KR102370113B1 - Apparatus and method for intelligent network management based on automatic packet analysis - Google Patents

Abstract

The present invention provides an automatic packet analysis-based intelligent network management device and a method thereof. With automatic packet analysis, a guide for accurate and quick cause identification and resolution with one click for various and complex network issues (performance, failure, etc.) is provided. Any network operator is allowed to easily and conveniently manage the network, and it is possible to provide customized network management services tailored to user needs by interworking with various systems with information collection and analysis functions.

Description

Automatic packet analysis-based intelligent network management device and method {Apparatus and method for intelligent network management based on automatic packet analysis}

The present invention relates to intelligent network management, and in particular, provides a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis, and provides easy An intelligent network management device and method based on automatic packet analysis that enables convenient network management and is suitable for providing customized network management services tailored to user needs by interworking with various systems with information collection and analysis functions will be.

In general, intelligent network technology refers to networks and infrastructure technologies that will be commonly used for the 4th industrial revolution and innovative growth based on intelligence. Specifically, SDN (Software-Defined Networking), NFV (Network Functions Virtualization), and network intelligence technologies , low-latency/time-determined network technology, quantum information communication technology, network structure technology, transmission network technology, wired and wireless access technology, etc. are comprehensively included.

In addition, network intelligence technology repeats a series of procedures such as automatic data collection and feedback for autonomous decision-making using artificial intelligence technologies such as machine learning, so that end-to-end (re)setup, control, management and orchestration, etc. technology that automatically performs the functions of

The meaning of these intelligent networks is evolving over time, mainly leading to breakthroughs in computation and algorithms.

As prior art, 'system for communication failure management and maintenance of network equipment' of Korean Patent Registration No. 10-1998863, and 'network management device, network management system and network management method' of Korean Patent Registration No. 10-2133001 are disclosed. has been disclosed.

When the network goes down, it directly leads to business disruption. In addition, delay in business processing due to network performance degradation leads to direct loss of the organization. The average loss for a single network outage is $402,542 in the United States. (Source: The Rise of AIOps: How Data, Machine Learning, and AI Will Transform Performance Monitoring, Appdynamics News, 2018.12.17.) Therefore, it is necessary to minimize the network interruption situation.

The Uptime Institute, which evaluates the performance of networks, has studied publicly reported cases of network outages. Looking at this, network failure among IT failures increased significantly from 19% in 2017 to 32% in 2018. Therefore, in the event of a network outage, a technology capable of promptly tracing the cause and suggesting a solution is required.

Conventional network management includes a Network Management System (NMS), a Traffic Management System (TMS), a Data Packet Inspector (DPI), and a Packet Analyzer.

However, NMS (Network Management System) centered on equipment and line monitoring has limitations in solving complex network issues. In addition, TMS (Traffic Management System) for network traffic management has a limitation in not supporting in-depth analysis of payload. In addition, DPI (Data Packet Inspector) and packet analyzer (Packet Analyzer) are very complicated and difficult to use, and there is a problem that requires a high degree of expertise.

KR 10-1998863 B1 KR 10-2133001 B1

Accordingly, the present invention has been proposed to solve the above problems in the prior art, and an object of the present invention is to accurately and quickly identify causes of various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis. Automatic packet analysis that provides a guide for and resolution, enables any network operator to easily and conveniently manage the network, and provides customized network management services tailored to user needs by linking with various systems with information collection and analysis functions An object of the present invention is to provide an intelligent network management device and method thereof.

1 is a conceptual diagram of an intelligent network management device based on automatic packet analysis according to an embodiment of the present invention, FIG. 2 is a conceptual diagram showing detailed functions of each part in FIG. 1, and FIG. 3 is the intelligent network management device of FIG. It is a conceptual diagram showing the connection of an external device with an external device, FIG. 4 is a conceptual diagram showing detailed functions of the automatic diagnosis unit in FIG. 1 , FIG. 5 is a conceptual diagram showing detailed functions of the one-click processing unit in FIG. 1 , and FIG. 6 is a report in FIG. It is a conceptual diagram showing detailed functions of the preparation unit, and FIG. 7 is a conceptual diagram showing detailed functions of the user interface unit in FIG. 1 .

