KR102563247B1 - Apparatus for Realtime Monitoring Performance Degradation of Network System - Google Patents

Abstract

The present invention relates to a network performance degradation monitoring device that detects network failures and external attacks in real time by mirroring and receiving packets transmitted and received from a server in a network system in which a plurality of client devices and a plurality of server devices are connected.
The network performance degradation monitoring apparatus includes a packet analysis module for extracting information about a session, information about a server connected to the session, information about a client connected to the session, and a type of the mirrored packet from mirrored packets; a structure management module for managing a session structure, a server structure, and a client structure based on the information analyzed by the packet analysis module; A risk management module for calculating and managing performance degradation risk as a ratio of standby flow to all flows in the network system from information stored in the session structure, the server structure, and the client structure, and for all sessions in the network system A plurality of session structures formed for each session, a plurality of server structures formed for each server for all servers forming all the sessions, and a plurality of client structures formed for each client for all clients forming all the sessions. include them

Description

Network system performance degradation real-time monitoring device {Apparatus for Realtime Monitoring Performance Degradation of Network System}

The present invention relates to a device for monitoring performance degradation of a network system, and more particularly, to a device for detecting network failures and external attacks in real time by rapidly analyzing network TCP protocol packets.

TCP (Transmission Control Protocol) is a transport layer protocol that supports connection-type services on top of the IP protocol and is basically used in the Internet environment. Types of TCP protocols include FTP, SSH, Telent, SMPT, DNS, DHCP, HTTP, HTTPS, POP3, SNMP, and SSL.

In order to guarantee communication without loss of data in the Internet, which is an unreliable public network, the TCP protocol proceeds with a procedure to check whether data packets are normally ready to be transmitted and received.

First, the client system sends a message that it wants to communicate to the server system it wants to communicate with in order to establish a TCP connection (transmitting a packet with the SYN flag set).

When the server system receives the SYN signal, it changes to the SYN-RECEIVED state, and responds by sending a message with the SYN-ACK flag set to the client system as a response and a message that I am ready for communication.

When the client system receives this SYN-ACK signal, it changes to the ESTABLISHED state and responds by sending an ACK signal to the server system. When the server system receives the client's ACK signal and changes to the ESTABLISHED state, the connection between the server system and the client system is successfully completed.

After that, since existing communication and new communication need to be distinguished, a transaction is performed by putting a flag value in a header, and a session is created for each application service.

A transaction between a client system and a server system consists of a procedure in which the client system transmits a transaction request message and the server system responds to the transaction request message in a state in which a session is created between the client system and the server system. Each transaction may consist of one packet or a plurality of packets. That is, in order to efficiently route allocation (routing) for sending data between the server system and the client system through the Internet, the amount of data that can be sent at one time is limited based on the transmission protocol. Therefore, when there is a large amount of data in one transaction, it is divided into several pieces and transmitted, and these pieces are called packets.

Traditional network systems include client devices used by users and various server devices associated with web sites. In general, a client device requests access to a server having a specific IP address in order to use a web site, and connects after waiting time. In this case, when a plurality of client devices are flocked by a plurality of users at a specific point in time to attempt to access the server or request a transaction, performance of a network system associated with the server may be degraded due to a bottleneck. The cause of such performance degradation must be quickly identified and a response to it must be made as quickly as possible.

As a prior art for identifying the cause of performance degradation of such a network system, there is Korean Patent Publication No. 2020-0033090 entitled "Network Security Monitoring Method, Network Security Monitoring Device and System".

The prior art described above includes a first entity (server), a second entity (client terminal), a switching device provided between the first entity and the second entity, and a network security monitoring device connected to the switching device. The security technique includes: obtaining mirrored at least one packet for at least one packet transmitted/received between a first entity and a second entity, based on mirroring by the network security monitoring device from the switching device; and determining, by the network security monitoring apparatus, whether a security problem occurs in a network associated with the first entity and the second entity based on at least a portion of information included in at least one mirrored packet.

