on the second time T2 and the third time T3 from the packet. It may include the step of calculating the client round-trip time (cRTT) based on the information.

Among the performance-related indicators, information on the first time T1, information on the second time T2, included in the at least one mirrored packet, with respect to the calculation of the delay time-related indicator, Information about the third time T3, information about the fourth time T4 when the last data of the response data requested by the client to the server arrives at the packet mirroring device, and the server round-trip time (sRTT) And a request transmission time indicating a time required until the request is received by the client by requesting response data from the server using at least one of the client round-trip time (cRTT). Response table indicating response delay time from the URL (Uniform Resource Locator) associated with the request until the server receives the first data associated with the response data. Latency, response data transmission time indicating the time required for the server to transmit the response data to the client, and the response after the client transmits a request for the response data to the server It is possible to calculate at least one of the total usage time (used time) indicating the time required to receive all data associated with the data.

The step of calculating a performance-related indicator indicating the performance of the service of the network includes loading a page to a specific web page based on the client time spent by the client, the network time spent by the network, and the server time spent by the server. And calculating the time.

The network time includes the sRTT, the cRTT, the request transmission time, and the response data transmission time, and the server time may include a response latency.

The performance-related indicator may include wait-for-response session information indicating the number of sessions that have not received a response to a request sent by the client.

The performance-related indicators include User Per Second (UPS) information indicating the number of clients connected per second, Connection Per Second (CPS) information indicating the number of new sessions connected per second, and TPS (Transaction) indicating the number of transactions occurring per second. Per Second) information.

The method may further include determining whether a network service problem occurs based on at least some of the performance-related indicators.

Determining whether a problem occurs in a network service based on at least some of the performance-related indicators includes: the first data associated with the response data from a URL (Uniform Resource Locator) associated with the request for the client's response data to the server; At least one of response latency information indicating response delay time until the server receives it and response wait session information indicating the number of sessions that have not received a response to the request sent by the client. Comparing with at least one of a threshold associated with a response waiting time and a threshold associated with a number of response waiting sessions and a response waiting time greater than at least one of a threshold associated with the response waiting time and a threshold associated with the number of response waiting sessions At least one of (latency) information and the response waiting session wait information is greater Wu, may comprise determining that the problem of traffic (traffic) or traffic over delay occurs.

Determining whether a network service problem occurs based on at least some of the performance-related indicators includes: Bit Per Second (BPS) information indicating a data transmission bit size per second and CPS (Connection Per) indicating a number of new sessions connected per second. Second) comparing at least one of the CPS information and the BPS information to at least one of a threshold associated with the BPS and a threshold associated with the CPS, and at least one of a threshold associated with the BPS and a threshold associated with the CPS. If at least one is larger, it may include determining that a problem of excessive BPS or excessive CPS occurs.

The step of determining whether a network service problem occurs based on at least some of the performance-related indicators includes: a threshold value associated with the 40X error, and at least one of the occurrence amount information of the 40X error per hour and the occurrence amount information of the 50X error per hour; Comparing with at least one of the thresholds associated with a 50X error and at least one of the occurrence amount information of a 40X error per specific hour and the occurrence amount of 50X error per specific hour than at least one of a threshold associated with the 40X error and a threshold associated with the 50X error If one is larger, it may include determining that a 40X or 50X error occurs.

The network diagnostic method is a text message, email and SNS (Social Network) to a user of the first account for management of the network, if it detects a problem with the network service based on at least some of the performance-related indicators. Service) may further include the step of notifying.

The first entity may be a first server, and the second entity may be a second server.

At least one of the first server and the second server may include at least one of a web server, a web application server (WAS), and a database server (DB server).

When acquiring mirrored packets for packets associated with the first entity, the second entity, and the third entity connected in series, the interval between the first entity and the second entity and the second entity and the third entity Performance-related indicators for each section of a section between individuals can be calculated.

The method for diagnosing network performance may further include generating a flow map by objectifying the first entity, the second entity, and the third entity on a visualization space based on performance indicators for each section. .

The performance-related indicator may be calculated and stored in real time as the packets transmitted and received between the first entity and the second entity are monitored in real time.

A network performance diagnosis apparatus connected to a switching device provided between a first entity and a second entity according to another aspect of the present invention for achieving the above object is based on mirroring from the switching device, A port for acquiring at least one mirrored packet for at least one packet transmitted and received between one entity and the second entity; A packet analysis module for calculating a performance-related index indicating performance of a service of a network associated with the first entity and the second entity based on at least some of information included in the at least one mirrored packet and the calculated performance It may include a repository for storing related indicators.

A network performance diagnosis system for performing network performance diagnosis according to another aspect of the present invention for achieving the above object is connected to a switching device provided between a first entity and a second entity, and the switching device, wherein Based on mirroring from the switching device, acquiring at least one mirrored packet for at least one packet transmitted and received between the first entity and the second entity, and included in the at least one mirrored packet Based on at least some of the information to calculate a performance-related indicator indicating the performance of the service of the network associated with the first entity and the second entity, and may include a network performance diagnostic device for storing the calculated performance-related indicator have.

According to the method for diagnosing network performance in the network performance diagnosis apparatus of the present invention, it is possible to secure visibility and intuition for service intervals, thereby making preemptive symptom management (prevention) for problems in network services.

1 is a conceptual diagram for explaining a process of performing a conventional network service management,
2 is a conceptual diagram showing a system including a packet mirroring apparatus according to an embodiment of the present invention,
3 is a block diagram showing a connection configuration between a packet mirroring device and another device on a network according to an embodiment of the present invention,
4 is a conceptual diagram for explaining the operation of each section of the packet mirroring apparatus according to an embodiment of the present invention,
5 is a block diagram specifically showing a packet mirroring device according to an embodiment of the present invention,
6 is a flowchart schematically illustrating a method for diagnosing network performance of a packet mirroring apparatus according to an embodiment of the present invention,
7A and 7B are conceptual diagrams illustrating network round trip time (RTT) indicators between a user and a server calculated by a packet mirroring device according to an embodiment of the present invention;
8 is a conceptual diagram showing a delay indicator calculated by the packet mirroring apparatus according to an embodiment of the present invention,
9 is a conceptual diagram showing an indicator of the number of server response waiting sessions calculated by the packet mirroring apparatus according to an embodiment of the present invention;
10 is a conceptual diagram showing a CPS / TPS (Connection Per Second / Transaction Per Second) index calculated by a packet mirroring device according to an embodiment of the present invention;
11 is a view showing a flow map (Flow map) generated based on the performance index calculated by the packet mirroring device according to an embodiment of the present invention,
12 is a table showing an example of a setting value for determining whether an alert related to network performance occurs in a packet mirroring device according to an embodiment of the present invention,
13A and 13B are diagrams showing exemplary aspects of response speed analysis for each section according to a flow map;
14 is a view showing the appearance of a dashboard (dashboard) for visualizing the performance index between the user and the server,
15 is a diagram showing a monitored page of detailed traffic for each server, user, URL, and session;
16 is a diagram showing a page for identifying contents of detailed session information and an error of an application;
17 is a view showing a page to check the correlation associated with the problem element by a drill-down (Drill-Down) method,
18 is a view showing a process of confirming detailed information for each server in real-time service status and warning;
19 is a diagram showing a diagnostic analysis page for a detailed log of the application;
20 is a diagram showing a process of tracking a user by estimating an abnormal access,
21 is a diagram showing a page visualizing the sensation speed up to the user's access for each main page,
22 is a diagram showing a page visualizing a user's responsive response speed to a main page according to a warning;
23 is a diagram showing a page analyzing a user's sensation speed according to a response delay analysis screen for a specific website,
FIG. 24 is a diagram showing a screen visualizing the loading time for each web page and an analysis page of the trend and delay components of the sensory speed accordingly;
25 is a diagram showing a page for diagnosing and analyzing the details of a delayed web page;
26 is a diagram showing a page for confirming an inflow path using HTTP referrer information;
27 is a diagram showing a page comparing and analyzing server indicators and network indicators;
28A is a flowchart illustrating a process of determining a server delay and failure event alarm,
28B is a diagram showing a threshold setting page,
29A and 29B show pages related to 40X error analysis,
30 is a diagram showing a page visualizing service performance in a global map in connection with geographical data;
31 is a diagram showing a page visualizing service performance in a local map in connection with geographical data;
32 is a diagram showing pages analyzed by monitoring performance of each server;
33 is a diagram showing a page showing a distribution of access by environment of a user;
34A and 34B show pages for registering new devices and links,
35 is a block diagram illustrating a configuration for performing an operation for automatically registering a new device in a packet mirroring device according to another embodiment of the present invention;
36A to 36C are flowcharts illustrating a process for registering a new device and a new link in a packet mirroring device according to another embodiment of the present invention,
37A to 37C are flowcharts illustrating a process for selectively registering a new device and a new link in a packet mirroring device according to another embodiment of the present invention,
38 shows an optional device auto-registration page,
39 is a diagram showing a flow map visualizing a newly generated link and a device by automatic device registration,
40 is a view for explaining a system connection relationship of a plurality of packet mirroring devices according to another embodiment of the present invention;
41 is a view showing a configuration that performs different functions according to a connection relationship of a plurality of packet mirroring devices according to another embodiment of the present invention,
42 is a block diagram specifically showing a packet mirroring apparatus or a service module of FIG. 5 according to an embodiment of the present invention.

The present invention can be applied to various changes and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail.

However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from other components. For example, the first component may be referred to as a second component without departing from the scope of the present invention, and similarly, the second component may be referred to as a first component. The term and / or includes a combination of a plurality of related described items or any one of a plurality of related described items.

When an element is said to be "connected" or "connected" to another component, it is understood that other components may be directly connected to or connected to the other component, but there may be other components in between. It should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that no other component exists in the middle.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, terms such as “include” or “have” are intended to indicate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, one or more other features. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the present invention pertains. Terms such as those defined in a commonly used dictionary should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Does not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the overall understanding in describing the present invention, the same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

Throughout this specification, entity includes various devices associated with a network, which is a term that includes client terminals and / or server devices.

The user basically means the user of the client terminal. However, in some cases, it may also mean a user of a packet mirroring device according to an embodiment of the present invention. A network operator and / or a network administrator is a person who manages a network related to a packet mirroring device, and may mean a user of the packet mirroring device.

A network performance diagnostic device that calculates performance-related indicators related to network performance may be referred to as a packet mirroring device. In addition, since it can be implemented as a device for visualizing the performance-related indicators of network services, it can be referred to as a network performance indicator visualization device. Additionally, since it may be implemented as a device for registering an entity newly associated with the network, it may be referred to as a network new object registration device. Hereinafter, despite the various implementation examples, it is referred to as a packet mirroring device.

In addition, the term network performance can be used generically with respect to communication performance in servers, networks and clients.

2 is a conceptual diagram showing a system including a packet mirroring apparatus according to an embodiment of the present invention. 2, the packet mirroring system according to an embodiment of the present invention is a client terminal (210-1 ~ 210-3), the network 220, the server end (230 ~ 250) and the packet mirroring device 200 ).

Referring to FIG. 2, the client terminals 210-1 to 210-3 access a specific website and / or web application through the network 220. At this time, the connection is performed at the server end 230 to 250 associated with the website and / or web application. The client terminals 210-1 to 210-3 access a specific web page through a web browser and request execution of a desired page or application. The request may include running static content, such as html documents, multimedia content, such as video, audio, and / or other applications.

According to an embodiment of the present invention, the client terminals 210-210-3 may be operated by a user and include any device including a communication function (including an Internet access and web browser execution function) and a data processing function. Can be. The client terminals 210 to 210-3 include a mobile station (MS), a user equipment (UE), a user terminal (UT), a wireless terminal, an access terminal (AT), a terminal, or a fixed or mobile subscriber unit. (Subscriber Unit), Subscriber Station (SS), Cellular Phone, Wireless Device, Wireless Communication Device, Wireless Transmit / Receive Unit (WTRU), Mobile Node, Mobile, Mobile Station, Personal It may be referred to as a personal digital assistant (PDA), smart phone, laptop, netbook, personal computer, wireless sensor, consumer electronics (CE) or other terms. Various embodiments of the client terminals 210-1 to 210-3 include a cellular phone, a smart phone having a wireless communication function, a personal digital assistant (PDA) having a wireless communication function, a wireless modem, a portable computer having a wireless communication function, Integrating imaging devices such as digital cameras with wireless communication capabilities, gaming devices with wireless communication capabilities, music storage and playback appliances with wireless communication capabilities, Internet home appliances with wireless Internet access and browsing, as well as combinations of those functions It may include a portable unit or a terminal, but is not limited thereto.

Each client terminal 210-1 to 210-3 includes input devices such as a mouse and keyboard for receiving user input, and a display for providing a control user interface for a user to interact with networked devices. It may include a user communication interface. The user interface may include a Graphical User Interface (GUI) to provide information to the user.

The network 220 includes wired and / or wireless networks. The network 220 may include the Internet. The network 220 may include a serial bus that provides a physical layer (medium) to transmit and receive data between variously connected client terminals 210-1 to 210-3 and server terminals 230 to 250. . Here, the serial bus may include a 1394 serial bus. It can support both time-multiplexed audio / video (A / V) streams and standard Internet Protocol (IP) communication (eg, IETF REC 2734), but is not limited thereto. . Network 220 may also include a non-1394 network (eg, Ethernet, etc.). Additionally, the network 220 may include a home network. Each of the client terminals 210-1 to 210-3 may communicate with one or more server devices 230 to 250 in the network 220.

The server end 230-250 responds to the user's request using the network 220 resource to provide services to the user. This includes the return of information (data). It also includes the performance of functions (eg, mechanical functions) and return of states, return of data streams and states, acceptance of data streams and returns of states, or storage of states for various actions. The server end (230-250) may include an on-demand, embedded, and control program to implement control of its own hardware.

The server end 230 to 250 may be associated with a specific web site and / or web application, and performs calculations and management related to tasks performed in each web site and / or web application. The server end 230-250 may interact with the client terminals 210-1-210-3 and other servers 230-250. Exemplary services may include MPEG sourcing / sinking, and display services.

The server end 230-250 is interface data (eg, HTML, XML, Java, JavaScript, GIF, JPEG, MPEG, graphic burst or intended) that provides an interface for command and control of the device through the network 220. (Any other format used for the purpose). In a particular embodiment, each server 230-250 may process information such as one or more Hypertext Markup Languages (HTML) that provide command and control of the device. The server end (230-250) uses an Internet standard that represents HTML pages using a browser technique.

According to an embodiment of the present invention, the server end 230 to 250 may include a web server 230, an app server 240 (APP server), and a database server 250 (DB server). However, the server end does not necessarily have to consist only of a combination of three servers. It is also valid that only the web server 230 exists, the app server 240 and the database server 250 do not exist, or it is also possible that only the app server 240 is configured, and other various types and combinations of layers of servers are also possible. It is possible.

The web server 230 is a server that provides requested content to a web client. The web server 230 may provide images such as static HTML, JPEG, and GIF to the web browser through the HTTP protocol. In some cases, the web server 230 may also include a container capable of operating an internal application.