As shown in this figure, in the intelligent network management device 100 that manages the network, the intelligent network management device 100 provides an accurate and quick cause for various and complex network issues with one click through automatic packet analysis. A control unit (control unit ( 110) and; An application data measurement unit 120 that receives the control of the control unit 110 and measures data including network packets, SNMP TRAP, and SYSLOG information from the network equipment 210 of the data center or the remote intelligent network management device 220; ; a network performance analysis unit 130 under the control of the control unit 110 and analyzing network performance using the data measured by the application data measurement unit 120; an automatic diagnosis unit 140 receiving control of the control unit 110 and automatically diagnosing the state of the network using the results analyzed by the network performance analysis unit 130; an event management unit 150 that receives control of the control unit 110 and manages events including packet analysis events, SNMP TRAP events, and SYSLOG events; It receives the control of the control unit 110, receives the results of the automatic diagnosis unit 140, and provides information necessary for network problem solving, including detailed information of network diagnosis, the meaning of the information, symptoms, expected causes, and measures. a one-click processing unit 160 that processes to provide with one click; a report writing unit 170 under the control of the control unit 110 and generating a packet analysis-based network diagnosis report; and a user interface unit 180 under the control of the control unit 110 and providing a user interface so that a user can perform network management.

The application data measurement unit 120, the type of collected data includes network packet, SNMP TRAP, and SYSLOG, the collection method uses SPAN/Port Mirroring or Tap equipment, and the collection point is immediate or schedule-based, and the collected data is The storage is characterized in that it is metadata and original packet (PCAP).

The network performance analysis unit 130 uses BPS, PPS, Latency, or Timeout for network usage and performance analysis, and uses TCP Session, UDP Session or HTTP Error for failure/event analysis, and application service (L7) analysis uses HTTP, DNS, SMTP, POP3, IMAP, FTP Server tracking or Client tracking, and L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis, or payload analysis. Trend analysis is characterized by using usage, performance indicators, failures, or events.

The automatic diagnosis unit 140 defines a diagnosis item, measures the state of the diagnosis target, provides symptoms of the diagnosis target, provides expected causes, provides action methods for each predicted cause, and provides analysis results The automatic diagnosis target is characterized by including performance, usage, UDP, TCP or HTTP error.

The event management unit 150 generates and manages three-step events of Warning, Critical, and Info when a packet analysis event occurs, performs SNMP Trap event collection processing, supports SNMP v1, v2c or v3, and SYSLOG event When SYSLOG event occurs, SYSLOG event collection and search are performed, and classification is performed by SYSLOG level.

The one-click processing unit 160, BPS, PPS, Latencies, Timeout, HTTP Error, when the user one-clicks any one or more of the TCP Flag, detailed information on the clicked item, the meaning of the information, symptoms, expected causes , provides information necessary to solve network problems, including action plans When the Latencies item is one-clicked, the network response delay status (Avg, Top, or IP) information is provided. When the Timeout item is one-clicked, the Network Timeout status (Avg, Top, or IP) information is provided, and HTTP Error When an item is one-clicked, HTTP Code state or URL comparison analysis status information is provided. When a TCP Flag item is one-clicked, TCP Zero Windows, Duplicate ACK, Retransmission or Reset status information is provided, and explanation and cause of each item are provided. It provides user-specified time filter information, and allows the user to select a chart or graph to manage the network.

8 is a flowchart illustrating an intelligent network management method based on automatic packet analysis according to an embodiment of the present invention.

As shown in this figure, when the intelligent network management device 100 performs network management, the application data measurement unit 120 receives network packets from the data center network equipment 210 or the remote intelligent network management device 220, SNMP a first step (ST1) of measuring data including TRAP and SYSLOG information; After the first step, the network performance analysis unit 130 performs a second step (ST2) of analyzing the network performance using the data measured by the application data measurement unit 120; The automatic diagnosis unit 140 includes a third step (ST3) of automatically diagnosing the state of the network using the results analyzed by the network performance analysis unit 130; After the third step, the one-click processing unit 160 receives the results of the automatic diagnosis unit 140, and is necessary for solving network problems including detailed information of network diagnosis, the meaning of the information, symptoms, expected causes, and measures. a fourth step (ST4) of processing information to be provided with one click; After the fourth step, the user interface unit 180 provides a user interface so that the user can perform network management ( ST5 ); and, automatic packet analysis in the intelligent network management device 100 . provides a guide for accurately and quickly identifying and resolving various and complex network issues with one click, enabling any network operator to easily and conveniently manage the network, and interlocking with various systems with information collection and analysis functions It is characterized in that it provides a customized network management service tailored to the user's needs.

The intelligent network management device and method based on automatic packet analysis according to the present invention provide a guide for accurate and quick identification and resolution of various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis It enables any network operator to easily and conveniently manage the network, and has the effect of providing customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

In addition, the present invention has the effect of providing all information necessary to solve the problem, such as detailed information, the meaning of the information, symptoms, and possible causes and measures with one click. However, there is a limitation that measures are not presented.