In this prior art, the step of determining whether a security problem occurs based on packet information includes determining that the number of connections in a section from a first source IP to a first destination IP is equal to or greater than a predetermined threshold, and determining whether a predetermined first URL Determination that the request for is greater than or equal to a predetermined threshold value, determination that the predetermined BPS (Bit Per Second) of the first server is greater than or equal to the predetermined threshold value, and determination that the predetermined packet per second (PPS) from the second source IP is determined in advance. Determination that the number of synchronization signal (SYN) packets from the predetermined third source IP is greater than or equal to the predetermined threshold, determination that the number of synchronization signal (SYN) packets from the predetermined third source IP is greater than or equal to the predetermined threshold, and simultaneous access by the predetermined fourth source IP to the number of server IPs equal to or greater than the predetermined threshold determines whether a security problem occurs based on at least one of the determinations to attempt

As described above, this prior art compares the number of connections, the number of requests, the number of BPS, PPS, synchronization signal packets, and the number of concurrent connections to the server IP with each threshold to determine whether a security problem occurs. .

In the detailed description of the invention of the prior art, in paragraphs [0085] to [0187], functions and operations of a packet analysis module for analyzing packets transmitted and received between a server and a client terminal are described. Since the packet analysis module of the prior art analyzes packets and calculates various performance indicators to determine whether a security problem occurs, real-time processing is difficult.

Republic of Korea Patent Publication No. 2020-0033090 Republic of Korea Patent Publication No. 2019-0088342 Republic of Korea Patent Publication No. 2019-0088343

An object of the present invention is to provide an apparatus for rapidly diagnosing network quality, failure and security and monitoring network performance degradation in real time by classifying, storing and searching network packet information transmitted and received in a network system at high speed.

Network performance degradation real-time monitoring device according to the present invention for achieving the above object,

A network performance degradation monitoring device provided by mirroring packets transmitted and received by a server end of a network system in which a plurality of client devices and a plurality of server devices are connected,

From the mirrored packet, information about a session, information about a server connected to the session, information about a client connected to the session, information about a client connected to the session, information about an application activated in the client, a packet analysis module for extracting information about a location and a type of the mirrored packet;
A session structure and a server structure based on the information analyzed by the packet analysis module. a structure management module that manages client structures, application structures and local structures;
A risk management module for calculating and managing a performance degradation risk as a ratio of standby flows to all flows in the network system using information stored in the session structure, server structure, client structure, application structure, and local structures,
The structure management module includes a session tree table for managing the session structures, a server tree table for managing the server structures, a client tree table for managing the client structures, an application hash table for managing the application structures, and the local structure. It includes a local hash table that manages

Each of the session structures includes information about the corresponding session, a server structure pointer for connecting to a server structure corresponding to a server connected to the corresponding session, and a client structure pointer for connecting to a client structure corresponding to a client connected to the corresponding session. do;

Each of the server structures includes a session structure management table managing information about the server, session structure pointers corresponding to all sessions connected to the server, and client IP addresses corresponding to all clients connected to the server. includes a client information management table;

Each of the client structures includes a session structure management table managing information about the corresponding client, session structure pointers corresponding to all sessions to which the client is connected, and server IP addresses corresponding to all servers connected to the client. It is characterized in that it includes a server information management table.

According to the present invention, network packet information transmitted and received to and from a network system is classified by session, server, client, application, and region, stored in a structure, and linked and managed to quickly determine whether or not the performance of the network system is degraded and the cause thereof. It has the advantage of being able to detect it accurately.

1 is a diagram showing a network environment to which this invention is applied.
2 is a block diagram of a network performance degradation monitoring device according to the present invention.
3 is an exemplary view of a session connection between a server and a client in a network system.
4 is a structure configuration and connection diagram generated in the exemplary network system of FIG. 3 .
5 is a block diagram of a session structure according to the present invention.
6 is a block diagram of a server structure according to the present invention.
7 is a block diagram of a client structure according to the present invention.
8 is a block diagram of an application structure according to the present invention.
9 is a block diagram of a local structure according to the present invention.
10 is an operational flow diagram illustrating a structure creation and update process of the present invention.
11 is an operational flow diagram illustrating the risk management process of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, or substitutes included in the spirit and technical scope of the present invention.

In describing each figure, like reference numbers are used for like elements. Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are only used for the purpose of distinguishing one component from another.

For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention. The term "and/or" includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs.

Terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with the meanings in the context of the related art, and unless explicitly defined in this application, they should not be interpreted in ideal or excessively formal meanings. Should not be.

