WO2002032068A2

WO2002032068A2 - Method for determining data packets

Info

Publication number: WO2002032068A2
Application number: PCT/EP2001/011900
Authority: WO
Inventors: Stefan Brock
Original assignee: Traian Internet Products Ag
Priority date: 2000-10-13
Filing date: 2001-10-15
Publication date: 2002-04-18
Also published as: AU2002223616A1; WO2002032068A3

Abstract

The invention relates to a method for determining data transmitted via a connection in a packet-oriented network. Said packet-oriented network is provided with a means which enables all data packets transmitted over the network to be evaluated. According to the invention, the dimensions relating to the control information of the network layer, the useful load of the network layer, the control information of the transport layer and the useful load of the transport layer are accumulated separately.

Description

EXPERIENCE FOR DETERMINING THE DATA TRANSMITTED IN A CONNECTION IN

A PACKAGE-ORIENTED NETWORK

The present invention relates to a method for determining the data transmitted in a connection in a packet-oriented network, the packet-oriented network having a means which permits the evaluation of all data packets transmitted in the network.

The so-called TCP / IP protocol is currently the general standard in packet-oriented networks. Are the data packets transmitted in a connection determined, e.g. B. to determine the total amount of data transmitted, there is currently no way to differentiate between user and protocol data of the different transmission layers. With log file analyzes, no service analysis is possible because control information is distributed via header and user data. It is also not possible to record the total data stream, i.e. to track whether a transmission has taken place at all or whether quality parameters of a service level agreement have been observed.

The problem on which the present invention is based is therefore to provide a method which enables an assignment of the useful and protocol data occurring in the respective layers of the transmission protocol protocol.

This problem is solved by a method according to claim 1. According to the invention, the size of control information of the network layer, of payload of the network layer, of control information of the transport layer and of the payload of the transport layer are each accumulated separately. This procedure offers the advantage that control information and useful information can be determined separately from one another.

In a further development of the method, it is provided that the means that allows the evaluation of all data packets transmitted in the network is a data station that has a filter that can filter all transmitted data packets. For this embodiment of the ner driving, the ner driving can be carried out using commercially available hardware, for example PCs. In a development of the method it is provided that all data packets transmitted in the network are evaluated in real time. Relevant parameters can be extracted directly from the evaluated data.

An embodiment of the invention is described below.

The basis is a TCP / IP network, which consists of a large number of so-called clients and a large number of so-called servers. The servers provide services such as HTTP, FTP, email or the like, the clients can use these services. The separation between client and server is not exclusive; a client can also act as a server, for example, and vice versa.

The transmitted data or the data connection is subdivided into a transport layer and a network layer, among other things, according to the ISO layer model. The transport layer provides a connection-oriented or connectionless protocol, the bitwise or hardware-side implementation of which is the responsibility of the layers below. In TCP / IP-oriented networks, z. B. the Transmition-ControU-ProtokoU (TCP) or User-Data-Protocol (UDP). These protocols contain options for addressing application processes using port numbers and checking options for the transmitted data packets with regard to errors that have occurred. The network layer primarily provides the functionality of addressing end systems.

Each station in a network usually only accepts data packets that are addressed directly to it. For this purpose, each data station evaluates the address fields of all data packets transmitted in the network and discards all data packets that are not directed to the station. This filtering usually already takes place independently, for example through a network card of the data station.

The network now has a so-called "sniffer", this is a data station that accepts all data packets, not just the data packets that are addressed directly to the station. For this purpose, the network card in the so-called "promiscous" Mode "operated. The "sniffer" evaluates all the data transmitted in its network segment, he has a hardware or software filter for the data packets. The filter rules of the filter can be configured as required; the filter evaluates both the control information of the IP packets, usually referred to as header data, and the user data of the IP packets. The result of the evaluation can e.g. B. Figures on the total amount of data transferred, the assignment of data amounts to individual workstations or content evaluations z. B. by key words within the user data.