In addition, the present invention makes it possible to clearly identify the cause of a network problem with one click, to provide a problem solving guide (ADA: Automatic Diagnostics Analysis), and to operate an operation method to access the problem without drilling down.

In addition, the present invention enables operation (All-In-One) in one system from information collection to analysis, diagnosis, and results, and provides an optimal system selection option suitable for the operating environment (Portable, Rack Mount, Rugged PC, Cloud, etc.) This is possible, and immediate use (Zero Configuration) is possible without pre-setting.

In addition, the present invention has the advantage of not relying on the vendor as a packet collection technology using a general NIC (Network Interface Controller), and has the advantage of not being affected by the user environment by internalizing the L7 protocol automatic classification engine, and interworking with EMS, SIEM, NMS, etc. (Rest API) There is a possible advantage, and there is an effect that a customized service according to the user's request is possible.

In addition, the present invention has the effect of reducing the mean time to repair (MTTR) by 1/5 or more while being cheaper at about 1/4 of the price of a foreign solution for the same purpose. In the prior art, it takes about 1 to 2 weeks to collect system setting information, analyze, and solve the report writing problem. On the other hand, the present invention has the advantage that it can be processed within about 2-3 days from information collection, analysis, report writing, and problem solving. (The total time required to solve the problem is a general empirical value and may vary depending on the nature of the problem.) The present invention can shorten the pre-preparation (setting) time for network information collection, and shorten the time to check the cause of the problem through analysis can do. It can also shorten the time to take action and recover from a problem. In addition, it is possible to shorten the preparation time of the final report.

In addition, in the case of the prior art, a network and solution operation expert is absolutely necessary for network management, but the present invention has the advantage that it can be operated even by a beginner network engineer.

1 is a conceptual diagram of an intelligent network management apparatus based on automatic packet analysis according to an embodiment of the present invention.
FIG. 2 is a conceptual diagram illustrating detailed functions of each part in FIG. 1 .
3 is a conceptual diagram illustrating a connection between the intelligent network management device of FIG. 1 and an external device.
4 is a conceptual diagram illustrating detailed functions of the automatic diagnosis unit in FIG. 1 .
5 is a conceptual diagram illustrating detailed functions of the one-click processing unit in FIG. 1 .
FIG. 6 is a conceptual diagram illustrating detailed functions of the report preparation unit in FIG. 1 .
FIG. 7 is a conceptual diagram illustrating detailed functions of the user interface unit in FIG. 1 .
8 is a flowchart illustrating an intelligent network management method based on automatic packet analysis according to an embodiment of the present invention.
9 is a conceptual diagram illustrating an application example of the present invention.
10 is a conceptual diagram illustrating an example of continuous network control in FIG. 9 .
11 is a conceptual diagram illustrating an example of CCTV integrated control in FIG. 9 .
12 is a conceptual diagram illustrating an example of performance management after network separation in FIG. 9 .
13 is a conceptual diagram illustrating an example of a network design in FIG. 9 .

A preferred embodiment of an automatic packet analysis-based intelligent network management apparatus and method according to the present invention configured as described above will be described in detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a related well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. And the terms to be described later are terms defined in consideration of functions in the present invention, which may vary depending on the intention or precedent of the user or operator, and accordingly, the meaning of each term should be interpreted based on the content throughout this specification. will be.

First, the present invention provides a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis, and any network operator can easily and conveniently manage the network. It is intended to provide a customized network management service tailored to user needs by interworking with various systems with information collection and analysis functions.

1 is a conceptual diagram of an intelligent network management apparatus based on automatic packet analysis according to an embodiment of the present invention.

The intelligent network management device 100 for managing the network includes a control unit 110 , an application data measurement unit 120 , a network performance analysis unit 130 , an automatic diagnosis unit 140 , an event management unit 150 , and one-click It may be configured to include a processing unit 160 , a report writing unit 170 , and a user interface unit 180 .

The control unit 110 provides a guide for accurately and quickly identifying and solving various and complex network issues with one click through automatic packet analysis in the intelligent network management device 100, and any network operator can easily and conveniently manage the network It controls to provide customized network management service tailored to user needs by interworking with various systems with information collection and analysis functions.

The application data measurement unit 120 is controlled by the control unit 110 and measures data including network packets, SNMP TRAP, and SYSLOG information from the network equipment 210 of the data center or the remote intelligent network management device 220 .

The network performance analysis unit 130 is controlled by the control unit 110 and analyzes the network performance using the data measured by the application data measurement unit 120 .