As described above, communication between the server and the client device consists of 3-way handshaking, session connection, and transaction request and response processes. When a number of client devices by a number of users flock to the server at a specific point in time and attempt to access the server or request a transaction, the SYN signal of 3-way handshaking and the transaction request are accumulated in the specific server, waiting for a response to the corresponding SYN signal. Response latency to time or transaction requests increases. In other words, among all flows including 3-way handshaking and transactions, the SYN waiting flow and the transaction waiting flow increase. This invention proposes a method for managing performance degradation risk based on the ratio of SYN waiting flows and transaction waiting flows among total flows.

1 is a diagram showing a network environment to which the present invention is applied.

A network environment to which this invention is applied includes a plurality of client devices 111, 112, and 113, a network 120, a router 130, a switch 140 having a packet mirroring function, a plurality of server devices 151, 152, and 153, and a network according to the present invention. A degradation monitoring device 160 is included.

The client devices 111 , 112 , and 113 access a specific web site or web application via the network 120 . At this time, access is performed in the server devices 151, 152, and 153 associated with the web site and/or web application. The client devices 111, 112, and 113 access a specific web page through a web browser and request execution of a desired page or application. The request may include not only static content such as an html document, but also multimedia content such as video and audio, and/or execution of other applications.

The client devices 111, 112, and 113 may include any device operated by a user and having a communication function (including Internet connection and web browser execution function) and data processing function. The client devices 111, 112, and 113 include a mobile station (MS), a user equipment (UE), a user terminal (UT), a wireless terminal, an access terminal (AT), a fixed and mobile subscriber unit, and a subscriber. Subscriber Station (SS), cellular phone, wireless device, wireless communication device, wireless transmit/receive unit (WTRU), mobile node, mobile, mobile station, personal digital assistant assistant), smartphone, laptop, netbook, personal computer, wireless sensor, consumer electronics (CE), Internet of Things (IoT) device, or other terms. Various modified embodiments of the client devices 111, 112, and 113 include a portable computer having a wireless communication function, a photographing device such as a digital camera having a wireless communication function, a gaming device having a wireless communication function, and a music storage and playback home appliance having a wireless communication function. , Internet appliances capable of wireless Internet access and browsing, as well as portable units or terminals incorporating combinations of these functions, but are not limited thereto.

Each client device 111, 112, 113 may include a user communication interface including input devices such as a mouse and keyboard for receiving user input and a display for providing a control user interface for the user to interact with the networked devices. can The user interface may include a graphical user interface (GUI) to provide information to the user.

Network 120 includes wired and/or wireless networks. Network 120 may include the Internet. The network 120 may include a serial bus that provides a physical layer (media) for transmitting and receiving data between variously connected client devices 111, 112, and 113 and server devices 151, 152, and 153. Here, the serial bus may include a 1394 serial bus. This may support both time-multiplexed audio/video (A/V) streams and standard IP (Internet Protocol) communication (eg, IETF REC 2734), but is not necessarily limited thereto. . Network 120 may also include non-1394 networks (eg, Ethernet, etc.). Network 120 may also include a home network. In addition, the network 120 may be any network supporting Internet of Things (IoT) connection. Each of the client devices 111 , 112 , and 113 may communicate with one or more server devices 151 , 152 , and 153 on the network 120 .

Server devices 151, 152, and 153 respond to users' requests by using network resources to provide services to users. This includes the return of information (data). It also includes the performance of a function (e.g., a mechanical function) and return of state, the return of data stream and state, the acceptance of data stream and return of state, or the storage of state for various actions. The server devices 151, 152, and 153 may include custom, built-in, and control programs to implement control of their own hardware.

The server devices 151 , 152 , and 153 may be associated with a specific web site and/or web application, and perform calculations and management related to work performed in each web site and/or web application. Server devices 151, 152, 153 may interact with client devices 111, 112, 113 and other servers. Exemplary services may include MPEG sourcing/sinking, and display services.

The server devices 151 , 152 , and 153 interface data (e.g., HTML, XML, Java, JavaScript, GIF, JPEG, MPEG, graphics bursting or for the intended purpose) providing an interface for command and control of the device over the network 120. information in any other format used). The server devices 151, 152, and 153 may process information such as one or more hypertext markup languages (HTML) that provide command and control of the device. The server devices 151, 152, and 153 use Internet standards to represent HTML pages using a browser technique.