In the present exemplary embodiment, the “sniffer” determines the control and user data belonging to a TCP connection. For this purpose, the information contained in individual data packets is commulated. The total amount S of control information of the IP packets is determined as the sum of the control information of the individual packets the total payload P of the IP packets is determined as the sum of the payload of the individual packets. In addition, the amount of the total control information H of the transport layer is ascertained as the sum of the control information of the individual data packets. The total payload Q of the transport layer can thus be the difference between the total payload and the total control information Q = PH can be determined accordingly, the total load L of the network layer can be transmitted as the sum of the total payload of the total amount of control information L = P + S.

A method for determining the data transmitted in a connection in a packet-oriented network is particularly preferred, the pallet-oriented network having a means that allows the evaluation of all data packets transmitted in the network, characterized in that the size of control information of the network layer , of the payload of the network layer, of control information of the transport layer and of the payload of the transport layer are each accumulated separately.

In one embodiment of the method, it is provided that the means that allows the evaluation of all data packets transmitted in the network is a data station that has a filter that can filter all transmitted data packets.

In a further embodiment of the method, it is provided that all data packets transmitted in the network are evaluated in real time. The present invention also relates to a method for determining the bandwidth to be provided for an IP connection, the IP connection between a transmitter and a receiver being monitored by a network monitoring and management system which is able to provide a connection with variable bandwidths to deliver.

Network non-monitoring and management systems are increasingly being used in IP networks. On the one hand, these systems should ensure that overloads, failures and the like can be recognized and reacted to, on the other hand, they should enable the provision of services with a guaranteed service quality. For this purpose, an admissible data transmission rate, usually referred to as bandwidth, is assigned dynamically or statically to different services.

This assignment is usually carried out by evaluating the data request from a receiver to a sender, for example by evaluating the address and port number. A disadvantage of this procedure is that different data streams that relate to the same service and thus the same port number are treated the same.

The present invention is therefore based on the problem of providing a method which allows the bandwidth provided to be adapted to the bandwidth actually required.

This problem is solved by a method according to claim 1. According to the invention, it is provided that the network monitoring and monitoring system can recognize the type of data to be transmitted and provide the bandwidth as a function of the type of data to be transmitted. Regardless of the underlying service, a dynamic adjustment of the bandwidth provided can be achieved.

In a development of the method according to the invention, it is provided that the bandwidth provided corresponds to the bandwidth required for the transmission of data in MPEG 4 format. MPEG 4 is a process that enables the quality of video and audio data to be adapted to the characteristics of the receiver. Using this method, video and audio data can be in different data densities depending on the recording or processing capability of the device. The amount of data required for the terminal is recognized at the start of the transfer and only this is subsequently transferred. The quality of the audio and video data transmitted is related to the amount of data to be transmitted. The higher the quality, the greater the amount of data to be transferred. If, for example, low-quality image data are to be transmitted for the display of a cell phone, this requires a very small amount of data. If data for moving images of a television set are to be transmitted, this requires a large amount of data and, in real-time transmission, a large transmission rate or bandwidth. In the method according to the invention, the data transmission rate or bandwidth made available is now adapted to the data density negotiated between the transmitter and the receiver for the transmission of the MPEG 4 format.

In a further development of the method according to the invention it can be provided that the bandwidth is additionally determined as a function of a service level agreement. The service level agreement specifies basic parameters and priorities for bandwidth allocation. This takes into account different priorities when allocating bandwidth to different users.

In a further development of the method according to the invention it can be provided that the bandwidth is additionally determined as a function of a bandwidth requested by the receiver. This measure takes into account the receiver's capabilities, which are unknown on the transmitter side, which the receiver can include in its bandwidth requirement.

In a development of the method according to the invention it can be provided that the bandwidth is guaranteed by reserving virtual channels. Depending on the underlying transmission medium, this is a common method of assuring transmission capacity in connectionless networks.

An exemplary embodiment of the invention is described below.