The automatic diagnosis unit 140 is controlled by the control unit 110 and automatically diagnoses the state of the network using the results analyzed by the network performance analysis unit 130 .

The event management unit 150 is controlled by the control unit 110 and manages events including packet analysis events, SNMP TRAP events, and SYSLOG events.

The one-click processing unit 160 receives the control of the control unit 110, receives the result of the automatic diagnosis unit 140, and network problems including detailed information of network diagnosis, the meaning of the information, symptoms, expected causes, and measures We process to provide the information necessary for resolution with one click.

The report writing unit 170 is controlled by the control unit 110 and creates a packet analysis-based network diagnosis report.

The user interface unit 180 is controlled by the control unit 110 and provides a user interface so that a user can perform network management.

FIG. 2 is a conceptual diagram illustrating detailed functions of each part in FIG. 1 .

The types of data collected by the application data measurement unit 120 include network packets, SNMP TRAPs, and SYSLOGs. The collection method uses SPAN/Port Mirroring or Tap equipment. The collection point is immediate or scheduled. Throughput can be 500Mbps, 1G, 5G, 10G, etc. Collected data storage is metadata and original packet (PCAP). The maximum storage capacity can also be 76 TB (Portable 32 TB).

In addition, the application data measurement unit 120 receives data center information as a packet, and manages the packet data as an information bundle. When packets are collected on the NIC, each packet is separately distributed and stored in a separate queue (hardware buffer) inside the NIC for load balancing on the NIC. And let the application program take out data from the hardware buffer and process it.

The application data measurement unit 120 creates a predetermined number of queues in the NIC hardware itself. And allocates a separate thread for reading data from the NIC. At this time, one is allocated for each queue. In addition, a separate buffer is created in advance to move and store the raw packets in the NIC's internal queue. Also, it is possible to check whether packets are stacked in the queue automatically or manually. In case of automatic confirmation, there is a delay until the system notifies the result to the program after checking the queue. This is a process of "checking the queue in the system → sending a message to the program → processing the program's message → processing the queue". Therefore, the delay is avoided by manual control based on an infinite loop. That is, it avoids the delay by performing the process of "queue check → queue processing → repeat in the program".

In addition, the application data measurement unit 120 calculates and checks the size of data accumulated for each queue by executing each thread at the same time. And select the location to be stored in the buffer for each queue. At this time, if the size of the data to be stored is larger than the remaining size of the buffer, the buffer is replaced with a new empty buffer. Also, after specifying the storage location in advance, each thread writes data to a single buffer at the same time. In general, when multiple threads write to a single buffer at the same time, there may be a problem where multiple threads write data at the same time at the same location, but in this case, there is no problem because the data writing area does not overlap. There is no room for wasting memory by specifying the storage location in advance. In the case of the prior art, because a single thread is used, the write speed is limited (up to 10 Gbps), or the speed problem is solved by using an FPGA-based separate hardware, whereas the present invention is a 100% software method only. It has the advantage of enabling high-speed processing.

Also, the application data measurement unit 120 manages a buffer for storing a plurality of packets, and each packet includes an L2 header, an L3 header, an L4 header, and a packet body (body and payload). The information bundle structure has a structure such as 'first time to store, last time to store, information block 1, information block 2, information block 3, ..., information block n'. The structure of the information block consists of the structure of 'compressed size, actual size, and compressed binary information data'. Among the previous information materials, the fixed length has the same structure as 'fixed-width data 1, fixed-width data 2, fixed-width data 3, fixed-width data 4, ..., fixed-width data n'. Among the previous information materials, variable length is 'fixed-width data 1 (including variable-length information), separate-length data 1, fixed-width data 2 (including variable-length information), variable-length data 2, fixed-width data 3 (including variable-length information) , variable-length data 3, ..., fixed-width data n (including variable-length information), and variable-length data n'.