In this invention, the server devices 151, 152, and 153 may include a web server, an app server, and a database server. However, it does not necessarily have to consist only of a combination of three server devices. It is effective that only the web server exists and the app server and database server do not exist, or it is possible to configure only one app server, and other combinations of servers in various forms and layers are possible.

A web server is a server that provides requested contents to web clients. A web server can provide static HTML or images such as JPEG or GIF to a web browser through the HTTP protocol. In some cases, a web server can also embed a container that can run internal applications.

The app server may also be called a web application server (WAS) server, and represents a middleware software server that provides transaction processing and management and an application execution environment in a client/server environment. Typically, the server side can be built as a three-tier web computing environment of a web server, application server, and database server. At this time, the app server plays the same role as an application server in a client/server environment. The app server provides an application execution environment and database access function, manages transactions, performs business logic for processing tasks, and performs application linkage between different types of systems.

The database server is a repository where various data handled by the web server and/or the app server are stored. The database server may store a huge amount of data related to the work processed by the web server and/or the app server, depending on the nature of the web site or web application. This may include personal information, organization information, and data related to various contents (eg, multimedia contents).

The router 130 or a router having a routing function extracts the location and destination of packets transmitted from the client devices 111, 112, and 113 through the network 120, designates an optimal path to the location, and data along the path. Forward the packet to switch 140. The router 130 identifies the destination IP address and forwards the corresponding data to the switch 140 .

The switch 140 stores the unique MAC address of each server device 151, 152, and 153, and determines which packet should be transmitted to where through this address, and transmits the packet provided from the router 130 to the corresponding server 151, 152, and 153. send. The switch 140 includes switches serving as OSI layer 2, OSI layer 3, OSI layer 4, and/or other layers (eg, OSI layer 7). For example, a function of setting a route may be performed. In addition, functions such as load balancing, port forwarding, and QoS may be performed. A switch may be called a network switch, a switching hub, a port switching hub, and the like.

The switch 140 includes a packet mirroring function, and duplicates or captures all packets received from the client devices 111, 112, and 113 to the server devices 151, 152, and 153 and all packets transmitted from the server devices 151, 152, and 153 to the client devices 111, 112, and 113, and , and provides the duplicated packet to the network performance degradation monitoring device 160 according to the present invention.

In this invention, a session is named as including a process of 3-way handshaking. That is, the session is connected between the server and the client only when the 3-way handshaking is terminated, but if the 3-way handshaking attempt temporarily increases, the performance of the network system may be deteriorated. To do so, a SYN signal is transmitted and a session is named from the time of connection attempt.

2 is a block diagram of a network performance degradation monitoring device according to the present invention.

The network performance degradation monitoring device of this invention includes a packet analysis module 200, a structure management module 210, a risk management module 220, and a display management module 230.

The packet analysis module 200 determines, from the mirrored packets, information about the session, information about the server, information about the client, information about the application, information about the area, and the corresponding mirrored packet type (corresponding packet Whether this is a SYN signal, a SYN-ACK signal, a transaction request signal, or a transaction response signal) is extracted. For a method in which the packet analysis module 200 analyzes the above-described information from mirrored packets, reference may be made to Korean Patent Publication No. 2020-0033090.

The structure management module 210 manages each structure described below based on the packet information analyzed by the packet analysis module 200 .

The risk management module 220 calculates the performance degradation risk as a ratio of standby flows (SYN waiting, transaction response waiting) to all flows made in the network system. The risk management module 220 calculates performance degradation risks for each server, each client, each application, each region, and the entire network system.

The display management module 230 displays the performance degradation risk of each server, each client, each application, region, and the entire network system calculated by the risk management module 220 on the screen.

The network performance degradation monitoring apparatus of this invention manages each piece of information in a structure.

An apparatus for monitoring network performance degradation according to the present invention includes a plurality of session structures 241, 242, and 243 formed for each session for all sessions performed in a network system, and a plurality of server structures formed for each server for all servers forming all sessions. 251, 252, 253, a plurality of client structures 261, 262, 263 formed for each client for all clients forming all sessions, and a plurality of application structures formed for each application for all applications used by all clients ( 271, 272, and 273), and a plurality of regional structures 281, 282, and 283 formed for each region with respect to regions to which all the clients belong.