The app server 240 may also be referred to as a WAS (Web Application Server) server, which represents a middleware software server that provides a transaction processing and management and application execution environment in a client / server environment. Typically, the server stage (230 ~ 250) can be built in a three-tier web computing environment of a web server, application server, database, wherein the app server 240 serves as an application server in a client / server environment. . The app server 240 provides an application execution environment and a database connection function, manages transactions, performs business logic for processing tasks, and performs application interworking between different types of systems.

According to an embodiment of the present invention, effective distribution can be induced through functional classification of the web server 230 and the WAS 240. The static data is structurally processed by the web server 230 existing in the front, and the dynamic data can be processed by the WAS 240 at the rear end. For example, service requests are not passed to the WAS 240 by processing HTML and JavaScript files, CSS, images, etc., which are static data, of the user's request by placing them in the web server 230 at the front end. In addition, by passing the web application service to the WAS 240 located behind the location, the WAS 240 can focus on performing the web application. The method of processing the web server 230 and the data to be passed to the WAS 240 may be processed through the configuration of the web server 230. Whether to pass a specific extension or directory task to the WAS 240 is handled by the web server 230.

The database server 250 is a storage in which various data handled by the web server 230 and / or the app server 240 are stored. The database server 250 may store a tremendous amount of data associated with it according to the nature of the work, website, and web application that the web server 230 and / or app server 240 process. This may include personal information, institutional information, data associated with various contents (eg, multimedia contents), and the like.

The packet mirroring device 200 may be disposed in at least one of between the network 220 and the web server 230, between the web server 230 and the app server 240, and between the app server 240 and the database server 250. Can be. The packet mirroring device 200 is disposed in at least one of between the network 220 and the web server 230, between the web server 230 and the app server 240, and between the app server 240 and the database server 250. The performance of network servers is diagnosed based on a packet that is connected to a switching device (not shown) and mirrors packets transmitted and received between two entities. According to the above embodiment of the present invention, since the mirrored packet can be generated by copying based on the packet actually transmitted and received (actually used user traffic), a separate artificial test packet can be generated for diagnosing the performance of the network service. no need. In particular, the packet mirroring device 200 can monitor all packets in real time.

The packet mirroring device 200 is based on various information included in the mirrored packet (eg, source ID, destination ID and time information, etc.) to indicate the performance of the network service. Calculate indicators in real time. The calculation of indicators can be done on a transaction basis. The calculated index may exceed 120, which will be described in more detail with reference to FIG. 5 below. Based on the calculated indicators, the packet mirroring device 200 determines whether there is a problem such as a speed delay, a wait delay, a traffic excess, or an error in each section, so that an operator or an administrator can check the determination result Visualize. That is, it is possible to quickly identify the error section and to quickly respond to the error section based on this. As the management of these network services is performed at a single point, it is possible to efficiently manage the IT management, which has been distributed to several representatives, and show the status of network services in all sections at a glance, and immediately check for errors. Support, and respond to it.

Moreover, the packet mirroring device 200 analyzes the mirrored packet to track access (related to security issues) from a malicious user, and also enables a response in real time.

According to the above embodiment of the present invention, since the packet mirroring device 200 is connected to the switching device, it may not require installation of an agent that substantially loads the server terminals 230-250. That is, it does not place a burden such as slowing down the work speed of the server stage (230 ~ 250). However, the packet mirroring device 200 of the present invention is not necessarily configured in hardware, and can be installed and operated in software, a switching device, or other device.

3 is a block diagram illustrating a connection configuration between a packet mirroring device and another device on a network according to an embodiment of the present invention.

Referring to FIG. 3, a router 322 is connected to a network such as the Internet 320, and the router 322 is connected to a switch 324 to connect to servers 330- related to a request of a client terminal (not shown). 1 to 330-3), and transmits information related to the response to the request from the servers 330-1 to 330-3 to the client terminal.

The router 322 or a router (not shown) having a routing function extracts a location and a destination of a packet transmitted from a client terminal through the Internet 320, designates an optimal path for the location, and follows this path. The data packet is diverted to the switch 324. The router 322 identifies the IP address and forwards the data to the switch 324.

The switch 324 remembers the unique MAC addresses of each of the servers 330-1 to 330-3, and then determines which packets should be transmitted to where through these addresses and receives the packets provided from the router 322. Send to the server (330-1 ~ 330-3). The switch 324 includes switches serving as OSI 2 layers, OSI 3 layers, OSI 4 layers, and / or other layers (eg, OSI 7 layers). For example, a function of setting a path may be performed. Also, it can perform functions such as load balancing, port forwarding, and QoS. The switch 324 may be referred to as a network switch, switching hub, port switching hub, or the like.

The packet mirroring device 300 is connected to the switch 324 and is obtained by mirroring almost all packets provided to the servers 330-1 to 330-3 through the switch 324. Packet mirroring, that is, replication or capture of packets may be performed at switch 324. In some cases, it may be made in the packet mirroring device 300 itself. The switch 324 replicates the packets provided to the servers 330-1 to 330-3, and then sets the port connected to the packet mirroring device 300 as a destination port to the packet mirroring device 300. Can provide. At this time, the corresponding port can be designated and provided for analysis.

4 is a conceptual diagram illustrating an operation of each section of the packet mirroring apparatus according to an embodiment of the present invention.

Referring to FIG. 4, as described in FIGS. 2 and 3, the client terminal 410 transmits packets through the Internet 420 to the server terminals 430, 440, and 450, at this time, with the Internet 420 Between the server 430, a router 422 and a switch 424 exist, and the packet mirroring device 400 is connected to the switch 424.

The packet mirroring device 400 may analyze the mirrored packet to check the user experience delay time at the client terminal 410. In addition, information related to traffic to the initial server 430 may be identified through the Internet 420, and response latency at the server terminals 430, 440, and 450 may also be checked. In particular, the response waiting time of the server stages 430, 440, and 450 is determined for each section. Response wait times of the web server 430 and WAS 440 sections and the WAS 440 and DB server 450 sections are calculated and handled separately. Web latency and app latency can be calculated separately. Here, the web response waiting time represents a response delay time until a static URL (image (gif, png, jpg, etc.), css, js, text, etc.) receives data from the web server 430, and the app response waiting time. Is the response delay time until receiving the first packet of a page generated from a dynamic URL or a post URL. App response wait time can be associated with dynamic content including query parameters, HTML, ASP, JSP, PHP, and dynamic content (page) and / or calls using HTTP POST methods. That is, it represents the response waiting time associated with the operation returned via the WAS server 440 and / or the DB server 450.

First, the user's sensation speed in the client terminal 410 is determined as the page loading time. This is analyzed and visualized as the user's sensation speed for each major web page. That is, when there are a large number of users accessing a specific web page, it is possible to grasp the sense time of each user environment and / or region of the plurality of users. The user environment may be differently identified for each region, the OS installed in the client terminal, the type of web browser, and the type of terminal. In addition, it is possible to provide access status and distribution monitoring environment by region. At this time, the access status by region may be provided by dividing the global regional status for the entire global region and the local regional status for the domestic region.

The actual traffic generation status of the user section (network section) up to the server 430 may be expressed as a network round trip time (RTT). This can also be called network time. Here, with respect to usage, BPS (Bit Per Second) information indicating data transmission speed per second, UPS (User Per Second) information indicating the number of users connected per second, and CPS (Connection indicating the number of new sessions connected per second) Per Second) information and TPS (Transaction Per Second) information indicating the number of transactions occurring per second are also grasped. In addition, user applications can be monitored, and abnormal behavior by users can be analyzed and tracked. Through these performance-related indicators, it is possible to recognize an application occupying network traffic, and to monitor correlation of users, applications, and networks.

Additionally, the packet mirroring device 400 can also grasp the response delay time between the servers 430, 440, and 450. That is, the response quality index for each server section can be identified. Here, the response delay time for each server, the number of waiting sessions for each server (wait), and the index for each application URI and / or the index for each DB server query (DB Query) can be determined. Can be.

5 is a block diagram specifically showing a packet mirroring apparatus according to an embodiment of the present invention. 5, the packet mirroring apparatus 500 according to an embodiment of the present invention may include a port 510, a packet analysis module 520, a service module 530, and a user interface 540. have. Also, a packet analysis database 522 and a service database 532 may be further included.

Referring to Figure 5, the port 510 may be provided with at least one, which is connected to the switch devices (524-1, 524-2, ...). One port can be connected to one switch device. The connected ports receive the mirrored packet information from the switch devices 524-1, 524-2, ..., and transmit the mirrored packet to the packet analysis module 520.

The packet analysis module 520 collects the mirrored packets and analyzes the packets substantially. This can be called an analysis engine. The packet analysis module 520 primarily analyzes the header of the packet in the mirrored packet. Through this, it is distinguished whether it is an HTTP packet, a DB related packet, or a TCP related packet. That is, it identifies which protocol is associated with the packet. Through this, it is possible to check to which server the request information such as "GET / web address / HTTP / 1.1" has been transmitted. The packet analysis module 520 parses the packet header information and parses it. "GET" becomes the request message, and "web address" indicates the web address associated with the request. In addition, "HTTP / 1.1" means an HTTP 1.1 version, and in addition, language information associated with a packet (eg, ko-kr) may be checked and stored. In addition to GET, request method, POST, HEAD, PUT, DELETE, etc. may be transmitted depending on the situation, and the packet analysis module 520 stores this information together with time information and related IP.

The packet analysis module 520 assigns an index of each packet, and checks which packet is a corresponding HTTP request packet or a response packet based on the index. At this time, a comparative analysis with information obtained from packets that have been received in the past is also performed. That is, if there is a request packet obtained from the first entity, there may be a response packet therefrom from the second entity, and at this time, at least two or more packets in time series, packets transmitted and received from the first entity and the second entity Based on one session establishment, transaction flows can be analyzed.

In addition, the packet analysis module 520 may parse which browser the client terminal used, information related to HOST, previous URL address information, and browser support language information. In this case, it is possible to analyze what kind of header (general header, request header, or entity header), and parse information indicating the boundary between the header and the payload.

Then, the packet analysis module 520 secondly, analyzes a uniform resource locator (URL) (or uniform resource identifier (URI)), a source IP (Source_ip), a destination IP (Dest_ip), and time information of the mirrored packet. do. Here, by checking the URL value, it is possible to check which address is redirected to a packet such as "https://www.google.co.kr/?gws_rd=ssl". In addition, the source IP may indicate the IP address of the client terminal, and the destination IP may indicate the IP of the server associated with the final destination site of the request. In the case of a response packet, the opposite information may be indicated. Time information may be provided in the form of a time stamp. In addition, length information (length) of the entire packet can be checked.

The packet analysis module 520 includes packet analysis algorithms corresponding to various protocols, such as HTTP, IP, UDP, TCP, DNS, and adaptively to each protocol, URL, source IP, The destination IP and time information can be extracted and used for analysis.

Based on the packet-related information extracted by the second analysis, performance index information of about 120 elements per transaction can be generated. Preferably, 6000 transactions are analyzed per second. Then, the extracted packet-related information and about 120 performance index information generated per transaction are stored in the database 522. Hereinafter, a performance-related index generated based on packet-related information of the mirrored packet will be described in more detail.

The packet analysis module 520 calculates round-trip arrival time information (RTT information) on a transaction basis. That is, round-trip time information of the data signal is calculated. The algorithm related to the calculation of RTT information will be described in more detail with reference to FIG. 7 below.

Then, the packet analysis module 520 generates session information. This may indicate the number of sockets established per second, that is, the number of sockets connected without interruption. In addition, the packet analysis module 520 calculates response latency information taken before a client sends a request and receives a response from a specific server. This can be seen as the latency it takes to query a database, run an application, or do other work.

The packet analysis module 520 includes BPS information indicating the size of bits transmitted or received per second, packet per second (PPS) information indicating the number of packets transmitted or received per second, and the number of users connected per second (IP Standard). This can calculate how many users are connected per second based on the number of source IPs connected to a specific destination IP. In addition, CPS information indicating the number of new sessions connected per second (indicating how many sessions are newly connected per second) and TPS information indicating the number of transactions occurring per second (indicating how many transactions are occurring per second) Calculate Then, the packet analysis module 520 calculates Hit Per Second (HPS) information indicating the number of URLs requested per second. At this time, the packet analysis module 520 calculates HPS based on how many URLs are requested per second from the server in the case of server HPS, and based on how many URLs are requested from the client in the case of client HPS Calculate HPS. Then, the packet analysis module 520 calculates Server Per Second (SPS) information, which is information on the number of servers connected per second. This indicates how many servers the client is connected to per second.

In addition, the packet analysis module 520 calculates wait information indicating the number of waiting sessions for response. This is the number of sessions in which the client has sent a request and has not received a response. If the server has 100 real-time sessions, and 10 is Wait, 10 of the 100 sessions have not yet received a response.

Moreover, the packet analysis module 520 generates client_ip, server_ip, client_port, and server_port information. This represents IP information of the client, IP information of the server, port information of the client, and port information of the server, respectively. At this time, the client_ip and server_ip information uses a string as a unit (eg, 222.103.141.187), and the client_port and server_port information uses a number as a unit (eg, 1254 or 80).

The packet analysis module 520 may calculate transaction_number information. The transaction_number information is the transaction number created after the session was established. 1 is the first transaction after the session is established. Normally, after a session is established, several transactions occur. At this time, the number is incremented by 1 and indexed. When viewing a page in the browser, when multiple components are processed in one session when requesting each component (js, css, image, etc.) in the page, indexing can be made by incrementing by 1 per transaction. For example, if it has transaction_number information of 8, it indicates that it was the 8th transaction after the session was established.

The packet analysis module 520 generates start_time information, start_usec information, end_time information, end_usec information, fin_time information, and fin_usec information in relation to the start and end of a transaction. This is based on the source ip, destination ip, and time information of the mirrored packet, the details of whether the same source (client) and destination (eg, server) send request packets within a certain time interval and receive all of the related data. It can be obtained by analyzing.

The start_time information indicates a transaction start time (year / month hour, minute, and second: for example, 2012-07-18 22:33:06), and the start_usec information indicates a transaction start time (part per millionth). The start_usec information may be a completed time by combining with the start_time (eg, 2012-07-18 22: 33: 06.288370).

end_time information indicates a transaction end time. That is, it indicates the end of data (time when the last response data of the transaction was received). For example, it can be expressed as 2012-07-18 22:33:12.

The end_usec information indicates the transaction end time in millionths of a second.

The fin_time information indicates the time when the next transaction comes after the transaction ends, the transaction completes (receives fin), or ends with a timeout. For example, it can be expressed as 2012-07-18 22:35:23.

fin_usec information: It indicates the transaction end time in millionths of a second.

The packet analysis module 520 stores the transaction state with the information name “state”. This can be expressed as 7 numbers, as follows.