The application data measurement unit 120 generates metadata for individual packets. The metadata includes packet confirmation time, packet size, session ID, packet size, MAC address, and various TCP-specific information. The information bundle includes a session information bundle, a BPS information bundle, a PPS information bundle, an RTT information bundle, a timeout information bundle, a TCP information bundle, a Remarks information bundle, and an event information bundle. Session ID, client IP/port, server IP/port, L4 protocol, and L7 protocol information are stored in the session information bundle. Session ID, transmission time (in seconds), data size transmitted from client to server per second, and data size information transmitted from server to client per second are stored in the BPS information bundle. The PPS information bundle stores the session ID, transmission time (in seconds), the number of packets transmitted from the client to the server per second, and the number of packets transmitted from the server to the client per second. In the RTT (Round Trip Time) information bundle, session ID, transmission delay time from client to server, and transmission delay time information from server to client are stored. All session information and occurrence time information are stored in the timeout information bundle. In the TCP information bundle, the time zone and session information in which TCP SYN occurred, TCP SYN, the time zone and session information in which TCP RST occurred, TCP RST, the time zone and session information in which TCP DUP ACK occurred, TCP DUP ACK, the time zone and session in which TCP packet retransmission occurred It stores TCP packet retransmission information, which is the time of occurrence and the type of problem (TCP Zero Window, Port Reused, Out of Order), and other TCP problem information. HTTP request/response header, DNS query and response result, SMTP email sender ID, FTP/IMAP/POP3 error content information are stored in Remarks information bundle. In the event information bundle, event information that occurs when it is above or below a predefined threshold or above a variable rate is stored.

The network performance analysis unit 130 analyzes network usage and performance using BPS, PPS, Latency, or Timeout. Failure/event analysis uses TCP Session, UDP Session or HTTP Error. Application service (L7) analysis uses HTTP, DNS, SMTP, POP3, IMAP, FTP Server trace or Client trace. L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis, or payload analysis. Statistics and trend analysis use usage, performance indicators, failures, or events.

In addition, the network performance analysis unit 130 generates the basic performance indicators including performance indicators of BPS, PPS, latency, and timeout. In addition, additional performance indicators include performance indicators of the number of flows created by time and IP, TCP performance indicators, performance indicators of IP list providing TCP-based services, IP list of UDP-based services, performance indicators of MAC addresses for each IP, data by port number One or more performance indicators are generated among performance indicators of usage status or performance indicators for each L7 protocol. TCP performance indicators include TCP RST, TCP Zero Windows, TCP DUP ACKS, TCP retransmission, TCP port reuse, and TCP packet order reversal. A performance indicator of data transmission amount measurement for each sender/receiver may be included.

The network performance analysis unit 130 determines that the performance indicator to be analyzed is BPS-based analysis, PPS-based analysis, Timeout-based analysis, TCP RST-based analysis, TCP Zero Windows analysis, TCP DUP ACK analysis, TCP retransmission analysis, TCP port reuse analysis, Determines which performance indicator analysis is performed among TCP packet order reversal analysis, HTTP error status analysis, and additional performance indicator analysis.

If the performance indicator analysis is BPS-based analysis, the network performance analysis unit 130 analyzes it as 'traffic surge' if the traffic is 85% or more of the total available bandwidth, and 'continues the excessive traffic state' if the traffic surge state lasts for 60 seconds or more. If more than 50% of the total traffic is concentrated on a single IP, it is analyzed as 'traffic concentration to a specific IP', and if the traffic in use is less than 2% of the total available bandwidth, it is analyzed as 'suspicious network failure'. In the case of PPS-based analysis, if the broadcast packet occupies more than 70% of the total packet, it is analyzed as 'high bandwidth occupation due to the rapid increase of the broadcast packet'. In this case, it is analyzed as 'unknown packets occupy a large amount of bandwidth'. In case of timeout based analysis, if timeout occurs for more than 20 IPs per second during the period specified by the user, it is analyzed as 'suspicious of service unavailable due to network interface shutdown or equipment power failure', and if more than 10 IPs per second during the period specified by the user If timeout occurs for less than ~ 20 IPs, it is analyzed as 'suspicious of service interruption due to cable or GBIC (Giga Bitrate Interface Converter, Gigabit Interface Converter) failure'. In the case of TCP RST-based analysis, if the same server sends RST more than 10 times per second, it is analyzed as 'a request is received from the server side to a destination port that does not exist, or a connection is attempted to a port that has already been connected' And, if the same client sends RST more than 5 times per second, it is analyzed as 'the application wants to close the connection using Reset instead of FIN'. If this is the case, it is analyzed as 'the case where either the server or the client terminates without notifying the termination'. In the case of TCP Zero Windows analysis, if the TCP Zero Window phenomenon occurs more than 10 times per second, it is analyzed as 'suspected of zero window creation due to errors such as firewalls, IPS security equipment, or WAN accelerators'. In the case of TCP DUP ACK analysis, if DUP ACK occurs more than 60 times per second from a specific IP, it is analyzed as 'Network Congestion'. In the case of TCP retransmission analysis, if TCP retransmission occurs more than 1000 times per second in a specific IP, it is analyzed as 'suspicious loop occurrence in the duplication section'. In the case of TCP port reuse analysis, if TCP port reuse is confirmed more than 3 times per second, it is analyzed as 'suspected of client-side local port exhaustion and server time wait status maintenance'. In the case of TCP packet reordering analysis, if the reordering occurs more than 3 times per second, it is analyzed as 'suspected of TCP segment loss due to packet loss'. In the case of HTTP error status analysis, if the status code is HTTP 4XX, if the same phenomenon is found in less than 10 IPs, it is recognized as a 'user input problem' and analyzed. If the status code is HTTP 5XX or HTTP 4XX, If the same phenomenon is found, it is recognized as 'there is a problem in the server or client's code' and analyzed. In the case of additional analysis of performance indicators, performance indicators are added and analyzed according to the addition of system settings or user additions.