The session structures 241, 242, and 243 are managed by a session tree table 240, the server structures 251, 252, and 253 are managed by a server tree table 250, and the client structures 261, 262, and 263 are managed by a client tree table ( 260), the application structures 271, 272 and 273 are managed by the application hash table 270, and the local structures 281, 282 and 283 are managed by the local hash table 280.

The session tree table 240, the server tree table 250, and the client tree table 260 are managed by applying a red-black tree algorithm to structures managed respectively.

The region information may be country information or city information. Local information to which the client belongs can be obtained from the client IP address.

3 is an exemplary view of a session connection between a server and a client in a network system.

A session (we call this Session 1) is connected between Server1 and Client1 (using Application1), and a session (we call this Session2) is connected between Server1 and Client3 (Using Application1), and Server2 A session (this is called session 3) is connected between server 2 and client 2 (using application 2), a session (this is called session 4) is connected between server 2 and client 3 (using application 2), and server 2 and client A session (this is called session 5) is connected between 5 (using application 2), and a session (this is called session 6) is connected between server 3 and client 4 (using application 2). Client 1 and Client 2 are located in Region 1, and Client 3, Client 4 and Client 5 are located in Region 2.

4 is a structure configuration and connection diagram generated in the exemplary network system of FIG. 3, and FIG. 5 is a configuration diagram of a session structure according to the present invention.

In the example of FIG. 3, since there are 6 sessions, 6 session structures are formed. Information about session 1 connected between server 1 and client 1 is recorded and managed in the session 1 structure, and each structure in which server, client, application, and local information related to the session is recorded is linked.

As shown in FIG. 5, the session structure includes information 51 about the session, a server structure pointer 52 for connecting to a server structure corresponding to a server connected to the session, and a server structure pointer 52 corresponding to a client connected to the session. A client structure pointer 53 for connection to the client structure, an application structure pointer 54 for connection to the application structure corresponding to the application activated by the client connected to the session, and the location where the client connected to the session is located. Contains a local structure pointer 55 to connect to the corresponding local structure.

Here, the information about the session includes server information connected to the session, client information connected to the session, application information activated by the client connected to the session, region information where the client connected to the session is located, and It contains status information (request, wait, response). That is, it includes information such as whether a SYN signal or transaction request signal is transmitted from the client to the server, whether a response to the corresponding request is in an unfinished waiting state, or whether the response to the corresponding request is in a completed state sent to the client. The risk management module 220 calculates a performance degradation risk by periodically receiving status information of corresponding sessions for all sessions connected to the network system and calculating a ratio of standby flows among all flows.

In the Session1 structure, information about Session 1, server 1 structure pointer, client 1 structure pointer, application 1 structure pointer, and region 1 structure pointer are linked and stored. Similarly, in the Session2 structure, information on Session 2 connected between Server 1 and Client 3 is recorded and managed, and information on Session 2, server 1 structure pointer, client 3 structure pointer, and application 1 structure pointer And, the region 2 structure pointer is linked and stored.

Similarly, information about session 3 connected between server 2 and client 2 is recorded and managed in the session 3 structure, and information about session 4 connected between server 2 and client 3 is recorded and managed in the session 4 structure. Information about session 5 connected between server 2 and client 5 is recorded and managed in the session 5 structure, and information about session 6 connected between server 3 and client 4 is recorded and managed in the session 6 structure.

Each session structure contains information about each session, a server structure pointer to connect to the server structure corresponding to the session, a client structure pointer to connect to the client structure corresponding to the session, and an application structure used by the corresponding client. An application structure pointer to connect to and a local structure pointer to connect to a local structure to which the client belongs are recorded.

6 is a block diagram of a server structure according to the present invention.

The server structure includes information about the corresponding server 61, a session structure management table 62 that manages session structure pointers corresponding to all sessions to which the server is connected, and a client IP corresponding to all clients connected to the server. A client information management table 63 for managing addresses, an application information management table 64 for managing an application list corresponding to all applications activated in all clients connected to the server, and past risk information of the corresponding server It includes a server risk table 65 to store and a server current risk 66 to store the current performance degradation risk of the corresponding server. Preferably, the client IP address and application list are managed as hash values.