Transaction Status Code

1-session_finish: initial state

2-3whs_syn_sent: client sent syn during 3 handshake

3-3whs_syn_received: Client received syn / ack during 3 handshake

4-3whs_ack_received: Server received ack during 3 handshake

5-session_connected: Session is connected

6-session_request: The state that the client has made a request

7-session_response: the server has responded

Next, the transaction result is stored with the information name "result". This can be expressed as 11 numbers, as follows.

Transaction result code

1-trans_finish: one transaction is over

2-client_finish: the client has ended the session (send Finish-FIN)

3-server_finish: The server has ended the session (send Finish-FIN)

4-client_reset: the client has ended the session (reset-RST is sent)

5-server_reset: The session is ended by the server (reset-RST is sent)

6-client_timeout: client is sending a request and has been terminated due to Timeout

7-server_timeout: The server was sending a response, and it was terminated due to Timeout

9-session_error: HTTP session error

10-req_parser_error: HTTP Request Header error

11-rsp_parser_error: HTTP Response Header error

Next, the packet analysis module 520 calculates time information related to the response delay of the transaction. This includes tran_latency, tran_rsp_time, used_time, and fin_used_time information.

The tran_latency information indicates the transaction response waiting time. This represents the wait time from when the client sends a request to receiving the first data from the server. It is in millionths of a second. For example, it may have a value of 76328. tran_rsp_time is a transaction response time, and indicates the transmission time of response data. That is, it indicates the time at which the server has transmitted the response data. Again, this is in millionths of a second. The used_time information is the total transaction use time and can be calculated as "End Time-Start Time". This represents the time taken between the client-server session and the client request and server response. The fin_used_time information is the usage time until the end of the transaction, and is calculated as "Fin Time-Start Time".

The packet analysis module 520 calculates session_req_pkts, session_req_bytes, session_rsp_pkts, session_rsp_bytes, session_bps, sess_max_bps, session_pps, and sess_max_pps information.

The session_req_pkts information indicates the number of transaction request data packets, which is calculated based on the number of packets sent by specific clients as request data. This is based on the number. The session_req_bytes information represents bytes of request data of a transaction, and is calculated based on the amount of bytes sent by specific clients as request data. The unit is byte. The session_rsp_pkts information indicates the number of transaction response packets, and is calculated based on the number of packet of response data sent by a specific server to the client. The number is in units. The session_rsp_bytes information represents bytes of response data of a transaction, and is calculated based on the amount of bytes sent by a specific server as response data. The unit is byte. The session_bps information represents the real-time BPS of the session, and is calculated based on the BPS of the currently established session. The unit is a number. The session_pps information represents the real-time PPS of the session, and is calculated based on the PPS of the currently established session. The unit is a number. The sess_max_pps information represents the maximum PPS of the session, and is calculated based on the maximum PPS during the period in which the corresponding session is to be used. The unit is a number.

Next, the packet analysis module 520 generates domain, url, method, and response_code_number information.

The domain information indicates information related to the domain among the URLs requested by the client. This is in string units. For example, it indicates information such as "www.lgmobile.co.kr".

The url information is a URL requested by a client, and indicates information such as "/jsp/front/search/include/akc.jsp". The unit is a string.

The method information is a type of request method (POST, GET, HEAD, PUT ...), and indicates the type of the request method requested by the client. The unit is a string.

The response_code_number information is a response result and is indicated by an HTTP status code. For example, the Response Status Code that the server responds may be expressed as one of "200, 304, 404, 500 ...". The unit is a string.

The packet analysis module 520 calculates users, max_users, sessions, max_sessions, wait, max_wait, ups, max_ups, cps, max_cps, tps, max_tps, latency, max_latency, and idle information in relation to a specific url.

The users information indicates the number of real-time users (based on the client IP) of the corresponding Url, for example, "the number of real-time users of /jsp/front/search/include/akc.jsp". The unit is a number.

The max_users information indicates the maximum number of users of the corresponding Url during the time when the Url is being used, for example, "the maximum number of users of /jsp/front/search/include/akc.jsp". The unit is a number.

The sessions information may indicate the number of real-time sessions of the corresponding Url, for example, "the number of real-time sessions of /jsp/front/search/include/akc.jsp". The unit is a number.

The max_sessions information indicates the maximum number of sessions of the corresponding Url during the time that the Url is being used, and may indicate, for example, "the maximum number of Sessions of /jsp/front/search/include/akc.jsp". The unit is a number.

The wait information is the number of real-time waits of the corresponding Url, and may indicate, for example, "the number of real-time response waiting sessions of jsp / front / search / include / akc.jsp". The unit is a number.

The max_wait information is the maximum number of response waiting sessions of the corresponding Url during the time that the Url is being used, and may indicate, for example, "the maximum number of response waiting sessions of /jsp/front/search/include/akc.jsp". The unit is a number.

The ups information may indicate a real-time UPS of the corresponding Url, for example, "real-time UPS of /jsp/front/search/include/akc.jsp". This means "users connected per second to /jsp/front/search/include/akc.jsp". The unit is a number.

The max_ups information indicates the Max UPS of the corresponding Url, for example, “Max UPS of /jsp/front/search/include/akc.jsp”. The unit is a number.

The cps information may indicate the real-time CPS of the corresponding Url, for example, "real-time CPS of /jsp/front/search/include/akc.jsp". This means "the number of sessions connected per second to /jsp/front/search/include/akc.jsp". The unit is a number.

max_cps represents the Max CPS of the corresponding Url, for example, "Maximum CPS of /jsp/front/search/include/akc.jsp". The unit is a number.

The tps information may indicate the real-time TPS of the corresponding Url, for example, "real-time TPS of /jsp/front/search/include/akc.jsp". This means "/jsp/front/search/include/akc.jsp, the number of transactions occurring per second". The unit is a number.

The max_tps information indicates Max TPS of the corresponding Url, and for example, “max TPS of /jsp/front/search/include/akc.jsp”. The unit is a number.

The latency information is the latency of the corresponding Url, and for example, may indicate "real-time latency (response latency) of jsp / front / search / include / akc.jsp". The unit is a number.

The max_latency information indicates Max Latency of the corresponding Url, and for example, “Maximum Latency of /jsp/front/search/include/akc.jsp” (response waiting time). The unit is a number.

The idle information indicates the Idle of the corresponding Url, for example, "time when there was no request of /jsp/front/search/include/akc.jsp". If the Url is used a lot, the Idle is shortened, and if the Url is not used a lot, the Idle is longer. The unit is a number.

The packet analysis module 520 may generate content_len, mime, referrers, agent, and cookie information by analyzing the headers of the client's request packet and the response packet from the server.

content_len, information indicates the content length of the response header, and indicates the length of the content included in the response HTTP header sent by the server. For example, it may mean "byte of /jsp/front/search/include/akc.jsp". The unit is a string.

The mime information indicates the response header content type. For example, it may be one of text / html. This is the content type information included in the response HTTP header sent by the server. The unit is a string.

Referrers information indicates a referrer of the request header, and a referrer included in the request HTTP header sent by the client. For example, the referrer of "/jsp/front/search/include/akc.jsp can be considered as the meaning of http://www.lgmobile.co.kr/jsp/front/search/include/miniAkc.html". have. The unit is a string.

The agent information indicates the agent (Agent) in the request header, which indicates the agent included in the request HTTP header sent by the client. This information is often included and sent by browsers, and may include information such as OS version, browser type, and version.

The cookie information indicates a cookie in the request header and contains information related to the cookie included in the request HTTP header sent by the client.

The packet analysis module 520 is information related to network service of a specific server, server_countrys, server_max_countrys, server_error, server_user, server_max_user, server_sessions, server_max_sessions, server_bps, server_max_bps, server_pps, server_max_pps, server_rtt, server_max_rtt, server_ups, server_ups, server_ups, server_ups , server_tps, server_max_tps, server_hps, server_max_hps, server_wait, server_max_wait, server_idle information can be generated.

The server_countrys information indicates the number of real-time countries on the server. For example, it may mean "the number of real-time countries of users connected to the server 203.247.157.199". Based on this, it is possible to analyze the fact that two countries are currently connected to the 203.247.157.199 server.

server_max_countrys information indicates the Max Country number of the server. That is, in the case of a registered server, the Max criterion may indicate one day. This can be changed with user settings. For example, it may mean "the maximum number of countries connected to the server 203.247.157.199". Through this, it is possible to analyze that the 203.247.157.199 server has been connected to up to 10 countries simultaneously.

The server_error information indicates the number of real-time errors (400, 500 Response Codes) of the server. For example, 203.247.157.199 may indicate the number of user errors and / or server errors from 400 to 599 among Response Status Codes that the server responds.

The server_user information indicates the number of real-time users of the server (based on Client IP). For example, it may mean "the number of real-time users of the 203.247.157.199 server".

The server_max_user information indicates the maximum number of users of the server. Here, in the case of a registered server, Max's standard may be one day. This can be changed with user settings. For example, it may represent "203.247.157.199 server maximum number of users".

server_sessions Indicates the number of real-time sessions of the server. The server_max_sessions information indicates the number of Max sessions of the server. server_bps information indicates real-time BPS of the server. server_max_bps information indicates Max BPS of the server. server_pps information indicates the real-time PPS of the server. server_max_pps information indicates Max PPS of the server.

server_rtt information indicates real-time RTT of the server. The server_max_rtt information represents the Max RTT of the corresponding server, for example, it can be solved with "maximum average RTT of the 203.247.157.199 server". The unit of server_rtt information and server_max_rtt information is micro sec.

server_ups information indicates the real-time UPS of the server. This can represent "real-time UPS of 203.247.157.199 server", which means that there are about 1 user per second connected to the 203.247.157.199 server.

The server_max_ups information indicates the Max UPS of the server.

The server_cps information may indicate the real-time CPS of the corresponding server, for example, "real-time CPS of the 203.247.157.199 server". This means that about 20 sessions per second are connected to the 203.247.157.199 server.

The server_max_cps information indicates the Max CPS of the server.

The server_tps information indicates the real-time TPS of the corresponding server, for example, "203.247.157.199 real-time TPS of the server". This indicates that approximately 20 transactions per second are occurring in the 203.247.157.199 server.

server_max_tps information indicates Max TPS of the server.

server_hps information indicates real-time HPS of the server. For example, it may indicate "real-time HPS of the 203.247.157.199 server". This means that about 20 Urls per second are requested to the server 203.247.157.199.

server_max_hps information indicates Max HPS of the server.

server_wait information indicates the number of waits for the server. For example, "203.247.157.199 real-time wait number of servers" may be indicated. This may indicate that 46 of the 206 sessions are waiting for a response on the 203.247.157.199 server.

The server_max_wait information indicates the number of Max Waits for the server.

The server_idle information indicates the Idle Time of the server. For example, it may indicate "time when there was no request to the server 203.247.157.199". If the server has many users, Idle is short, and if the number of users is small, Idle is long. The unit is micro sec.

According to an embodiment of the present invention, server_countrys, server_max_countrys, server_error, server_user, server_max_user, server_sessions, server_max_sessions, server_bps, server_max_bps, server_pps, server_max_pps, server_ups, server_max_ups, server_cps, server_max_ server, server_max, server_max, The unit of information is a number.

The packet analysis module 520 is information related to network service of a specific client, client_country_code, client_error, client_servers, client_max_servers, client_sessions, client_max_sessions, client_bps, client_max_bps, client_pps, client_max_pps, client_rtt, client_max_rtt, client_sps, client_cps, client_cps, client_cps, client_cps , client_max_tps, client_hps, client_max_hps, client_wait, client_max_wait and client_idle information can be generated.

The client_country_code information indicates the client's country code (KR ..). For example, "222.103.141.187 country of the client may represent KR".

The client_error information indicates the number of real-time errors of the client. For example, "222.103.141.187 The number of errors from 400 to 599 of the Response Status Code among the transactions requested by the client" may be indicated.

The client_servers information indicates the number of real-time server connections of the client, which is calculated based on the server currently being monitored by the packet analysis module 520. For example, "222.103.141.187 The number of servers the Client is currently connected to" may be indicated. The client_max_servers information indicates the maximum number of concurrent servers of the client. The client_sessions information indicates the number of real-time sessions of the client. The client_max_sessions information indicates the maximum number of sessions of the client.

The client_bps information represents the real-time BPS of the client, the client_max_bps represents the maximum BPS of the client, the client_pps information represents the real-time PPS of the client, and the client_max_pps information represents the maximum PPS of the client.

The client_rtt information represents the real-time RTT of the client, and the client_max_rtt information represents the maximum RTT of the client. The unit of client_rtt information and client_max_rtt information is micro sec.

 The client_sps information indicates the real-time SPS of the client and how many servers are currently connected per second. The client_max_sps information indicates the maximum SPS of the client. The client_cps information indicates the real-time CPS of the client, which indicates how many sessions are connected per second. The client_max_cps information indicates the maximum CPS of the client. The client_tps information indicates the real-time TPS of the client, which indicates how many transactions per second are currently occurring. The client_max_tps information indicates the maximum TPS of the client. The client_hps information represents the real-time HPS of the client, and the client_max_hps information represents the maximum HPS of the client.

The client_wait information indicates the real-time wait number of the client, and indicates the number of sessions currently waiting for a response from a specific client. The client_max_wait information indicates the maximum number of waits of the client, and the client_idle information indicates the real-time idle time of the client, which indicates the time when there was no request from a specific client. The unit of client_idle information is micro sec.

According to embodiments of the present invention, client_country_code, client_error, client_servers, client_max_servers, client_sessions, client_max_sessions, client_bps, client_max_bps, client_pps, client_max_pps, client_sps, client_max_sps, client_cps, client_max_cps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps, client_tps The unit is a number.

Additionally, the packet analysis module 520 may generate org, city_id, isp_id, os_id, browser_id, mobile_id, and telcom_id information.

The org information indicates the organization of IP-based clients. For example, "222.103.141.187 Client's organization" may indicate that it is Korea Telecom.

The city_id information can indicate the city code of the IP-based client. For example, "222.103.141.187 Client City" may indicate that it is Seoul.

The isp_id information indicates the ISP code of the IP-based client. For example, "222.103.141.187 Client ISP" may indicate that it is Korea Telecom.

The os_id information indicates the OS code of the client of the client. Through this, it is possible to check information on whether the client uses Win XP, iOS, or Android as the OS.

browser_id represents the browser code of the client. Through this, you can check information on whether the client is using a web browser, explorer, chrome, or MSIE9.

mobile_id information indicates the mobile code of the client. This is the device identification information of the client, and indicates information on whether it is a Samsung, Pantech, or Apple device.

The telcom_id information indicates the client's TelCom Code. This indicates whether the client's carrier is SKT, KT, or LGT.

The network service performance related indicators associated with the above 120 packets are generated in real time and stored in the database 522.