A system for network monitoring and management is installed in a BP-based network (internet, intranet, UMTS or the like). This system is able to provide certain services or individual connections with a certain bandwidth assign. The bandwidth is allocated on the basis of the source and destination address as well as the port number or desired service.

The monitoring measures the load on the network and the available network capacities, i.e. routes, bandwidths and availability.

The network monitoring system is able to determine bottlenecks in the route between sender and receiver. These bottlenecks are commonly referred to as "bottlenecks". If there is such a constriction, that is to say a location that limits the available bandwidth, this route is blocked for services that would overwhelm this bandwidth or its availability is restricted.

Depending on the type of data to be transmitted, the bandwidth allocated to a connection is controlled by the network monitoring system. If, for example, data is transmitted according to the MPEG 4 standard, the data density to be transmitted is determined as a function of the terminal. MEG 4 is a process for the dynamic adaptation of video and audio data quality to the receiver properties. With the help of this method, video and audio data can be transmitted in different data densities depending on the recording or processing capability of the terminal, so the amount of data required for the terminal is recognized at the beginning of the transmission and then only this is transmitted.

If the data density was determined at the beginning of the transmission of video or audio signals using the MPEG 4 process, the required bandwidth can be derived directly from this. The network monitoring and management system now defines the bandwidth available between the sender and the receiver so that it is just sufficient for the transmission of the audio or video data. In addition, the determination can be made depending on a service level agreement with the recipient or depending on the bandwidth requested by the recipient. The bandwidth to be provided can be assured, for example, by virtual transmission channels.

The bandwidth is adjusted dynamically depending on the data requested. For example, if an http homepage is requested, a bandwidth of 64 kbit could be specified. Will be of the same

The recipient subsequently requested a high-resolution image, so could for that Process the bandwidth, for example, to 128 kbit / sec. be determined. The subsequent retrieval of, for example, video streaming could, for example, set a bandwidth of 2 Mbit / sec. respectively. An order of an article following the video stream on an http page, which only contains text, could now be set again at 64 kbit / sec. respectively.

The above-mentioned figures for determining bandwidth are arbitrarily chosen examples, they are only intended to explain the basic process. In practice, determining this bandwidth depends on the available transmission medium.

A method for determining the bandwidth to be provided for an IP connection is particularly preferred, the IP connection between a sender and a receiver being monitored by a network monitoring and management system which is able to provide a connection with variable bandwidths which the network monitoring and monitoring system can recognize the type of data to be transmitted and provides the bandwidth depending on the type of data to be transmitted.

A further development of the method provides that the bandwidth provided corresponds to the bandwidth required for the transmission of data in MPEG 4 format.

In a further development of the method it is provided that the bandwidth is additionally determined as a function of a service level agreement.

In a development of the method it is provided that the bandwidth is additionally determined as a function of a bandwidth requested by the receiver.

In a development of the method it is provided that the bandwidth is guaranteed by reserving virtual channels.

The invention also relates to a method for measuring data traffic in SS7 networks. The Signaling System 7 (SS7) is a global standard in the telecommunications sector. This standard defines both a transmission method and a protocol with the help of which network elements in publicly switched telephone networks (so-called Public Switched Telephone Networks or PSTN) exchange information via a separate digital network. This ensures in particular the establishment of a connection and the control of telephone calls. So far, no methods are known that enable an evaluation of the data traffic in SS7 networks.

The invention is based on the problem of specifying a possibility for evaluating the data transmitted in an SS7 network.

This problem is solved by methods for measuring data traffic in SS7 networks comprising the following method steps: converting the voice and signal data of the SS7 protocol into a one of a packet-oriented protocol; Evaluating the transmitted data packets; Return of the individual protocol levels; Converting the packet-oriented data back into an SS7 data stream.

A further development of the method provides that the data packets transmitted are evaluated with a sniffer. This is a known technique for evaluating packet-oriented data streams. This means that commercially available hardware and software can be used for this purpose.

In a further development of the method it is provided that the data of a large number of sniffers are accumulated. In this way, data from different networks can be gathered and the accumulated data can be fed to a central evaluation.