The risk management module 220 calculates the instantaneous risk by calculating the ratio of the standby flow to the total flow periodically (eg, 1 second), and calculates the instantaneous risk for the past 7 seconds based on the calculated instantaneous risk and past risk information stored in each structure. Calculate the current risk by averaging the risks of

Information about server 1 is recorded and managed in the server 1 structure, information about server 2 is recorded and managed in the server 2 structure, and information about server 3 is recorded and managed in the server 3 structure.

7 is a block diagram of a client structure according to the present invention.

The client structure includes information about the corresponding client 71, a session structure management table 72 that manages session structure pointers corresponding to all sessions to which the client is connected, and a server IP corresponding to all servers connected to the client. A server information management table 73 for managing addresses, an application information management table 74 for managing a list of all applications activated in the client, and a client risk table 75 for storing past risk information of the corresponding client; A client current risk 76 storing the current performance degradation risk of the corresponding client is included. Preferably, the server IP address and application list are managed as hash values.

Here, the client risk is calculated based on the standby flow of the server among all flows, and is calculated as a ratio of the flow waiting for a response for each client. The risk management module 220 periodically (eg, 1 second) calculates the instantaneous risk of the ratio of the standby flow to the total flow, and averages the risks of the past 7 seconds based on the past risk information stored in each structure to determine the current risk Calculate.

8 is a block diagram of an application structure according to the present invention.

The application structure includes information about the corresponding application 81, a session structure management table 82 that manages session structure pointers corresponding to all sessions to which all clients activated by the application are connected, and all clients activated by the application. A client information management table 83 for managing client IP addresses corresponding to the corresponding applications, an application risk table 84 for storing past risk information of the corresponding application, and an application current risk 85 for storing the current performance degradation risk of the corresponding application. ). Here, the client IP address is preferably managed as a hash value.

9 is a block diagram of a local structure according to the present invention.

The region structure includes information about the region 91, a session structure management table 92 that manages session structure pointers corresponding to all sessions to which all clients located in the region are connected, and all clients located in the region. A client information management table 93 for managing corresponding client IP addresses, an application information management table 94 for managing an application list corresponding to applications activated on all clients, and detailed region classification of the corresponding region A sub-region management table 95 for managing a sub-region list for the corresponding region, a region risk table 96 for storing past risk information of the corresponding region, and a region current risk 97 for storing the current performance degradation risk of the corresponding region include Here, it is preferable that the client IP address and application list are managed as hash values.

10 is an operational flow diagram illustrating a structure creation and update process of the present invention.

When a mirrored packet is input (S101), the packet analysis module analyzes the corresponding packet (S102). After extracting session information from the packet, the structure management module 210 queries the session tree table 240 for a session structure corresponding to the corresponding session. In the session tree table 240, when the corresponding session structure does not exist, the corresponding session structure is created and returned to the structure management module, and when the corresponding session structure exists, the current state of the corresponding session structure is updated (S103).

In addition, a server structure linked with the corresponding session structure is created or the corresponding server structure is updated (S104). In addition, a client structure linked with the corresponding session structure is created or the corresponding client structure is updated (S105). Also, an application structure linked with the corresponding session structure is created or the corresponding application structure is updated (S106). In addition, a local structure linked with the corresponding session structure is created or the corresponding local structure is updated (S107).

That is, when a new session is created, a session structure is created, and a server structure, client structure, application structure, and local structure corresponding to the session structure are created, or previously created server structures, client structures, application structures, and local structures are created. In , information on a currently created session is added by updating a session structure management table, a server information management table, a client information management table, an application information management table, and the like.

11 is an operational flow diagram illustrating the risk management process of the present invention.

When the risk calculation period arrives (S111), the risk management module detects state information for each session of all flows (S112). The risk management module calculates the flow versus standby flow for each server, reads the past risk information for each server and calculates the average value to calculate the current risk, and updates the server risk table of the server structure of each server and the server current risk ( S113).

The risk management module calculates the flow versus standby flow for each client, reads the past risk information for each client, calculates the average value to calculate the current risk, and updates the client risk table of the client structure of each client and the current risk of the client ( S114).