The service module 530 generates statistics based on performance-related indicators stored in the database 522. Statistics may be performed in a specific server unit, a specific user unit, a URL unit, a session unit, a server group located in a specific region, a client group unit located in a specific region, and / or a web page unit. The service module 530 appropriately visualizes the performance-related indicators so that the user can intuitively grasp the performance of the service according to the current network by using various preset visualization tools. Visualization is performed based on statistics. That is, it is possible to generate a graph or table in a meaningful form by collecting indicators associated with a specific mediator. For example, a list of sessions created in a specific time period in association with a specific client or server, or a table for a database query generated at the time is performed. That is, since the performance-related indicators associated with the network service are stored together with the time information (timestamp information) of the corresponding packet, a flow map to understand the packet flow in a specific time period in relation to the client terminal and the server end You can also create Various statistics and corresponding visualization methods will be described in more detail through the following drawings.

The service module 530 may generate a specific graph or a specific table / list in response to input from a user, a desired time or a desired environment (for example, a specific web browser type or a specific user terminal type (mobile or PC)) You can search and search based on criteria variables such as: The service module 530 may classify desired data based on the selected reference variable to generate visualization information in an appropriate form.

According to an embodiment of the present invention, the service module 530 may perform an alarm function for finding and displaying a problem portion in a network service. For example, when the number of waits is greater than or equal to a threshold, it may be determined that there is a problem with the response speed of the corresponding section, and visually indicate that there is a problem with the corresponding section. The warning means according to the occurrence of the problem may be implemented in a form of transmitting a text message or e-mail to a pre-stored contact person in addition to visually expressing it differently. This will be described in more detail through FIG. 12.

Various statistical data generated by the service module 530, visualization information data, information related to the visualization tool, and various threshold information set by the user are stored in the service database 532, and the user may randomly select through the user interface 540. When requesting the processed information of, it can return the corresponding information.

The user interface 540 includes a device that receives various inputs from an operator and outputs visualized information such as graphs or tables generated by the service module 530. It may include input means such as a mouse, keyboard, and touch pad, and output means such as a monitor and a touch screen. The user is associated with information about the server (e.g., server name, server IP, associated URL, port, sort number, server location information, processable IP area, etc.), various server-side connection relationships (links) ), And a UX / UI database information including a visualization database for output to a user and / or metadata associated with the visualization. In addition, a rule set for determining a problem occurrence and various setting values associated with the rule set may be input.

6 is a flowchart schematically illustrating a method for diagnosing network performance of a packet mirroring apparatus according to an embodiment of the present invention.

Referring to FIG. 6, the packet mirroring device acquires the mirrored packet from the switching device (S610).

Then, after extracting the source IP, destination IP, and time information from the mirrored packet, various performance-related indicators are calculated (S620). Some of the performance-related indicators may be calculated in units of transactions, and certain performance-related indicators may be calculated in seconds.

Then, the performance-related indicators calculated by the packet mirroring device may be stored in a local storage and / or an external database (S630). And, in order to visualize the statistical information desired by the user and / or the network manager of the client terminal based on the calculated performance-related index, statistics for each index may be generated, and search and inquiry results for the desired information may be returned. . In addition, if it is more than a specific value in connection with the service, it is determined that the problem is on the network, and it can be displayed for each section or for each website.

7A and 7B are conceptual views illustrating a network round trip time (RTT) index between a user and a server calculated by a packet mirroring device according to an embodiment of the present invention.

Referring to FIG. 7A, a packet mirroring device calculates round trip time (RTT) information of a packet on a network between a user and a server. At this time, it is assumed that the packet mirroring device is between the client and the server. Assuming a basic synchronization scenario, the first client sends a synchronization signal (SYN), the server receives it, the server sends a synchronization signal and a response signal (ACK) together in response to the received synchronization signal, and the client The response signal ACK may be transmitted in response to the signal from. The transmission and reception of these three signals can be called a 3-way handshake.

In this signal transmission scenario, since the packet mirroring device is between the client and the server, the mirrored packet arrives at the T1 time earlier than the time when the synchronization signal (SYN) arrives at the real server starting from the client. Then, the synchronization signal and the response signal from the server arrive at the packet mirroring device at a T2 time earlier than the client arrival time. Finally, the response signal (ACK) from the client arrives at the packet mirroring device at a T3 time earlier than the arrival time at the server.

In this relationship, the packet mirroring device can secure T1 to T3 time information in relation to three packet transmission / reception times, and set the TTT value “T3-T1” shifted from the arrival time at the server to a predetermined time earlier. Can be calculated using This can be called a network RTT.

Referring to FIG. 7B, the network RTT can be further subdivided to calculate the RTT at the server and the RTT at the client. The RTT (sRTT) at the server indicates a delay time at the server end for one packet, which can be calculated using "T2-T1".

Also, RTT (cRTT) at the client is RTT at the client, and can be calculated using "T3-T2".

The packet mirroring apparatus according to an embodiment of the present invention calculates and stores the above three RTT, network RTT, server RTT, and / or client RTT for each transaction in real time.

8 is a conceptual diagram showing delay indicators calculated by a packet mirroring apparatus according to an embodiment of the present invention.

Referring to FIG. 8, the packet mirroring apparatus can calculate various delay indicators. In this case, it is assumed that the packet mirroring device exists between the client and the server, the client transmits a plurality of request packets to the server, and the server transmits a plurality of response packets to the client in response to the plurality of requests.

The packet mirroring device includes the T1 time when the first client request packet arrives at the packet mirroring device, the T2 time the last client request packet arrives, the T3 time the first response packet arrives from the server, and the T4 time the last response packet arrives from the server. Can be obtained through the arrival time of the mirrored packet.

At this time, the request transmission time (request time) information of the delay indicator indicates the time that the request has reached the server from the time when the transmission of the plurality of requests from the client to the server. In this regard, the packet mirroring device may know the time at which the first request packet departed from the client based on the T1 time point through a value obtained by dividing the cRTT in half. In addition, the value obtained by dividing the sRTT in half indicates the time when the last request packet reached the real server. Through this arithmetic analysis, it can be calculated using "request time = cRTT / 2 + (T2-T1) + sRTT / 2", and generally the sRTT value is very small, so cRTT / 2 + (T2- T1) It is calculated as the approximate value.

Next, the response latency represents the response delay time from the URL associated with the client's request until the server receives the content or data associated with the request. That is, the server reports that the transmission is performed to the client as soon as the data is received, and indicates the time until the server receives the first data related to the request from the URL. This is calculated as (T2-T3) minus the sRTT value. Here, since the sRTT value may be small enough to be ignored, “T2-T3” may be a response waiting time.

Next, the response data transmission time represents a time required for the server to transmit content related to the request to the client. This is calculated using the equation "response time = sRTT / 2 + (T4-T3) + cRTT / 2". Considering that sRTT is a very small value, it is almost identical to the (T4-T3) + cRTT / 2 value.

If the used time is calculated from sending the request from the client side until receiving the entire response data related to the request, this is the sum of the request transmission time, the response waiting time, and the response data transmission time. time = (T4-T1) + cRTT ".

9 is a conceptual diagram illustrating an indicator of the number of server response waiting sessions calculated by the packet mirroring apparatus according to an embodiment of the present invention.

Referring to FIG. 9, since the server processes at least one request from a plurality of clients, one server also processes a plurality of sessions in connection with the requests. At this time, if the processing time at the server is long, the waiting time at the client is increased, which requires the user of the client device to be patient. Therefore, the number of sessions waiting for a response at the server has a significant significance.

The number of sessions waiting for a response is calculated as the number of sessions remaining after subtracting a session in which actual response data is transmitted to a client through processing by a server among a plurality of sessions associated with the request. For example, if only one response is made for three sessions, the number of waiting sessions for response is calculated as wait = 3-1 = 2. That is, since the packet mirroring device can secure all of the mirroring packets for the actual packet that exists between the client and the server and is transmitted and received between them, it is possible to clearly grasp the number of response waiting sessions currently being processed in the server.

According to an embodiment of the present invention, whether or not processing of a specific request is completed in the server can be confirmed based on whether a response packet for a request for a specific URL is transmitted to a client based on a source ip and a destination ip. In the case of a response packet, it is possible to grasp by checking whether a destination ip and a source ip are included as opposed to the request packet while being associated with the specific URL indicated in the request packet.

10 is a conceptual diagram showing a CPS / TPS (Connection Per Second / Transaction Per Second) index calculated by a packet mirroring device according to an embodiment of the present invention.

Referring to FIG. 10, one transaction includes at least one request between a client and a server and at least one response data packet according to the at least one request. In the embodiment of FIG. 10, three response data packets form one transaction for one GET request, which does not necessarily have a 1: 3 relationship, more request packets, and corresponding responses to the request packets It is okay to have fewer data packets.

These transactions also have important implications for the speed and delay of network services. Accordingly, the packet mirroring device calculates the number of newly attempted transactions per second. This is called TPS. In addition, the number of connections between a specific client and a specific server, which may be referred to as a connection, calculates the number of newly attempted connections per second. This is called CPS.

In addition, UPS (User Per Second) information indicating the number of users connected per second and BPS information indicating the amount of data transmitted / received per second through a specific client, a specific server, or a specific session are periodically calculated. PPS information indicating the number of packets transmitted and received per second, HPS information indicating the number of URLs requested per second, and SPS information indicating the number of servers connected per second are also periodically calculated.

In the embodiments of FIGS. 7A to 10, an exemplary embodiment in which a packet mirroring device exists between a client and a server to calculate various indicators related to network delay between the client and the server is illustrated. It can exist between a plurality of servers to calculate the delay between servers. For example, it can exist between the web server and the WAS server to calculate the delay indicator between the web server and the WAS server, and it can exist between the WAS server and the DB server to calculate the delay indicator between the WAS server and the DB server. In addition, a plurality of packet mirroring devices are disposed in a server terminal including a plurality of servers to calculate delay indicators for each section, and the calculated delay indicators are shared with each other to synthesize delay indicators for each section and each server in the entire server network. It can also be displayed.

According to another embodiment of the present invention, one packet mirroring device is connected to a switch between a client and a web server, a switch between a web server and a WAS server, and a switch between a WAS server and a DB server to mirror one packet. The device may calculate delay indicators for each section and / or each server in a plurality of server sections.

11 is a view showing a flow map (Flow map) generated based on the performance index calculated by the packet mirroring apparatus according to an embodiment of the present invention.

Referring to FIG. 11, a flow map is composed of a user and at least one server and links (associated with sessions) between the user and the server. In this embodiment, a system configuration is shown in which a user is connected to three web servers, three web servers are connected to three WASs, and three WASs are connected to one DB.

According to an embodiment of the present invention, in relation to the part of visualizing the performance indicator of the packet mirroring device, the packet mirroring device is implemented as a network performance indicator visualization device, wherein the performance-related indicator is necessarily generated based on the mirrored packet It is not necessary to use indicators. After acquiring the packet in another way, based on the information in the obtained packet, the performance-related indicator is calculated, and then the performance-related indicator is objectified to flow map, server list, user list, URL list to be described later. , Session list and web page analysis page.

First, in the embodiment of FIG. 11, the packet mirroring device may generate a flow map indicating the traffic flow of the network including each entity based on the calculated performance-related indicators. At the top of the flow map, there is a part for setting a time period to be viewed. If you set it in real time, the flow map of the current time point is played. In order to check the performance of a network service at a specific point in time in the past, a flow map of the past point in time may be reproduced. For example, if you want to see the section from 11:11 on January 2, 2017 to 01:33 on January 3, 2017, the user sets the start time and end time respectively, and is generated based on the corresponding time. Play content associated with the flow map. At this time, a time bar is generated according to the set start time and end time, and for the generated time bar, a flow map at a desired time point can be reproduced through controls such as fast forward movement, fast backward movement, and play / stop. Can be. At this time, it is possible to select an index to be displayed through each link, each user, and each server. For example, at least one of response latency (latency), response waiting session number information (wait), BPS, CPS, TPS, UPS, and the like may be included. Also, you can choose to display IP addresses for each user and each server.

According to an embodiment of the present invention, in the flow map, the user and each server display the performance-related indicator calculated above. In this case, among performance-related indicators, indicators related to network delay and / or speed may be used. Each performance-related indicator is objectified and displayed on a specific visualization space. Here, the object is a data object, and the performance-related indicator is objectified so that it can appear on the flow map. For example, it may include data such as response latency or BPS. Since each performance-related index includes time information, an object may also be implemented to include time information and mapped to a visualization space. The visualization space represents a display space displaying objects, and a plurality of objects may be represented in the visualization space.

In generating a flow map, the packet mirroring device determines whether the performance-related indicator is related to an entity (eg, a client, a server, or a link between a client and a server), identifies which performance-related indicator, and identifies Based on the contents of the performance-related indicators (whether it is BPS, the number of wait-for-response sessions, or the latency of response) and the objects of the performance-related indicators, a flow map is generated in accordance with predetermined metadata in the visualization space. do. In particular, it is a principle that one performance-related indicator corresponds to an object and is expressed in a certain visual form for each indicator. However, performance-related indicators with high relevance (e.g., indicators such as the response waiting speed of the same user and the number of waiting sessions) Can be object with a single visual form. That is, two data may be displayed together in a certain format on one client icon. The same is true for performance indicators associated with server ends and links.

For example, a delay indicator such as a user's response latency of 0.63 ms is objectified and expressed on a visualization space associated with a flow map. Links are objectified based on at least one of performance indicators among a plurality of entities. The server is objectified based on at least one of performance related indicators associated with the server and is represented on the visualization space. The delay indicator displayed on the flow map does not necessarily include the response waiting speed, and may display at least one other indicator of about 120 performance-related indicators generated according to an embodiment of the present invention. At this time, the displayed response waiting speed may indicate the current response waiting speed, and when a plurality of response waiting speeds exist in a plurality of links, the fastest response waiting speed, the average response waiting speed, and / or the most You can display the slow response waiting speed.

In addition, in the flow map, in relation to the user and each server, information on the number of sessions currently being associated with the user and information on the number of sessions waiting to be processed may be displayed in the form of “1/203”.

According to an embodiment of the present invention, a user may be displayed as a user group in a specific region. For example, users in one company may be displayed as a group user related to one company, and at this time, the number of related users may be separately indicated. In addition, users can be classified into a group 1 and a group 2 by classifying users within one group. At this time, the classification criteria may be set by the administrator directly, or may be automatically classified based on information related to the region, organization, and / or IP. In addition, performance-related indicators for classified users may be separately processed. The meaning of the separate processing may mean that the object is generated as a separate object when objectifying in the flow map. That is, in the group of 50 office workers, group 1 is 15 people, and group 2 can be classified as 35 people. At this time, user 1 represents 15 performance related indicators of group 1, and group 2 is the remaining 35 performance related indicators. It may be objectified based on and displayed on the flow map.

In the case of the server, the number of sessions currently being processed and the number of sessions currently being processed may be displayed as "1/122" compared to the total number of sessions connected to the server. Here, the information related to the session may be displayed by changing to information related to a transaction and / or information related to a connection (or link) according to a user setting. That is, about 120 performance-related indicators calculated by the packet mirroring device can be appropriately illustrated in the flow map.