If you look at the contents of automatic diagnosis in the automatic diagnosis unit 140, it defines the diagnosis items, measures the state of the diagnosis target, provides the symptoms of the diagnosis target, provides the expected cause, and provides an action method for each expected cause and provide analysis results. Auto-diagnosis targets include performance, usage, and UDP, TCP or HTTP errors.

The event management target in the event management unit 150 includes an event by packet analysis, an SNMP TRAP event, a SYSLOG event, and the like. When a packet analysis event occurs, it generates and manages three-step events of Warning, Critical, and Info, performs SNMP trap event collection processing, and supports SNMP v1, v2c or v3. When a SYSLOG event occurs, SYSLOG event collection and search are performed, and classification is performed by SYSLOG level.

The report creation unit 170 creates a packet analysis-based diagnostic report, and creates a report including performance and usage, UDP/TCP analysis, and application analysis. When looking at the report writing function in the report writing unit 170, it includes period, IP, port, and tag filtering. It also allows you to choose a report item selection. For example, it can provide 16 selection options including network status, network usage and performance, failure/event, application service, automatic diagnosis, L2-L7 analysis, statistics and trend analysis, events, and more. It also provides a function to select the report title, date, and logo. In addition, a window for inputting opinions for each report item is provided. It also provides a comprehensive comment input window. Also, for example, four report templates can be provided. It also provides a report preview function. It also provides the ability to create PDF and Tab Separated Values (TSV) files. In addition, it provides a download function for raw data storage and management by providing a RAW data download function.

3 is a conceptual diagram illustrating a connection between the intelligent network management device of FIG. 1 and an external device.

The external device may be the network equipment 210 of the data center or the remote intelligent network management device 220 or the like. The network equipment 210 of the data center measures data by connecting to a physical network (Physical NW) by tapping or port mirroring. In addition, the network equipment 210 of the data center may be a virtualization environment including a virtual switch (vSwitch). The remote intelligent network management device 220 may be a device installed in a remote office.

In the intelligent network management device 100 , the application data measurement unit 120 measures raw data and generates meta information. Raw data becomes Network packet, SNMP Trap, Syslog, etc., and it is possible to create meta information by storing and parsing such raw data. Through meta-information generation, network status, usage, performance, failure and event information extraction, service automatic recognition, classification, etc. are performed and stored.

4 is a conceptual diagram illustrating detailed functions of the automatic diagnosis unit in FIG. 1 .

The automatic diagnosis unit 140 performs automatic diagnosis of the network through network status, network use and performance, failure/event, application service, automatic diagnosis, L2 to L7 analysis, statistics and trend analysis, and event processing.

In the automatic diagnosis of network status, the status of network equipment is identified through SNMP Trap information analysis and Syslog data analysis is performed.

In the automatic diagnosis of network usage and performance, automatic diagnosis of BPS (Bits Per Second), PPS (Packets Per Second), Latencies, and Timeout is performed.

Automatic diagnosis of failure/event performs automatic diagnosis of UDP Flag, TCP Resets, TCP Zero Windows, TCP Reuse, TCP Duplicate ACKs, and TCP Retransmission. It also performs automatic diagnosis for HTTP 4XX and HTTP 5XX.

In automatic diagnosis of application service, automatic recognition of application service and detailed analysis of payload are performed. Therefore, automatic diagnosis is performed for HTTP, DNS, SMTP, POP3, IMAP, and FTP.

In automatic diagnosis to suggest the cause and solution of the problem, automatic diagnosis is performed on TCP Retransmission, Hop Low, Microburst, RTT (Round Trip Time), TCP Reset, TCP Zero Windows, TCP DUP ACKs, and Timeout.

In the automatic diagnosis of L2 ~ L7 analysis, Mac usage analysis is performed by Layer 2 analysis, Hop Account analysis is performed by Layer 3 analysis, analysis by port (by source and destination) by Layer 4 analysis, and automatic diagnosis of application services are performed by Layer 7 analysis do.