The risk management module calculates the flow versus standby flow for each application, reads the past risk information for each application, calculates the average value to calculate the current risk, and updates the application risk table of the application structure of each application and the current risk of the application ( S115).

The risk management module calculates the flow versus standby flow for each region, reads the past risk information for each region, calculates the average value, calculates the current risk, and updates the regional risk table of the regional structure of each region and the regional current risk (S116). ).

200: packet analysis module 210: structure management module
220: risk management module 230: display management module
240: session tree table 241~243: session structure
250: server tree table 251~253: server structure
260: client tree table 261~263: client structure
270: application hash table 271 to 273: application structure
280: local hash table 281~283: local structure

Claims (6)

A network performance degradation monitoring device provided by mirroring packets transmitted and received by a server end of a network system in which a plurality of client devices and a plurality of server devices are connected,
From the mirrored packet, information about a session, information about a server connected to the session, information about a client connected to the session, information about a client connected to the session, information about an application activated in the client, a packet analysis module for extracting information about a location and a type of the mirrored packet;
A session structure and a server structure based on the information analyzed by the packet analysis module. a structure management module that manages client structures, application structures and local structures;
A risk management module for calculating and managing a performance degradation risk as a ratio of standby flows to all flows in the network system using information stored in the session structure, server structure, client structure, application structure, and local structures,
The structure management module includes a session tree table for managing the session structures, a server tree table for managing the server structures, a client tree table for managing the client structures, an application hash table for managing the application structures, and the local structure. It includes a local hash table that manages
Each session structure includes information about the corresponding session, a server structure pointer for connecting to a server structure corresponding to a server connected to the corresponding session, and a client structure pointer for connecting to a client structure corresponding to a client connected to the corresponding session;
Each of the server structures includes information about the corresponding server, a session structure management table managing session structure pointers corresponding to all sessions to which the server is connected, and a client managing client IP addresses corresponding to all clients connected to the server. It includes an information management table,
Each of the client structures includes information about the corresponding client, a session structure management table managing session structure pointers corresponding to all sessions to which the client is connected, and a server managing server IP addresses corresponding to all servers connected to the client. Network system performance degradation real-time monitoring device comprising an information management table. The method of claim 1,
The session structure further includes an application structure pointer for connecting to an application structure corresponding to an application activated by a client connected to the corresponding session, and a local structure pointer for connecting to a local structure corresponding to a region where the client connected to the corresponding session is located. include,
The server structure includes an application information management table for managing an application list corresponding to all applications activated in all clients connected to the server, a server risk table for storing past risk information of the server, and a current performance degradation risk of the server. The server that stores the current risk further includes,
The client structure further includes an application information management table for managing a list of all applications activated in the client, a client risk table for storing past risk information of the corresponding client, and a client current risk for storing the current performance degradation risk of the corresponding client Network system performance degradation real-time monitoring device, characterized in that. The real-time monitoring device for performance degradation of a network system according to claim 1 , wherein the region information is country information or city information. The method of claim 1,
The application structure includes information about a corresponding application, a session structure management table managing session structure pointers corresponding to all sessions connected to all clients in which the application is activated, and a client IP address corresponding to all clients in which the application is activated. It includes a client information management table for managing them, an application risk table for storing past risk information of the corresponding application, and an application current risk for storing the current performance degradation risk of the corresponding application,
The region structure manages information about a corresponding region, a session structure management table managing session structure pointers corresponding to all sessions to which all clients located in the region are connected, and client IP addresses corresponding to all clients located in the region. a client information management table that manages an application list corresponding to applications activated on all clients, a lower region management table that manages a lower region list for detailed regional classification of a corresponding region, A network system performance degradation real-time monitoring device comprising: a region risk table for storing historical risk information; and a region current risk for storing current performance degradation risks in a corresponding region. The method of claim 1,
Each of the session tree table, the server tree table, and the client tree table,
An apparatus for monitoring network system performance degradation in real time, characterized in that each structure to be managed is managed by applying a red-black tree algorithm. The method of claim 1,
Network system performance degradation real-time monitoring device, characterized in that it further comprises a display management module to display on the screen the performance degradation risk of each server, each client, each application, region and the entire network system calculated by the risk management module.

Images