In the embodiment of Fig. 11, each link is associated with sessions across both packet transmission and reception. In the middle of the link, information displayed by being objectized in a square box may include latency indicators such as response waiting speed, response waiting session number information, and BPS. For example, in the case of the user and the homepage_WEB 1 at the top of FIG. 11, the response waiting speed of 0.03 s is shown for a specific packet between two entities, and there are 122 sessions, most of which have been processed, and currently only one session You can see at a glance that this response is waiting. In addition, it can be seen that the service is performed at a high speed with a BPS of 401.4k.

On the contrary, the portal administration_WEB 1 at the bottom of FIG. 11 shows a very slow speed with a response waiting speed of 1.35 s, and the ratio of the number of sessions waiting for a response to the total session of 0/65 is 28.61k. It shows a relatively low BPS. Therefore, due to the low response latency and BPS, the link is marked with a warning related to "interval delay". The warning sign can be expressed through the method of distinguishing the color of the line representing the link, the thickness of the line, or the method of changing the shape of the line. For example, a threshold value associated with a plurality of response waiting speeds is set, and the set threshold value and the current response waiting speed value are compared to distinguish states. The state may be determined by a rule set, which will be described later, and may be divided into a plurality of sections through a plurality of threshold values. For example, it can be classified into states such as "normal", "warning", and "problem", and the state can be determined based on a comparison result with a threshold. There is a visual expression corresponding to the determined state, and the corresponding state may be displayed as the corresponding visual expression. For example, the worst state may be a red color indicating "problem", and a next yellow state indicating "warning" may be used. That is, different visual expressions may be achieved for a plurality of sections corresponding to a plurality of threshold values. The visual expression includes changing at least one of the color, thickness, and shape of the object. In particular, in the state related to the link, the "normal" state is a black line, the "delay" state is a red line, the "network problem" state is a black dotted line, and the "network delay" state is a red dotted line, intuitively at a glance. Can be marked for operator understanding.

Additionally, in the flow map, the web server is associated with at least one WAS server. In particular, the two web servers at the top (homepage_WEB 1 and homepage_WEB 2) are connected while forming a plurality of links with the two WAS servers (homepage_WAS 1 and homepage_WAS 2). That is, the web server (homepage_WEB 1) is also connected to two WAS (homepage_WAS 1 and homepage_WAS 2), and the web server (homepage_WEB 2) is also connected to the two WAS (homepage_WAS 1 and homepage_ WAS 2). Accordingly, four links are generated, and performance-related indicators are respectively displayed for the four links.

In this way, it is possible to express not only the user-web server section, but also the web server-WAS section and WAS-DB section. Due to this visual expression, the user can intuitively present any section on the network server in the present or past. You can determine if there is a problem with the server.

According to another embodiment of the present invention, it is not necessarily represented by three sections of a user-web server section, a web server-WAS section and a WAS-DB section, and one section smaller than this (eg, a user-server section) It may be expressed as, or hierarchically divided into a plurality of DB server sections, it may be expressed as a plurality of DB slave, DB master (DB master) and DB end (DB end). The same applies to web servers or WAS. This overall flow map configuration can be created through user settings (which may be stored as metadata).

In relation to the generation of the flow map, the packet mirroring device configures the web server, WAS server, and DB server associated with the user's request based on the analyzed packet analysis based on the central user (ie, the IP of the client terminal). can do. That is, in the mirrored packet, a server terminal related to the destination ip and / or URL can be extracted as a component of the flow map, and a connection relationship of the flow map can be generated based on the ip of each server to visualize it. Alternatively, a specific specific server may be set first, and a flow map may be generated by linking a user who has sent a request to the server based on the set server and other servers associated with the set server.

Metadata associated with the configuration of the flow map may be stored in advance in the service database (532 in FIG. 5). The metadata may store color, font, physical file location, tile background, etc., as well as information related to the shape and location coordinates of the object object (eg, user, server, and link) to be objectified. This will be described in more detail below.

12 is a table showing an example of a setting value for determining whether an alert related to network performance occurs in a packet mirroring device according to an embodiment of the present invention.

Referring to FIG. 12, in a flow map or other visualized representation, the packet mirroring device may prevent a large traffic problem in advance by warning a user by comparing and displaying performance-related metrics associated with the current network service with various threshold values. Support. Accordingly, various threshold values may be required in relation to the warning determination.

Overall, the judgment on the warning situation can be divided into a server warning and a section warning. Each has a separate usable rule set. For the server section, the part of the server status (Service Down, Server Down), the number of sessions, the number of response waiting sessions, the response waiting time, CPS, TPS, BPS, HTTP 40x or 50x errors It may be determined based on the like. The interval warning may be determined based on the number of response waiting sessions and the response waiting time.

As shown in FIG. 12, the packet mirroring device determines whether a network service problem occurs based on at least some of the performance-related indicators. Response latency information indicating the response delay time until the server receives the first data associated with the content from the URL associated with the request for the client's content and the client has not received a response to the request. It is possible to determine web traffic delay, WAS traffic server delay, excessive WAS traffic wait, DB traffic delay, web WAS section delay, etc. based on the wait-wait session number information indicating the number of sessions. The packet mirroring device may determine whether a problem has occurred by comparing a performance-related indicator with a threshold, and measuring a duration in which a value of a performance-related indicator higher than a threshold as a result of the comparison exists.

First, the web traffic delay may occur when the number of response waiting sessions is 70% or more, and the response waiting time exceeds 5 seconds, for all web servers. Depending on user settings, if this time is more than 10 seconds, it can be determined that there is a problem with web traffic delay.

In addition, the delay of the WAS traffic server may determine that a problem has occurred when the state in which the response waiting time is 5 seconds or more is sustained for 5 seconds or more, targeting the WAS server. The excessive occurrence of WAS traffic wait determines that a problem has occurred when the state where the number of waiting sessions for response to the WAS server is 70% or more lasts for 5 seconds or more.

Delay of DB traffic may occur for all DB servers when the number of response waiting sessions is 30% or more among all sessions and the response waiting time exceeds 5 seconds. Depending on the user setting, if this time is more than 10 seconds, it can be determined that there is a problem with the delay of DB traffic.

Moreover, in relation to the web WAS section delay occurrence, it may be determined that there is a problem in a state in which the response waiting time of 5 seconds or more continues for about 5 seconds or more for all web servers and WAS servers.

Also, the packet mirroring device may determine whether a problem occurs by comparing a speed-related indicator such as a BPS with a threshold. Excessive BPS is targeted to all servers, but it is judged that a problem has occurred if the state where the BPS exceeds 50M continues for more than 5 seconds.

The excessive occurrence of CPS is applied to all servers, and it is judged that a problem has occurred if the state where the CPS exceeds 150 continues for about 10 seconds or more.

In the case of 50X and / or 40X errors, for all web servers, if the status of HTTP 50x error (or HTTP 40x error) exceeding 5 continues for about 5 seconds or more, it is determined that a problem has occurred.

In case of excessive wait, if the total number of sessions exceeds 1000 for all servers, and the ratio of the number of waiting sessions over 80% continues for about 10 seconds or more, it is determined that a problem has occurred.

The various thresholds associated with this problem occurrence, the associated duration threshold, the target server IP, and the alert level accordingly are selected to be changeable by user settings.

According to an embodiment of the present invention, an alert level may be determined to match the above problem situation, and an alert state may be expressed in accordance with the alert level in a flow map and various other visualization tools according to the alert level. In addition, as an action matched to the problem situation, an operation of notifying the warning situation by SMS text, e-mail, and / or social network service (SNS) associated with the predetermined contact account may be performed.

According to another embodiment of the present invention, the packet mirroring device continuously stores data on an index related to network performance over time, so that the stored data forms big data. By applying a machine learning algorithm to the stored big data, it is possible to adaptively generate an appropriate rule set for a warning situation. For example, for a WAS server where a packet mirroring device constantly encounters a WAS traffic delay problem, the threshold value is lowered or lowered based on the data on the average response delay time and / or the number of waiting sessions of past WAS servers. You can set it high.

In addition, the average response delay time and / or the number of response waiting sessions in the normal category, BPS, while storing the response delay time and / or response waiting session number, BPS, or TPS values in the normal category through the past big data Or, if there is a difference over the threshold value compared to the TPS value, it can be determined to determine the occurrence of the problem.

Otherwise, if the service speed delay occurs intensively in only one server in the connection relationship between the web server and the WAS server or the WAS server and the DB server, a speed delay greater than a threshold value compared to the average speed delay value with other servers occurs It is also possible to judge and express a warning.

13A and 13B are diagrams illustrating exemplary aspects of response speed analysis for each section according to a flow map.

13A is a load balancing situation in the morning time period for a specific network service, and it can be confirmed that it operates in a normal situation. 13B illustrates a load balancing situation in the afternoon time related to the specific network service. Here, the number of transactions of 601 is indicated in the uppermost web server, and processing of excessive transactions is indicated.

As described above, it is possible to intuitively grasp the state of the service at a specific time point in the present and past through the flow map. Since the WEB 1 server is processing more transactions than other servers in the afternoon hours when there is a high amount of access, compared to the morning hours, it is possible to notify the operator through a warning display such as a numerical expansion or a red display. In particular, this warning display can be performed through comparison with other servers. That is, when the amount of processing transactions on a specific server is significantly higher than the average processing transaction amount of a plurality of servers existing in a position on a uniform server section, it is possible to determine the occurrence of a problem and compare the set threshold with a warning. have.

14 is a view showing a state of the dashboard (dashboard) for visualizing the performance index between the user and the server.

Referring to FIG. 14, the flow map identifies and visualizes problems for each user, for each server, and for each communication section. It can be updated at a fixed period (eg, in 1 second increments). If you want to look at detailed performance-related indicators for a specific link in the flow map, click the link to check the detailed performance-related indicators.

When one of a plurality of links between a user and a web server is clicked, performance-related indicators such as URL information associated with the link, response wait time information, and a method information list of a packet may be displayed. In the case of a web server and a WAS section and a WAS and DB server section, a list of related performance indicators can be output. Through this, when a specific analysis of a problem in a specific section is needed, the user can specifically grasp the details of related performance-related indicators. The performance-related indicators displayed in the list displayed for each section may be different.

In particular, when it is expressed that there is a problem with a specific link, the specific link is determined as a parameter, and details associated with the specific link as a parameter are called. Then, a detailed history list is displayed. At this time, the packet mirroring device causes the performance-related index (eg, a performance-related index indicating an indicator higher than a threshold value) that causes the problem to be visually different from the normal range indicators such as red in the corresponding list. Allow users to grasp the detailed cause at a glance. That is, the problem portion of the flow map and the related list / page can be expressed to match each other based on parameters.

According to an embodiment of the present invention, settings related to a drill-down movement from a specific map to a specific page (or list) may be stored through user settings, and may be changed to a template desired by the user. . That is, the page (or list) may have hierarchical information, and when a specific area in the list is clicked, the packet mirroring device uses information associated with the area as a parameter and a page (or list) of the lower layer having the same parameter. ).

15 is a diagram showing a monitored page of detailed traffic for each server, user, URL, and session.

Referring to FIG. 15, the packet mirroring device may display the current state in a table form so that the server, user, URL and session associated with the packet mirroring device, and other performance related indicators can be recognized at a glance. The packet mirroring device may generate a list according to a management target server, a user associated with the server, a URL, and a session in connection with a network. This is achieved by periodically monitoring (eg, in units of 1 second) and storing detailed traffic associated with the list. Here, the Max part represents the maximum value associated with the corresponding server, such as server_max_xxxx information (eg, server_max_user information). That is, the maximum management target server, the maximum number of users of the server, the number of URLs and the number of sessions, etc., and the Current part may indicate the currently used server, the number of users, the number of URLs and the number of sessions.

At this time, when a server is clicked, a server list including information of servers currently managed by the packet mirroring device is displayed, as in the drill-down method of FIG. 14. In the server list, the name of the server to be managed, server IP, country, number of users, number of sessions, number of transactions, number of sessions (and ratio) waiting for response, TPS, BPS, app latency, web latency, RTT, error, status Information and the like can be displayed.

When the user part is clicked, the packet mirroring device displays a user list including information of users associated with all clients currently associated with the server to be managed. In the user list, the IP of the client terminal, the server, session, transaction, number of waiting sessions (and ratio), SPS, CPS, TPS, HPS, BPS, PPS, RTT, error, agent, web browser, Information related to cities and institutions may be displayed.

When a session is clicked, a session list including information of sessions currently managed by the packet mirroring device is displayed. In the session list, the IP of the user's client terminal associated with the session, the IP of the server associated with the session, the relevant URL, method, result code value, number of transactions, response waiting time, agent, city, agency, and status information can be displayed. have.

When a URL is clicked, a URL list including information of URLs currently managed by the packet mirroring device is displayed. In the URL list, the IP, URL address, method, result code value of the server associated with the URL, the number of sessions (or the number of currently connected sessions compared to the entire session), number of waiting sessions, UPS, CPS, HPS, BPS, waiting for response Information related to time, number of downloads, and length may be displayed.

At the far right of each list, there is an icon marked as Act. When you click the action icon, packets related to a specific server in the server list, a specific user in the user list, a specific session in the session list, and a specific URL in the URL list Details are displayed. Here, a variable that is a parameter for switching between lists is called a parameter, and in this embodiment, a specific server (eg, WEB_administrative portal 1 server), a specific user, a specific session, and a specific URL are parameters. . That is, in the conversion of the list, in a detailed request through a user's click or the like (also viewed as a list conversion request), a specific parameter by a click is determined, and thereafter, another form associated with the specific parameter The list is displayed. The conversion of the list and the drill-down movement of pages having hierarchical relationships are described in more detail below.

16 is a diagram showing a page for identifying content of detailed session information and an error in an application.

Referring to FIG. 16, as described above, each list managed by the packet mirroring device may be displayed with an association of parameters. That is, when a specific session in the session list is clicked, a specific session is determined as a parameter, and a user list, server list, etc. related to the specific session can be checked. In this case, since information included in the mirrored packet and information related to performance-related indicators are stored while having time information, detailed information included in each list may also have time information, and details of a time point desired by the administrator Can return

In the embodiment of FIG. 16, when a specific session is clicked in the user list, a new session list is displayed by extracting information related to the parameter session and the corresponding session as a parameter (see the upper left list of FIG. 16). . Here, when a specific user's session is clicked, the packet mirroring device determines a user's session associated with the clicked area as a parameter, and relates to 155 sessions currently connected among the maximum 178 session data associated with the specific user. Data is extracted and displayed in the form of a list. That is, the user can check an application related to a specific session associated with the user by viewing the session list. In the corresponding session list, the IP of the client terminal of the user related to the sessions of the specific user, the IP of the server associated with the session, the relevant URL, method, result code value, number of transactions, response waiting time, agent, city, agency, status Information can be displayed.

In addition, in the user list of the embodiment of FIG. 16, when looking at the session 70/143 of the user 172.18.220.14, the session list associated with the session is displayed as shown in the list on the left right of FIG. Here, you can see the user, server IP, and associated URL. And, in particular, you can check the DB query. To check the DB query, the packet mirroring device extracts the contents of packets related to the DB query sent to a specific DB server and network performance indicators of the packets and generates and visualizes them in a list form.