In a development of the method it is provided that the data are analyzed with regard to the volume and / or the number of signal elements and / or the transmitter and / or the receiver and / or the service sent. Basically there is the possibility to map all protocol information as well as all content information of the SS7 data stream in a packet-oriented data stream. Accordingly, all of this information can be filtered out of the packet-oriented data stream using the aforementioned sniffer technology. The problem mentioned at the outset is also solved by an arrangement for measuring the data traffic in SS7 networks, comprising at least one partial route for transmitting the data in a packet-oriented protocol and at least one sniffer for receiving the packet-oriented data and an evaluation unit.

In a further development, the arrangement comprises several sniffers, the data of which are summarized by at least one collector. The collectors can be arranged hierarchically. Due to the hierarchical arrangement of the collectors, an evaluation and thus a reduction in the amount of data can take place in each hierarchy level.

Advantageous embodiments of the invention are further explained in the drawings. Here show:

Fig. 1: a sketch of the SS7;

2: a sketch of the transition from SS7 to IP;

3: a basic sketch of the method for packet evaluation in a TCP / IP network;

Fig. 4: a basic sketch of the collector hierarchy.

Fig. 1 shows a schematic diagram for setting up a telephone network according to SS7. SS7 uses an "out of bend signal" in which connection information is transmitted in a separate channel and not in the same channel as the telephone data. This has the advantage that telephone connections can be established more efficiently and with greater security. SS7 consists of a number of channels, the so-called "signaling links", which are connected by network nodes "signaling points". Service. Switching points (SSPS) start or end a call. These communicate with so-called service control points (SCPs), which route the route Determine the connection or the control of other service features, so-called signal transfer points (STPs) control the traffic in the SS7 network. Fig. 2 illustrates a transition from an SS7 network to a TCP / IP network. The data in the SS7 protocol are transferred to the TCP / EP protocol, transferred via a TCP / IP network and converted back to the original format. The TCP / IP network can be arbitrary. For example, this can consist solely of a sniffer that carries out the evaluation described below.

3 illustrates the evaluation method after the transition to the TCP / IP network. The data stream 1 of a transmitter is transmitted by means of a network 6 to a receiver and is returned there to a data stream 9. Nowadays, a packet-oriented network, such as TCP / IP, Tokenring or SNA, is usually used for this. B. over fiber or cable such. B. Ethernet. The network 6 can consist of several mutually independent transmission links that are used dynamically depending on their load. The data stream 1 of the transmitter is divided into individual packets 2. The packets 2 consist of user data 3 and header data 4 and together form a packet stream 5. The header data 4 contain information which allow the packets to be routed and allow the recipient to assemble the data stream, for example by sequential numbering of the packets 2. The individual packets 2 are fed to the receiver via the network 6 and converted back into the data stream 2 at the receiver using the header data 4. Ideally, data stream 1 of the transmitter and data stream 2 of the receiver after transmission over the network 6 are identical; deviations from one another manifest themselves as errors, for example as bit errors due to poor transmission quality.

The method now provides that within the transmission via the network 6 the packet stream 5 is first converted into a filter data stream 7 in real time. This contains both the data stream 1 of the transmitter in the form in which it was sent by the transmitter and all header data 4 of the individual packets 2. The filter data stream 7 is now fed to a filter 8. With the help of the filter 8, the filter data stream 7 can be searched for any information within the data stream 1 of the transmitter or the header data 4. In this way, information on the content of the data stream 1 of the transmitter can be obtained on the one hand, as well as destination or route information which result from the header data 4. In a next step, filter data stream 7 leaving filter 8 is transferred back into packet stream 5. This packet stream 5 can now be transmitted further in the network 6. Alternatively, the filter data stream 7 can be taken from the network 6 for evaluation, the packet stream 5 being transmitted unchanged. In this case, the packet filter stream 7 is not converted back after evaluation in the filter 8.