Automatic diagnosis of statistics and trend analysis performs automatic diagnosis of performance indicators (BPS, PPS, Latency, Timeout), TCP related, HTTP error, Layer 7 analysis, and flow trend.

In the automatic diagnosis of events, threshold setting and control by performance, alarm generation and class setting, search and inquiry by alarm class, and automatic diagnosis of Syslog Server (Remote) and SNMP Trap Server are performed. And alarm/event provides real-time network status monitoring and notification service.

FIG. 5 is a conceptual diagram illustrating detailed functions of the one-click processing unit in FIG. 1 .

When the user one-clicks any one or more of BPS, PPS, Latencies, Timeout, HTTP Error, and TCP Flag, the one-click processing unit 160 provides detailed information about the clicked item, the meaning of the information, symptoms, expected causes, and actions It provides all the information you need to troubleshoot your network, including how to do it.

The conventional competitive technology can identify the cause of a problem through a complex analysis process, but has a limitation in not being able to suggest a countermeasure.

So, the one-click processing unit 160 provides network traffic status (Avg or Top) information when the BPS item is one-clicked, and provides Unicast, Multicast, Broadcast or Unknown status information when the PPS item is one-clicked, and the Latencies item is one-click When clicked, network response delay status (by Avg, Top, or IP) information is provided, when Timeout item is one-clicked, network timeout status (by Avg, Top or IP) information is provided, and when HTTP Error item is one-clicked, HTTP Code Provides state or URL comparison analysis status information. When TCP Flag item is one-clicked, TCP Zero Windows, Duplicate ACK, Retransmission or Reset status information is provided, description and cause of each item are provided, and user-specified time filter It provides information and allows the user to select a chart or graph to manage the network.

6 is a conceptual diagram illustrating a detailed function of the report preparation unit in FIG. 1 .

The report creation unit 170 generates a diagnosis report with one click without a separate analysis or diagnosis operation. Users can designate a desired period, insert user logos, and provide a window for inputting general opinions.

FIG. 7 is a conceptual diagram illustrating detailed functions of the user interface unit in FIG. 1 .

The user interface unit 180 provides a dashboard UI (User Interface), a statistics UI, an analysis tool UI, a payload tracking UI, a report UI, an automatic diagnostic analysis UI, an event UI, a system setting UI, and the like.

8 is a flowchart illustrating an intelligent network management method based on automatic packet analysis according to an embodiment of the present invention.

In the first step (ST1), when network management is performed by the intelligent network management device 100, network packets from the network equipment 210 of the data center or the remote intelligent network management device 220 in the application data measurement unit 120, Measure data including SNMP TRAP and SYSLOG information.

In the second step ST2 , after the first step, the network performance analyzer 130 analyzes the network performance using the data measured by the application data measurer 120 .

In the third step ST3, the automatic diagnosis unit 140 automatically diagnoses the state of the network by using the result analyzed by the network performance analysis unit 130 .

In the fourth step (ST4), after the third step, the one-click processing unit 160 receives the result of the automatic diagnosis unit 140, and includes detailed information of the network diagnosis, the meaning of the information, symptoms, expected causes, and measures. It provides one-click information necessary to troubleshoot network problems.

In the fifth step ST5, after the fourth step, the user interface unit 180 provides a user interface so that the user can perform network management.

So, with automatic packet analysis in the intelligent network management device 100, it provides a guide for accurately and quickly identifying and resolving various and complex network issues with one click, so that any network operator can easily and conveniently manage the network. In addition, it provides customized network management services tailored to user needs by interworking with various systems with information collection and analysis functions.

9 is a conceptual diagram illustrating an application example of the present invention.

Therefore, the present invention makes it possible to perform network constant control, performance, and failure event management of a business network through continuous network control. In addition, it enables performance and failure management through CCTV integrated control. In addition, network performance improvement and network structure and configuration diagnosis can be performed through performance management after network separation. It also enables capacity optimization design through network design.

10 is a conceptual diagram illustrating an example of continuous network control in FIG. 9 .

Therefore, it becomes possible to check usage and health (network operation status), performance monitoring, fault monitoring and resolution, abnormal behavior detection and warning, service optimization, and regular report provision through regular network control.

11 is a conceptual diagram illustrating an example of CCTV integrated control in FIG. 9 .

Through CCTV integrated control, it becomes possible to check usage and health (network operation status), performance monitoring, fault monitoring and resolution, abnormal behavior detection and warning, service optimization, and regular report provision.

12 is a conceptual diagram illustrating an example of performance management after network separation in FIG. 9 .