Moreover, as described above, the user list may display information related to network usage for each user such as CPS, TPS, HPS, BPS, and PPS. In addition, information about whether the agent, web browser, mobile device, city, ISP, and institution information can be checked, and information related to the occurrence of an error is also displayed. At this time, when the error part is clicked, the stored information having the error code that the user wants to see is extracted, and a session list is generated and displayed based on information of sessions associated with the extracted information. In the embodiment of FIG. 16, a total of 6 errors are displayed in the user list, and when the error portion is clicked, 6 sessions related to 6 errors may be displayed in the form of a session list.

FIG. 17 is a diagram showing a page for confirming a correlation associated with a problem element by a drill-down method.

Referring to FIG. 17, while outputting a user list through a packet mirroring device, in order to check an application that causes a service delay, when a part of a wait-for-response session (Wait) is clicked, a response over a specific threshold or a specific threshold is waited. A URL list and / or session list indicating the number of sessions may be displayed. The user can see the URL list and / or the session list and clearly identify the application that is currently experiencing a service delay. Then you can react quickly and take action on it.

In addition, in order to view the error part in detail, in the session list, when error 400 and error 500 are clicked, a session list including sessions related to the error is output, and an application related to the error occurrence is viewed while viewing the session list associated with the error occurrence. Can be confirmed.

18 is a view showing a process of confirming detailed information per server and real-time service status for each warning.

Referring to FIG. 18, it is possible to check real-time service status and detailed information for each warning for each server. The packet mirroring apparatus according to an embodiment of the present invention may generate a page displaying server status information. On the page, the server name and server IP are displayed, and among all the allowable sessions, the number of currently connected sessions is displayed. This can be expressed in a form in which a certain part is filled in an empty box form. That is, 10% can be expressed in a form in which only one of the ten empty boxes is filled with color. In addition, this number and / or ratio related information can be expressed in a box form. In addition, a graph of a change in the response waiting time over time and a change in the number of response waiting sessions over time may also be displayed. In this way, by arranging and displaying a plurality of server status information on one page in the packet mirroring apparatus, a user can recognize status information on at least some of the servers managed by the packet mirroring apparatus at a glance.

At this time, the server list may be displayed in the form of a table in the upper right of the server status information, and may be displayed in the form of a list in the lower right of the server status information with warnings related to the server to be managed. When one of them (for example, a warning part called "too many sessions") is clicked, details related to the warning of the clicked area are displayed (see the upper left window of FIG. 18). The packet mirroring device, in response to the alert details request, extracts performance-related indicators of the corresponding point in time of the server, and extracts indicators related to errors therefrom. Then, information related to the information (for example, the server IP and the start time and end time of occurrence of a problem related to a warning) is displayed as a list. The number of warnings is also displayed. In addition, as status information, performance related indicators such as the number of users associated with the corresponding session, the number of sessions, the number of waiting sessions for response, UPS, CPS, TPS, BPS, RTT, waiting time for response, 400 errors and 500 errors are displayed.

When the play icon is clicked in the warning history part, the start and end times related to the warning are automatically set to play the flow map of the corresponding time zone (see the flow map at the bottom right of FIG. 18). Here, it is possible to detect a link or server abnormality associated with a specific session.

At this time, when the link related to the alarm condition is clicked, the detailed log of the alarm condition of the sessions (especially the transaction) associated with the two subjects (client (Tokyo_office) and server (webSRV1)) of the link at that time can be checked (left side of FIG. 18). (See the log data at the bottom) .This includes the log of the transaction in the corresponding time zone, including client IP, number of users, OS, ISP, RTT, etc. as client details, URL address, and response as relevant URL information. Waiting time information, length, referer, etc. are displayed, and server name, response time, user, session, TPS, waiting session number, RTT and BPS information are displayed as server information, and corresponding to time information Information indicating from which point in time the transaction has occurred, information indicating the current state information, for example, whether the session is waiting for a response from the server (session_response) and And information (e.g., client_finish) is also displayed together.

19 is a diagram showing a diagnostic analysis page for a detailed log of the application.

Referring to FIG. 19, the packet mirroring device may display information related to an application in an application list (upper left list in FIG. 19). These include the server's name and IP associated with the application, the number of users, the number of sessions, the number of transactions, and error information, BPS, the amount of request data, the amount of response data, the number of response waiting sessions, and the response waiting time information. Is displayed. At this time, if you want to see the part related to the error of the application, you can click the error part.

Then, in the packet mirroring device, a part related to the clicked area is determined as a parameter. Then, the transaction data associated with the application as a parameter is found. Then, among them, data with an error indication is extracted, and log data related to an application error is output. This is transaction log data, and may be displayed in a form similar to the lower left log list of FIG. 18. Here, it is possible to grasp at which point in time an application error occurred between a client and a server.

In addition, the packet mirroring device may display a response delay time of a specific application in a graph form according to time. In particular, when a specific time is clicked, the clicked time is specified (for example, in a preset unit (1 minute unit)) Extracts packets (or performance-related indicators based thereon) associated with the application at a specific point in time. Here, the server can be expressed in a chart form based on the location of the servers related to the application on the map in conjunction with a map representing geographic information. At this time, the server can be expressed in different forms based on response latency information (latency) generated in the process of request and response processing of the application. That is, the server having the first response waiting time is green, the server having the second response waiting time is light green, and the server having the third response waiting time is yellow, so that the delays of the servers associated with the application are displayed only by the color on the map. Make it possible to understand how much is happening. Then, status information can be displayed at the bottom of the chart and the response wait time graph. The status information includes country status, user status, and URL status, where the URL status is information related to the URL associated with the application, URL address information, method information, transaction number information, error information, HPS, amount of response data, It may include information on the number of sessions waiting for an average response, information on an average number of waiting for responses, information on the number of downloads, and the like.

20 is a diagram illustrating a process of tracking a user by estimating an abnormal access.

Referring to FIG. 20, the packet mirroring device may track an abnormal access user using a specific user list. When the user clicks the action icon in the user list, the packet mirroring device can extract all the connection contents of a specific time zone of the corresponding user and display it in a list form.

At this time, the packet mirroring device may display the session start time and the session end time side by side in the form of a time bar for each session based on the specific time zone. At this time, it is not necessarily displayed for each session, but may be displayed for each transaction or for each URL accessed.

At this time, the time bar may be displayed through different visualization expressions. In particular, the client RTT, the server RTT, the request time, the response waiting time and the response data transmission time are displayed in different visualization expressions (eg, different colors, different shapes, different thicknesses, etc.). Therefore, it is possible to intuitively understand through a time bar what action a specific session was performing in a specific time period in the specific time period.

In addition, the packet mirroring device may extract and display usage time, response waiting time, method, result value, type information related to the URL, status information, and related URL information in connection with the session.

Additionally, the packet mirroring device extracts data related to a packet associated with the specific session in a corresponding time zone when detailed information related to a specific session is requested, and thus time information, cRTT information, sRTT information, request time, response waiting time and response Data transfer time can be displayed with a clearer numerical value than the time bar. URL information can also be displayed as related domain, URL address, type, method, result, BPS, PPS, number of users, number of sessions, and number of waiting sessions for response. In addition, as related server information, server IP, port, number of response data packets, amount of response data, number of users, number of sessions, and number of waiting sessions for response may be displayed.

Since the packet mirroring device can trace back the actions of all users in a specific time period, it is possible to track the users connected through the abnormal route, and the user's abnormal behavior (eg, excessive CPS, excessive TPS, and / or excessive error response) ) From which user.

21 is a diagram showing a page visualizing the sensation speed up to the user's access for each main page.

Referring to FIG. 21, the packet mirroring device provides information on sRTT, cRTT, request time, response waiting time, and response data transmission time ahead of the time to reach the web page based on the web page associated with the user request in the mirrored packet. Can be calculated based on. In addition, in relation to the configuration of the flow map, the time until the response data is received according to the request transmission is calculated based on the number of sessions according to the request to access a specific server, the response waiting time according to the session, and the number of response waiting sessions (wait). can do. That is, the responsive response speed from a user's point of view to a specific web page can be calculated and displayed on one page. For example, the packet mirroring device may utilize a used time as the responsive speed.

The packet mirroring device may convert and display the haptic response times for a plurality of web sites into time values. And, compared to the threshold value associated with the set haptic response time, when the threshold is greater than or equal to, it can be determined as a serious problem occurrence situation such as warning or service down and server down.

The packet mirroring device may express the number of response-waiting sessions associated with the web site in comparison to the total number of allowable sessions, in addition to the haptic response time, as individual information for a plurality of web sites. In addition, it is possible to briefly summarize and express the change in the wait time for response over time.

22 is a diagram showing a page visualizing the response speed of the user's sensation of the main page subject to the warning.

Referring to FIG. 22, when a website in an alert state is clicked, the packet mirroring device causes a performance analysis page according to the alert to be displayed. For example, the performance analysis page may be a web-WAS delay warning, and in the analysis page, related actions are organized into a list based on information in mirrored packets associated with a speed delay at a corresponding time. Display.

At this time, it is possible to analyze and display sessions related to a specific web site and organize actions that have occurred at that time. For example, it is possible to extract the access behavior of the server associated with the web page to the IP. In addition, the client's IP (country, OS, and whether mobile) may be displayed, and the time taken for the corresponding connection activity may be calculated and displayed. In particular, as described above, cRTT, sRTT, request time, server response waiting time, and response data transmission time can be expressed in the form of a time bar.

If this is further refined, detailed information on a session or transaction (or connection) occurring at a specific time can be displayed for a specific web page. On the page, the client IP associated with the session (or transaction), page start time, page end time, OS, browser, mobile device availability information, carrier information, ISP information, and city information are displayed.

In addition, page load time information may be provided in the form of a time bar that distinguishes cRTT, sRTT, request time, server response waiting time, and response data transmission time. Alternatively, it may be displayed in the form of a time bar divided into client time, network time and server time. And, the client time, network time, and server time can be displayed, respectively. Client time refers to the time spent at the client end and includes the page design time and the client itself. The network time includes cRTT information, sRTT information, request time and download time. Server time includes response wait time. At this time, the page design time represents the time required to play the data associated with the received web design on the client terminal, and the client's own time required is the client, such as the time to generate the request information associated with the web page, regardless of the network status. It may mean the time taken for page loading inside the device. In consideration of the time required from the status of status code 5, which means the session is established based on the transaction status code, among the performance-related metrics generated by the packet mirroring device, to the status associated with status code 6 where the session request is performed. Can be calculated. Alternatively, it may be calculated based on the session result code.

In addition, in relation to the use of the web page, usage component information, the amount of request packets, the amount of response data, user information, session information, number of waiting sessions for response, TPS information and error related information are also displayed.

In addition, the details (analysis by component) are displayed by sorting in chronological order for the multiple sessions included in the time, but in the form of a time bar that distinguishes cRTT, sRTT, request time, server response wait time, and response data transmission time. Provided therein, URL information, used time information, response waiting time information, and the like may be expressed. Based on this, the delay component can be extracted.

23 is a diagram showing a page analyzing a user's sensation speed according to a response delay analysis screen for a specific website.

Referring to FIG. 23, the packet mirroring device generates and displays a response delay analysis screen for a website. At this time, the packet mirroring device extracts performance related indicators generated from the packets and information related to a specific website at a specific time, and generates an analysis page based on the extracted information.

The set time information is displayed on the analysis page, and the page loading time information related to the response delay on the page is expressed in the form of a time bar that distinguishes cRTT, sRTT, request time, server response waiting time, and response data transmission time. do. Then, as shown in the website analysis page at the bottom of FIG. 22, page loading time information, client time information, network time information, and server time information are displayed. In addition, usage information (including call number, request amount, and response data amount information), current status information (including simultaneous user information, simultaneous session number information, TPS information, and response waiting session information) and availability information (error related Information). Here, the page loading time may be calculated based on the server response waiting time and / or the total usage time. Alternatively, it may be calculated by adding the use time to the client time. That is, it may be a time value measured from the time the request is transmitted to the time when the entire data of the response data packet for the request-related packet is loaded.

In addition, response speed information for each service (or component) associated with the web page is displayed in detail. According to the embodiment of FIG. 23, the content analyzed by the two service users' sensation speed is displayed. First, the page loading speed of the iinju-k service is somewhat slow at 4.78 seconds, and the ratio of the delayed pages is 63.64%, which confirms that many users have experienced a delay. Delayed pages refer to pages with a page loading speed above a certain speed, and the ratio may be calculated based on the number of delayed pages compared to the number of calls from the user. Next, it can be seen that the page loading speed of the gne service is also slightly slower at 4.95 seconds.

In addition, more specifically, the section in which the sensation speed delay occurs through analysis of the sensation speed delay section can be confirmed as a client section (Page Design Time, Client Time).

FIG. 24 is a diagram showing a screen visualizing a loading time for each web page and an analysis page of the transition and delay components of the sensation speed accordingly.

Referring to FIG. 24, the packet mirroring device measures and loads a loading time for each web page in a web page analysis page. At this time, when the user clicks the trend icon to request additional trend analysis, the packet mirroring device provides a graph-shaped change over time of the sensation speed for the web page. In the graph, the normal category is set based on the threshold for the sensation speed, so that events in the normal category are purple, and events that are not in the normal category can be expressed in different colors. In addition, among the events in an abnormal state, the delay due to the client time is blue, the delay due to the network time is green, and the delay due to the server time can be expressed in yellow, and the delay due to a plurality of causes can be expressed in gray. Do. That is, it expresses delays due to various causes so that they can be grasped at a glance over time.

In addition, when an event representing a specific sensation rate at a specific time is clicked in the graph, a delay component analysis page associated with the event is generated.

On the corresponding analysis page, a web page analysis screen with a time and delay rate corresponding to the clicked event is displayed, and related URL access actions are provided in the form of a time bar.

25 is a diagram showing a page for diagnosing and analyzing details of a delayed web page.

Referring to FIG. 25, the packet mirroring apparatus may generate a detailed diagnostic analysis page for a slow web page having a sensation speed of a specific value or more. One web page includes a plurality of components. At this time, the delayed web page shows a web page having a sensation speed of a specific value or more, and displays client information, time information, and the like associated therewith. At this time, the entire page loading time is displayed in the time information. The packet mirroring device can extract the highest delay cause based on the share of the client time, the share of the network time, and the share of the server time among the total page load time. This is visually expressed as a time bar.

At this time, detailed analysis may be performed on a specific web page. In response to a detailed analysis request from the user, the packet mirroring device performs component-specific analysis. That is, URL information, time bar information, usage time, response waiting time, amount of received data, result code value, type, and status information are displayed for each component held by the corresponding web page. At this time, the time bar information may be divided into cRTT, sRTT, request time, server time, and response time.

26 is a diagram showing a page for checking an inflow path using HTTP referrer information.

Referring to FIG. 26, the packet mirroring apparatus may generate HTTP list information of packets of a specific time period by sorting them by obtaining them from packets. Referrer refers to the traces of each site visited through hyperlinks when surfing the World Wide Web (www) with a web browser. Through this, it is possible to check the route of the visitor of the website to the site.