In the case of several independent SS7 networks, the evaluation data can be merged hierarchically and evaluated in a closed manner at each hierarchy level or made accessible to a central evaluation. For this purpose, each SS7 subnetwork is converted into data of a TCP / IP network as described above. The data are each evaluated by a sniffer 15 according to FIG. 4

The sniffer 15 is, for example, a commercially available PC in which the network card is operated in the so-called promiscous mode. The sniffer 15 evaluates all the data transmitted in its network segment, it has a hardware or software filter 8 for the data packets 2. The filter rules of the filter 8 can be configured as desired, the filter 8 evaluates both the control information of the IP packets 2, thus their header data 4, as well as the user data 3 of the IP packets 2. The result of the evaluation can e.g. B. Figures on the total amount of data transferred, the assignment of data amounts to individual workstations or content evaluations z. B. by keywords within the user data 3.

An extensive TCP / EP network, ie consisting of many network participants, consists of a plurality of network segments which are connected to one another by routers. Within each network segment, local data traffic remains within the segment, and data traffic going beyond segment boundaries is mediated by the routers 13 to the target segments. Data relating to data traffic is collected within certain segments or all segments of the network. For this purpose, a sniffer 15 is arranged in each subnet to be monitored, which can monitor the entire data traffic taking place within the subnet. The sniffers 15 collect the desired data and pass them on to collectors 10, which aggregate the data of several sniffers 15. The collectors 10 in turn pass on the data that you have collected and possibly already partially evaluated to other collectors 10.1. In this way, a tree-like hierarchy is created, which leads to a collector 10.2 as the central evaluation point. Within the collector hierarchy, user data, which can originate from different sources, are collected and consolidated. This results in several types of data collectors. Depending on the position of the collector 10 within the hierarchy, the latter accepts data from other collectors 10, from sniffers 15 or from both collectors 10 and from sniffers 15. Furthermore, collectors 10.1, which only accept data from other collectors 10, can be of different types, depending on the height within the hierarchy tree in which they are arranged.

A preferred embodiment relates to a method for measuring data traffic in SS7 networks, comprising the following method steps: converting the voice and signal data of the SS7 protocol into a packet-oriented protocol; Evaluating the transmitted data packets; Return of the individual protocol levels; Converting the packet-oriented data back into an SS7 data stream.

A further development of the method provides that the transmitted data packets (2) are evaluated with a sniffer (15).

A further development of the method provides that the data of a large number of sniffers (15) are accumulated.

In a further development of the method, it is provided that the old, redetected data are fed to a central evaluation.

In a development of the method it is provided that the data are analyzed with regard to the volume and or the number of signal elements and / or the transmitter and / or the receiver and / or the service sent.

A preferred arrangement for measuring data traffic in SS7 networks comprises at least one section (14) for transmitting the data in a packet-oriented protocol and at least one sniffer (15) for receiving the packet-oriented data (2) and an evaluation unit (17).

A further development of the arrangement comprises a number of sniffers (15), the data of which are summarized by at least one collector (10, 10.1, 10.2).

In a further development of the arrangement, the collectors are arranged hierarchically. LIST OF REFERENCE NUMBERS

data stream

package

payload

Header data

packet stream

network

Filter data stream

filter

data stream

collector

Network subscriber of a first local area network (LAN)

Network subscriber of a second local area network (LAN)

router

transmission network

Sniffer

Network Connection

evaluation

Claims

1. A method for determining the data transmitted in a connection in a packet-oriented network, the packet-oriented network having a means that allows the evaluation of all data packets transmitted in the network, characterized in that s the size of control information of the network layer, of payload the

Network layer, from control information of the transport layer and from the payload of the transport layer are each accumulated separately.

2. The method according to claim 1, characterized in that the means that allows the evaluation of all data packets transmitted in the network is a terminal that has a filter that can filter all transmitted data packets.

3. The method according to any one of claims 1 or 2, characterized in that the evaluation of all data packets transmitted in the network in

Real time.