Through performance management after network separation, network performance problems can be solved. Therefore, it can contribute to VDI (Virtual Desktop Infrastructure) environment, physical network separation, and logical network separation.

13 is a conceptual diagram illustrating an example of a network design in FIG. 9 .

Therefore, when designing a network, it becomes possible to check usage and health (network operation status), monitor performance, optimize services, and provide analysis reports.

As such, the present invention provides a guide for accurately and quickly identifying and resolving various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis, and any network operator can easily and conveniently manage the network. It provides a customized network management service tailored to user needs by interworking with various systems with information collection and analysis functions.

Although the present invention has been described in more detail with reference to examples above, the present invention is not necessarily limited to these examples, and various modifications may be made within the scope without departing from the technical spirit of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: network management device
110: control unit
120: application data measurement unit
130: network performance analysis unit
140: automatic diagnosis unit
150: event management unit
160: one-click processing unit
170: report writing department
180: user interface unit
210: network equipment in the data center
220: remote intelligent network management device

Claims (7)

An intelligent network management device for managing a network, comprising:
Automatic packet analysis in the intelligent network management device provides a guide for accurate and quick identification and resolution of various and complex network issues with one click, and enables any network operator to easily and conveniently manage the network, information a control unit for controlling to provide a customized network management service tailored to user needs by interworking with various systems with a collection and analysis function;
an application data measurement unit that receives the control of the control unit and measures data including network packet, SNMP TRAP, and SYSLOG information from a network device of a data center or a remote intelligent network management device;
a network performance analysis unit under the control of the control unit and analyzing network performance using the data measured by the application data measurement unit;
an automatic diagnosis unit receiving control from the control unit and automatically diagnosing a network state using the results analyzed by the network performance analysis unit;
an event management unit receiving the control of the control unit and managing events including packet analysis events, SNMP TRAP events, and SYSLOG events;
Process to be controlled by the control unit, to receive the results of the automatic diagnosis unit, and to provide information necessary for network problem solving, including detailed information of network diagnosis, the meaning of the information, symptoms, expected causes, and measures, with a single click a one-click processing unit;
a report writing unit receiving the control of the control unit and preparing a packet analysis-based network diagnosis report;
and a user interface unit that receives the control of the control unit and provides a user interface so that a user can perform network management;
In the application data measurement unit, the types of collected data include network packets, SNMP TRAP, and SYSLOG, the collection method uses SPAN/Port Mirroring or Tap equipment, the collection point is immediate or schedule-based, and the collection data storage is metadata and a packet origin (PCAP);
The one-click processing unit, when the user one-clicks any one or more of BPS, PPS, Latencies, Timeout, HTTP Error, and TCP Flag, detailed information on the clicked item, the meaning of the information, symptoms, expected causes, action plan Provides information necessary to troubleshoot network problems including When the Latencies item is one-clicked, the network response delay status (by Avg, Top, or IP) is provided. When the Timeout item is one-clicked, the network timeout status (by Avg, Top, or IP) information is provided, and the HTTP Error When clicked, HTTP Code state or URL comparison analysis status information is provided. When TCP Flag item is one-clicked, TCP Zero Windows, Duplicate ACK, Retransmission or Reset status information is provided, and explanation and cause of each item are provided. An intelligent network management device based on automatic packet analysis, characterized in that it provides user-specified time filter information and allows the user to manage the network by selecting a chart or graph.
delete The method according to claim 1, wherein the network performance analysis unit,
Network usage and performance analysis uses BPS, PPS, Latency or Timeout, failure/event analysis uses TCP Session, UDP Session or HTTP Error, and application service (L7) analysis uses HTTP, DNS, SMTP, POP3, IMAP , FTP Server tracking or Client tracking is used, and L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis, or payload analysis. or an intelligent network management device based on automatic packet analysis, characterized in that it uses an event.
The method according to claim 1, wherein the automatic diagnosis unit,
Defines the diagnostic items, measures the status of the diagnostic target, provides the symptoms of the diagnostic target, provides the expected cause, provides the action method for each expected cause, and provides the analysis result, and the automatic diagnostic target is the performance and usage , UDP, TCP or HTTP error, characterized in that it includes an automatic packet analysis-based intelligent network management device.
The method according to claim 1, The event management unit,
When a packet analysis event occurs, it generates and manages three-step events of Warning, Critical, and Info, performs SNMP Trap event collection processing, supports SNMP v1, v2c or v3, and collects and retrieves SYSLOG event when a SYSLOG event occurs and automatic packet analysis-based intelligent network management device, characterized in that it performs classification by SYSLOG level.
delete delete

Images