As shown in FIG. 26, by returning to the request for confirming the inflow path of a specific time zone for a specific web site, the packet mirroring device extracts referrer information from packets and performance related indicators of the time zone of the web site and lists them. . Displays information on the number of transactions associated with the referrer, percentage information of transactions related to the referrer among all transactions, error information, request data amount, response data amount, response wait time and response wait session number information, and download time information. Can be. In particular, it can be sorted in ascending or descending order in relation to transactions.

In addition, looking at the graph at the bottom of FIG. 26, the packet mirroring device may show each referrer in a graph form according to a ratio associated with a transaction. Accordingly, it is possible to grasp at a glance which route a user accesses to the corresponding website through which route.

27 is a diagram showing a page comparing and analyzing a server indicator and a network indicator.

Referring to FIG. 27, the packet mirroring device may generate a graph comparing server indicators and network-related indicators. For example, the response latency value of a specific server and the RTT value associated with a network can be compared graphically in chronological order. The packet mirroring device can compare other server-related indicators and other network-related indicators as well as response waiting time. For example, non-RTT, BPS, TPS, CPS, HPS, etc. can also be compared over time. In addition, the highest peak point among the server indicator and the network-related indicator over a specific time period may be extracted to display the value of the corresponding portion.

28A is a flowchart illustrating a process of determining a server delay and failure event alarm.

Referring to FIG. 28A, in the packet mirroring device, various rule sets related to the occurrence of a problem exist, and a threshold for application of the rule set exists. To this end, a threshold setting through a user interface may be required (S2810). Then, a configuration for interworking with a network service such as e-mail, SMS text, or SNS is set (S2812). Then, it detects the occurrence of the event (S2814), and allows a preemptive response through an early warning to be performed (S2816).

According to an embodiment of the present invention, when an event occurs, not only visual action but also auditory action may be accompanied. That is, it can be controlled such that an operation such as sounding an alarm sound is performed. Also, when an event occurs, it can be automatically scrolled to the server associated with the event. For example, when a delay-related problem associated with response waiting time occurs in the first server, the packet mirroring device identifies the first server in which the event occurred, the flow map of the event occurrence time of the first server, the server status page, the session list, The user list and / or related website analysis pages may be automatically output.

28B is a diagram showing a threshold setting page.

Referring to FIG. 28B, the packet mirroring device generates a configuration window associated with the occurrence of an event and outputs it through a user interface. Then, an appropriate rule set and a threshold value associated with the rule set may be set by receiving user input through a user interface.

First, through the configuration window, the user can set the name of the alert and enter the associated server IP. In addition, the duration threshold of the problem occurrence condition may be set, and the condition may be selected whether all of the multiple conditions are satisfied or a specific ratio is satisfied.

It is also possible to select the type of server status when a specific event occurs. For example, you can choose whether the entire service is down or only the server is down. In addition, as described above with reference to FIG. 12, in connection with a problem occurrence, information related to the number of sessions, the number of response waiting sessions, the response waiting time, CPS, TPS, BPS, and errors may be set. In addition to the performance-related indicators exemplified above, events related to other indicators may be generated.

That is, the packet mirroring device can easily set the information related to the response speed, the number / rate of errors of the application, the status of the server and the application waiting for response, the network usage and / or the designated event notification for each recipient group through the configuration window. Support.

29A and 29B are diagrams illustrating pages related to 40X error analysis.

Referring to FIG. 29A, the packet mirroring device may generate and display a trend graph of the occurrence amount of the 40X error for each day of the date associated with the request in response to the request for analyzing the amount of error occurrence for a specific date. In addition, by displaying the distribution of users at the corresponding time, it is possible to visualize the occurrence of 40X errors according to the distribution of users at a glance. It can be seen that a proportional relationship is established between the two.

Referring to FIG. 29B, the packet mirroring device may collect 40X occurrence-related information occurring on a related date in response to an analysis request for a 40X occurrence application for a specific time period, and display and display the collected content in a table form. At this time, IP, URL, method, transaction information, error information, request and response data amount, number of response waiting sessions, response waiting time information, and download time information of related servers can be displayed together. In the embodiment of FIG. 29B, it can be seen that the application having the most 40X error is “www.gne.go.kr/main/photo_news.jsp”. It is possible to check the tendency associated with the occurrence of the same phenomenon as well as the corresponding application, and the packet mirroring device can determine whether there is a link problem of a specific page based on the concentration of the phenomenon, and the corresponding link It can be controlled to periodically monitor the server or client associated with.

The above error analysis is not only performed for 40X errors, but can also be performed for other errors such as 50X errors.

30 is a diagram showing a page visualizing service performance in a global map in connection with geographical data.

Referring to FIG. 30, the packet mirroring device may store geographic information. For example, GIS (Geographic Information System) information may be stored. GIS information is interoperable with information (eg, country, city, etc.) associated with the location of the packet mirroring device according to an embodiment of the present invention, and GIS information and the packet information and / or performance-related indicator information are displayed in association Can be.

According to the embodiment of FIG. 30, the packet mirroring device visualizes the current state of a plurality of clients forming a session in a server existing in Korea in consideration of a geographic location. That is, based on the IP, country information, and city information of the client, the number information of the corresponding client or a visual expression corresponding to the number of the client may be implemented in the world map on the client. The visual expression may be implemented as size or color information corresponding to the number of clients. Or, it can be implemented by specifying the number of clients actually present in the corresponding region.

In addition, in response to a request for displaying information of all clients associated with the corresponding server, the packet mirroring device may extract and display a user list including user information associated with the server. In this case, a line representing a connection between the client and the server may be differently expressed based on at least a part (eg, RTT) of the network delay indicator. Differences in visual expression include different colors, thicknesses, and shapes.

According to another embodiment of the present invention, it is also possible to express a response based on geographic information on an information request for a user in the embodiment of FIG. 30 as information on servers associated with a specific client and / or servers selected by an operator. It is possible. That is, interworking with geographic information is not limited to user information, and is applicable to server information, session information, URL information, and / or website information.

31 is a diagram showing a page visualizing service performance in a local map in connection with geographical data.

Referring to FIG. 31, when a specific country is clicked on the global map, information associated with the local map of the clicked country may be displayed. That is, the global map and the country map (which may be called a local map), the city map of the lower level, etc. are connected in a hierarchical relationship, and the user inputs a certain input (eg, click, zoom-in, zoom-out) , Through a control input such as panning). The packet mirroring device may display server information, user information, session information, URL information, and / or website information in association with geographical data on a local map.

That is, the packet mirroring device obtains or pre-stores the packet through the packet, the client's ip, the client port information, the client's country information, organization information (org information), ISP information (isp_id), city information (city_id) and / or server ip , Server port, server country, server city, etc. (which may be pre-stored information) can be represented by mapping data related to geographical information on an actual map. At this time, the service speed in a specific area can be checked at a glance through RTT or other delay-related indicators. For example, the packet mirroring device compares the average value (or the highest value and / or the lowest value) of the RTT value of the client in a specific region with a predetermined threshold value (which may be multiple), and then classifies it into a specific section, and then divides the section. The corresponding region can be displayed with a visual expression corresponding to. Alternatively, after mapping a location of a specific client in a corresponding region as a point (point), a visual expression corresponding to the divided section may be applied to the corresponding point. At this time, if an information request for a specific region or a corresponding point is input, the packet mirroring device may return session information, client information, server information, URL information, and / or web page information associated with the packet mirroring device.

32 is a diagram showing pages analyzed by monitoring performance of each server.

Referring to FIG. 32, the packet mirroring device may display a server status based on servers associated with a specific service (eg, university authentication, course registration related service). In this regard, the packet mirroring device is a visual expression indicating a percentage of currently available sessions in a session associated with a specific server, which is being connected, and whether an error exists (a certain percentage of the filled portion in the empty box) (Including what is expressed through). In addition, the server status page may be displayed with a time bar displayed by classifying client time, network time, and server time, and also display speed related indicators (BPS, TPS, etc.) from the current time point to a specific time point in the past. Can be.

33 is a diagram showing a page showing the distribution of access by environment of a user.

Referring to FIG. 33, a packet mirroring device extracts information related to user attributes from a mirrored packet and generates related information. Accordingly, statistics may be generated for each environment of the user terminal associated with the current management target server, URL, and / or sessions at a specific time or in real time. At this time, org information, city_id information, isp_id information, os_id information, browser_id information, mobile_id information, and / or telcom_id information may be utilized.

For example, based on the user ISP, a distribution of currently related users may be displayed in a graph. Alternatively, the distribution of related users may be displayed for each OS, for each web browser, for each device type, for each related carrier, and for each mobile device type. At this time, when a specific distribution part in the graph (for example, Chrome 39 in a web browser graph) is clicked, a list of users associated with a client using the specific distribution part may be displayed. The connection relationship between these analysis pages is stored through metadata, and can be changed through user settings.

34A and 34B are diagrams illustrating pages for registering new devices and links.

Referring to FIG. 34A, in order to register a new device and a link in a packet mirroring device, first, a user (or a network administrator / operator) can directly input server information. Server name, server IP, port, sort number, etc. may be required for the server device input.

In addition, when the device is registered, it is selected in the form of a link (source-destination) (source IP, destination IP), and these links automatically construct a flow from the user to each step-by-step server by means of interconnection information. That is, a flow map may be generated at a final step by step through a link configuration step after input of device information.

However, the packet mirroring device according to an embodiment of the present invention applies a packet mirroring technique to all IP-based devices connected to a network to monitor and diagnose performance and security problems of the device. At this time, it may be difficult to register hundreds or thousands of devices one by one, and when a new device is added, an instant registration process is not possible. Accordingly, a method for automatically registering a new object according to another embodiment of the present invention will be described in detail below with reference to FIGS. 35 to 39.

At this time, in relation to the new object auto-registration part of the packet mirroring device, the packet mirroring device may be implemented as a new object auto-registration device, in which case the device does not necessarily have to use the mirrored packet. After obtaining information related to the packet in another way, after obtaining information defining an address and a specific entity such as a destination IP and a source IP among the obtained packet related information, the obtained information and the new object auto-registration device A new object can be registered by comparing it with the network object information (including a server list) held.

35 is a block diagram illustrating a configuration for performing an operation for automatically registering a new device in a packet mirroring device according to another embodiment of the present invention. As illustrated in FIG. 35, the packet mirroring apparatus 3500 according to another embodiment of the present invention may include a packet analysis module 3502 and a service module 3504. The packet mirroring apparatus 3500 may further include a database (not shown) storing information related to packets and a database (not shown) storing network entity information such as a server list.

Referring to FIG. 35, the packet analysis module 3502 includes a packet between a service user and a web server 3510, a packet between a web server 3510 and a WAS server 3520, and a WAS server 3520 and a DB server 3530 ) It collects the mirrored packets for the packets in between and analyzes the collected packets to generate about 120 performance-related indicators. Through this, real-time information for each section may be provided to the service module 3504. At this time, a list of servers not registered among the collected packets is also provided to the service module 3504. That is, it is possible to extract unregistered servers by comparing the ip of the server described in the destination ip in the mirrored packet with the server list pre-registered by the operator and providing it to the service module 3504.

As described above, the service module 3504 performs various statistical data, search, inquiry, and alarm functions based on performance-related indicators generated by the packet analysis module 3502. In addition, after automatic registration is performed based on the unregistered server list received from the packet analysis module 3502, the monitoring server list is regenerated and provided to the packet analysis module 3502.

There are two methods for registering a new device. There may be a method of automatically registering without special input from the administrator and a method of allowing a new device to exist as a candidate and a new device candidate to become a new device by the administrator's decision. Through these methods, a new device is automatically registered in a pre-stored server list and a flow map, and a link can be automatically configured.

According to an embodiment of the present invention, not only the destination ip in the packet is used, but also the source ip can be registered as a new device. In addition, registration with the client as well as the server side can be considered. At this time, comparison with the user list may be required.

36A to 36C are flowcharts illustrating a process for registering a new device and a new link in a packet mirroring device according to another embodiment of the present invention.

Referring to Figure 36a, in the overall process, the packet mirroring device collects and analyzes the mirrored packet (S3610). This can be done in the packet analysis module. Then, it compares whether the destination in the packet is a new destination by comparing with the previously stored server list or server information (S3612). If it is a new destination, it is registered as a new device (S3614). Then, it is determined whether the source device associated with the registered new device is a new source (S3616). If it is a new source device, it is registered as a new link (S3618). According to an embodiment of the present invention, even if the source device is not new, a link between an existing client and a new server device may also be registered as a new link. For example, a link between the source device existing in the pre-stored user list and the newly registered server device may also be considered as a new link.

Referring to FIG. 36B, in a process associated with registering a new device, the packet mirroring device determines whether the device belongs to a registration category based on information (eg, IP information) of the new device (S3630). Here, the registration category indicates a target device IP area to be processed by the packet mirroring device. It may be preset. For example, if 192.47.33.12 to 192.49.33.44 are registration categories, the IP of the new device is determined by comparing it with the registration category IP range. As a result of determination, if it belongs to the registration category, the device is registered in the form of a destination IP (S3632).

Referring to FIG. 36C, in a process associated with registering a new link, the packet mirroring device determines whether the device belongs to a registration category based on link information with a source device associated with the new device (S3640). As described above, the registration category may indicate the IP area of the target device. As a result of determination, if the link with the source device is also within the registration category, the new device and the source device are registered in the link list in the form of source IP and destination IP (S3642). At this time, the link is registered in association with existing flow map links. That is, the new device may indicate a connection with an existing or new source while being added as a new server to the existing flow map through the link-related information (source IP-destination IP). According to another embodiment, it may be added as a client device to an existing flow map.

37A to 37C are flowcharts illustrating a process for selectively registering new devices and new links in a packet mirroring device according to another embodiment of the present invention.

Referring to FIG. 37A, in the overall process, the packet mirroring device collects and analyzes the mirrored packet (S3710). Then, it compares whether the destination in the packet is a new destination by comparing with the previously stored server list or server information (S3712). If it is a new destination, it is registered as a new device candidate (S3714). Then, it is determined whether the source device associated with the registered new device candidate is a new source (S3716). If it is a new source device, it is registered as a new link candidate (S3718).

Referring to FIG. 37B, in a process associated with registering a new device candidate, the packet mirroring device determines whether the candidate belongs to a registration category based on information (eg, IP information) of the new device candidate (S3730). As described above, the registration category may indicate a target device IP area to be processed by the packet mirroring device. As a result of the determination, if it belongs to the registration category, the candidate is registered in the device candidate list in the form of a destination IP (S3732). Then, the process goes to the optional device automatic registration process to automatically register the device (S3734). The optional device automatic registration process is described below with reference to FIG. 38.

Referring to FIG. 37C, in a process associated with registering a new link candidate, the packet mirroring device determines whether the candidate and the source device belong to a registration category based on link information with the source device associated with the new device candidate (S3740). . As a result of the determination, if the link with the source device is also within the registration category, new device candidates and source devices are registered in the link candidate list in the form of source IP and destination IP (S3742). Then, the process goes to the optional device automatic registration process to automatically register the device (S3734).

38 is a diagram showing an optional device automatic registration page.

Referring to FIG. 38, the packet mirroring device displays a monitoring server registration screen for a candidate device considered as a new device candidate as a result of comparison with a pre-registered server list and a determination as to whether or not it falls within a registration category. The administrator may confirm that a new device exists through the screen and determine whether to register the device. The monitoring server registration screen includes information input fields such as a server name, a server IP, a sort number, a dashboard view (which indicates whether a flow map is shown), and a health check. The new server name is displayed as the server IP by default and can be changed by user input. When the user registers the corresponding device, a link may be automatically configured using relationship information with an existing source.

39 is a diagram showing a flow map visualizing a link and a device newly generated by automatic device registration.

Referring to FIG. 39, when the packet mirroring device automatically registers a new device in the same manner as above, it can be confirmed that one link is added to existing links. At this time, the server-to-server link may be generated by grasping the relationship with other servers other than the client based on packets transmitted and received with other servers.

According to another embodiment of the present invention, the new device may include a device related to the Internet of Things (IoT). For example, various sensors such as a temperature sensor, an illuminance sensor, and an acceleration sensor may be included, and an image processing device such as a CCTV or an IP camera may be included. Through this, after registering various devices in the packet mirroring device for network management according to an embodiment of the present invention, it can be used for alarm purposes according to security, intrusion prevention, and abnormal sign determination.

40 is a diagram for explaining a system connection relationship of a plurality of packet mirroring devices according to another embodiment of the present invention.

Referring to FIG. 40, the packet mirroring device may be connected to L2 / L3 switching and L4 switches. The entire network system including the packet mirroring device is a backbone switch connected to the Internet network, an L4 switch connected to the backbone switch, a firewall system connected to the L4 switch (intrusion prevention system) and an intrusion prevention system, connected to the intrusion prevention system L4 switch, and L2 / L3 switch connected to the L4 switch. Here, two other L4 switches can be connected to the branch from the intrusion prevention system, and the two L4 switches are connected to the L3 system. The packet mirroring device 1 collects packets from L2 / L3 switches and L4 switches. At this time, the packet is mirrored in the 1000base-T standard from the L2 / 3 switch to receive the mirrored packet. From the L4 switch, it is possible to receive a mirrored packet by performing packet mirroring using a 10G Fiber NIC. At this time, a management interface of 1000Base-T is connected to one of the two L4 switches to transmit and receive signals related to management of the switching operation and management of the packet mirroring operation.

According to the above embodiment of the present invention, the switches connected to the packet mirroring device 1 can communicate with different standards, and especially, the connection media also has various types of media, including copper and fiber. Can be used for

The packet mirroring device 1 may be configured to interwork with the packet mirroring device 2, the packet mirroring device 1 may be configured to classify operations to perform packet collection and analysis, and the packet mirroring device 2 to perform performance statistics and search operations. Can be. At this time, since the L2 / 3 switch is complexly connected to the web server, WAS server, and DB server, network service performance indicators for each section can be calculated for the web server-WAS server section and WAS server-DB server section.

41 is a view showing a configuration that performs different functions according to a connection relationship of a plurality of packet mirroring devices according to another embodiment of the present invention.

Referring to FIG. 41, the packet mirroring device 1 is connected to a switch to collect mirrored packets. The packet mirroring device 1 collects packet information for each section such as a client-web server, a web-WAS, and a WAS-DB, and analyzes and monitors the performance of network services for each section in real time. It can interoperate with packet mirroring device 2, which performs statistics and performs analysis related to performance.

The packet mirroring device 2 communicates with the packet mirroring device 1 through short-range wireless communication or wired communication such as Near Field Communication (NFC), and transmits packet-related raw data and analyzed performance-related indicators from the packet mirroring device 1. Statistical data is periodically generated using the associated data. Certain statistics may be generated in 1 hour increments. Then, it can perform a function of querying, searching, and storing statistical data.

Although it is disclosed in the figure that only the packet mirroring device 1 is connected, the packet mirroring device 1 and / or the packet mirroring device 2 may be connected to a display means to display related data for a user to view.

42 is a block diagram specifically illustrating a packet mirroring apparatus or a service module of FIG. 5 according to an embodiment of the present invention. As illustrated in FIG. 42, the packet mirroring apparatus or service module according to an embodiment of the present invention may include a receiver 4210 and a map / page generator 4220.

Referring to FIG. 42, the receiver 4210 may receive raw data information of a mirrored packet and data related to performance-related indicators from a packet mirroring device (not shown) or an analysis database (see 522 in FIG. 5). Then, data received by the map / page generation unit 4220 is provided.

The map / page generation unit 4220 may receive packet data and / or performance based on the location template 4230, tile information 4232, project setting 4234, rule script 4236, and execution scheduler 4238 information. You can create flow map or analysis page data by integrating related indicators.

The location template information 4230 may include placement information of various types of pages. For example, it may include various types of information of a plurality of analysis pages (eg, server list, session list, user list, URL list, web page analysis page, etc.) in one entire display canvas. Further, the template information may include connection relationship information between maps / pages. In relation to the hierarchical page configuration based on the drill-down, it is determined which analytical page is to be placed in which layer (default type is configurable and multiple types are configurable), and a predetermined type of map / page placement and map / page is determined. A template having a connection relationship between them may be defined. According to another embodiment of the present invention, if a specific type of template desired by the administrator is created, the same template / page configuration can be easily rearranged by importing the same template later.

The tile information 4232 stores background information of the user interface. For example, the background information used as the background of the flow map is stored so that when the map / page generation unit 4220 generates map / page data, it is visualized as the stored background.

The project setting 4234 information includes various setting information of a project generating dynamic content in the map generating unit 4220.

The rule script 4236 includes basic arrangement information of various objects (eg, device objects, server objects, and / or link objects, etc.) displayed on the map / page, colors, fonts, etc. of visual expressions to be displayed on the map / page. Is defined. The setting information of the rule script 4236 may be managed by the rule system such as creation, storage of new settings, deletion of existing settings, and the like.

In addition, since the period of the received data may be variable, the map / page generation unit 4230 has an execution scheduler 4238 and automatically / manually changes the data reception period and / or page generation period according to the defined schedule. You can perform map / page creation. The execution scheduler 4238 may include time-series work order information from the step of extracting data necessary for analysis from the received data to generating a map and / or analysis page.

The map and / or page data generated through the map / page generation unit 4230 may be output through a display means 4240 such as a monitor. Alternatively, it may be provided as another packet mirroring device, and may process map and / or page data provided with an interlocking packet mirroring device to generate other types of data. The display means 4240 may be included in the packet mirroring device, or may exist separately as an external monitor.

The system or device described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the systems, devices, and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, and field programmable arrays (FPAs). ), A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and / or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodied in the transmitted signal wave. The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiments may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. Includes hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and / or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if substituted or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (22)

A method for diagnosing network performance in a network performance diagnosis apparatus connected to a switching device provided between a first entity and a second entity,
Obtaining at least one mirrored packet for at least one packet transmitted and received between the first entity and the second entity based on mirroring from the switching device;
Calculating a performance-related index indicating performance of a service of a network associated with the first entity and the second entity based on at least some of information included in the mirrored at least one packet; And
Including the step of storing the calculated performance-related indicators,
The first entity includes a client, and the second entity includes a server,
The step of calculating a performance-related indicator indicating the performance of a network service based on at least some of the information included in the at least one mirrored packet is:
Extracting information about a first time (T1) when the first packet arrives at the network performance diagnosis apparatus from the client, in a mirrored packet for the first packet transmitted from the client to the server;
Extracting information about a second time (T2) when the first response packet arrives at the network diagnostic apparatus from the server, in a mirrored packet of the first response packet from the server for the first packet;
Extracting information about a third time (T3) when the second response packet arrives at the network diagnostic apparatus from the client, in the mirrored packet of the second response packet from the client, for the first response packet ;
Calculating a server round trip time (sRTT) based on the extracted first time T1 and the second time T2; And
And calculating a client round-trip time (cRTT) based on the information on the second time T2 and the information on the third time T3. According to claim 1,
The information included in the at least one mirrored packet includes a source IP, a destination IP, and time information. delete delete delete According to claim 1,
Among the performance-related indicators, information on the first time T1, information on the second time T2, included in the at least one mirrored packet, with respect to the calculation of the delay time-related indicator, Information about a third time T3, information about a fourth time T4 when the last data of the response data requested by the client to the server arrives at the network performance diagnostic apparatus from the server, and the server round-trip time (sRTT) ) And the client round-trip time (cRTT),
A request time indicating a time required for the client to request response data from the server and receiving the request from the server;
Response latency (latency) indicating the response delay time from the URL (Uniform Resource Locator) associated with the request until the server receives the first data associated with the response data:
A response data transmission time indicating a time required for the server to transmit the response data to the client; And
A method for diagnosing network performance, which calculates a total usage time indicating a time required from when the client transmits a request for the response data to the server and receives all data related to the response data. The method of claim 6, wherein calculating a performance-related index indicating performance of the service of the network
And calculating a page loading time to a specific web page based on the client time spent by the client, the network time spent by the network, and the server time spent by the server. The method of claim 7,
The network time includes the sRTT, the cRTT, the request transmission time (request time), and the response data transmission time (Response time),
The server time comprises a response latency (latency) network performance diagnostic method. According to claim 1,
The performance-related indicator includes network-waiting session number information indicating a number of sessions in a state of not receiving a response to a request sent by the client. According to claim 1, The performance-related indicator,
User Per Second (UPS) information indicating the number of clients connected per second;
CPS (Connection Per Second) information indicating the number of new sessions connected per second; And
A network performance diagnosis method including at least one of transaction per second (TPS) information indicating the number of transactions occurring per second. According to claim 1,
And determining whether a network service problem occurs based on at least some of the performance-related indicators. The method of claim 11, wherein determining whether a problem occurs in the network service based on at least some of the performance-related indicators is:
Response latency information indicating the response delay time from the URL (Uniform Resource Locator) associated with the request for the client's response data to the server until the server receives the first data associated with the response data and the client Compares at least one of the wait information associated with the response waiting time and the threshold associated with the number of waiting sessions to respond to at least one of wait information indicating the number of sessions that have not received a response to the request sent by step; And
If at least one of the response latency information and the response waiting session number (wait) information is greater than at least one of the threshold associated with the response waiting time and the threshold associated with the number of response waiting sessions, traffic ( traffic) A method for diagnosing network performance, comprising determining that a problem of delay or excessive traffic occurs. The method of claim 11, wherein determining whether a problem occurs in the network service based on at least some of the performance-related indicators is:
At least one of a threshold associated with the BPS and a threshold associated with the CPS, at least one of Bit Per Second (BPS) information indicating a transmission bit size of data per second and Connection Per Second (CPS) information indicating a number of new sessions connected per second. Comparing with; And
And determining that a problem of excessive BPS or excessive CPS occurs when at least one of the CPS information and the BPS information is greater than at least one of a threshold associated with the BPS and a threshold associated with the CPS. Diagnostic method. The method of claim 11, wherein determining whether a problem occurs in the network service based on at least some of the performance-related indicators is:
Comparing at least one of the occurrence amount information of the 40X error per specific hour and the occurrence amount information of the 50X error per hour to at least one of a threshold value associated with the 40X error and a threshold value associated with the 50X error; And
If at least one of the occurrence amount information of the 40X error per specific hour and the occurrence amount information of the 50X error per specific hour is greater than at least one of the threshold associated with the 40X error and the threshold associated with the 50X error, a 40X or 50X error occurs. A network performance diagnostic method comprising determining. The method of claim 11,
When detecting a problem of a network service based on at least some of the performance-related indicators, at least one of a text message, an email, and a social network service (SNS) to a user of the first account for management of the network, which is pre-registered The method further comprising the step of notifying using the network performance diagnostic method. According to claim 1,
The first entity is a first server, and the second entity is a second server. The method of claim 16,
At least one of the first server and the second server network performance diagnostic method comprising at least one of a web server (web server), WAS (Web Application Server) and a database server (DB server). According to claim 1,
When acquiring mirrored packets for packets associated with the first entity, the second entity, and the third entity connected in series, the interval between the first entity and the second entity and the second entity and the third entity A network performance diagnosis method that calculates performance-related indicators for each section of a section between entities. The method of claim 18,
And generating a flow map by objectifying the first object, the second object, and the third object on a visualization space based on the performance-related index for each section. According to claim 1,
The performance-related indicator is a network performance diagnosis method that is calculated and stored in real time by monitoring packets transmitted and received between the first entity and the second entity in real time. In the network performance diagnostic apparatus connected to the switching device provided between the first entity (entity) and the second entity,
A port for acquiring at least one mirrored packet for at least one packet transmitted and received between the first entity and the second entity based on mirroring from the switching device;
A packet analysis module for calculating a performance-related index indicating performance of a service of a network associated with the first entity and the second entity based on at least some of information included in the mirrored at least one packet; And
It includes a storage for storing the calculated performance-related indicators,
The first entity includes a client, and the second entity includes a server,
The packet analysis module:
Extracting information about a first time (T1) when the first packet arrives at the network performance diagnosis apparatus from the client, in a mirrored packet for the first packet transmitted from the client to the server;
Extracting information about a second time (T2) when the first response packet arrives at the network performance diagnostic apparatus from the server, in a mirrored packet of the first response packet from the server for the first packet;
In the mirrored packet of the second response packet from the client, for the first response packet, the second response packet extracts information about a third time T3 when the client arrives at the network performance diagnosis apparatus and ;
Calculating a server round-trip time (sRTT) based on the extracted first time T1 and the second time T2; And
A network performance diagnosis apparatus for calculating a client round-trip time (cRTT) based on the information on the second time T2 and the information on the third time T3. In the network performance diagnosis system for performing a network performance diagnosis,
A switching device provided between the first entity and the second entity; And
It is connected to the switching device, based on the mirroring from the switching device, for obtaining at least one packet, for at least one packet transmitted and received between the first entity and the second entity, the mirroring, Based on at least some of the information contained in the at least one packet, a performance-related indicator indicating the performance of the service of the network associated with the first entity and the second entity is calculated, and the calculated performance-related indicator is stored. Includes a network performance diagnostic device,
The first entity includes a client, and the second entity includes a server,
The network performance diagnostic device is:
Extracting information about a first time (T1) when the first packet arrives at the network performance diagnosis apparatus from the client, in a mirrored packet for the first packet transmitted from the client to the server;
Extracting information about a second time (T2) when the first response packet arrives at the network performance diagnostic apparatus from the server, in a mirrored packet of the first response packet from the server for the first packet;
In the mirrored packet of the second response packet from the client, for the first response packet, the second response packet extracts information about a third time T3 when the client arrives at the network performance diagnosis apparatus and ;
Calculating a server round-trip time (sRTT) based on the extracted first time T1 and the second time T2; And
A network performance diagnosis system that calculates a client round-trip time (cRTT) based on the information on the second time T2 and the information on the third time T3.

Images