WO2022270766A1

WO2022270766A1 - Device and method for automatic packet analysis-based intelligent network management

Info

Publication number: WO2022270766A1
Application number: PCT/KR2022/007006
Authority: WO
Inventors: 김신규
Original assignee: (주)소울시스템즈
Priority date: 2021-06-21
Filing date: 2022-05-17
Publication date: 2022-12-29
Also published as: KR102370113B1

Abstract

The present invention provides a device and method for automatic packet analysis-based intelligent network management, which can provide, by a single click, an accurate and fast troubleshooting guide for complex network issues (performance, failure, etc.) through automatic packet analysis, enable any network operator to manage a network easily and conveniently, and provide a customized network management service customized for user request by interworking with various systems through information collection and analysis functions.

Description

Intelligent network management device and method based on automatic packet analysis

The present invention relates to intelligent network management, and in particular, provides a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) An automatic packet analysis-based intelligent network management device and method that enables convenient network management and is suitable for providing customized network management services tailored to user needs by linking with various systems with information collection and analysis functions will be.

In general, intelligent network technology collectively refers to network and infrastructure technologies commonly used for the 4th industrial revolution and innovative growth based on intelligence, and in detail, software-defined networking (SDN), network functions virtualization (NFV), and network intelligence technology , low-latency/time-deterministic network technology, quantum information communication technology, network structure technology, transport network technology, and wired/wireless access technology.

In addition, the network intelligence technology repeats a series of procedures such as automatic collection of data and feedback for autonomous decision-making using artificial intelligence technologies such as machine learning. technology that automatically performs the functions of

The meaning of these intelligent networks is evolving over time, primarily leading to breakthroughs in computation and algorithms.

Prior art includes Korean Patent Registration No. 10-1998863 'System for Communication Failure Management and Maintenance of Network Equipment' and Korean Patent Registration No. 10-2133001 'Network Management Apparatus, Network Management System and Network Management Method'. has been disclosed.

If the network is down, it is directly related to the disruption of the business. In addition, business processing delays due to network performance degradation lead to direct losses for the organization. They answered that the average loss in the case of a single network outage is USD 402,542 in the US. (Source: The Rise of AIOps: How Data, Machine Learning, and AI Will Transform Performance Monitoring, Appdynamics News, 2018.12.17.) Therefore, it is necessary to minimize the network interruption situation.

The Uptime Institute, which evaluates the performance of networks, has studied publicly reported cases of network outages. Looking at this, among IT failures, network failures increased significantly from 19% in 2017 to 32% in 2018. Therefore, in the event of a network outage, a technology capable of quickly tracking the cause and suggesting a solution is required.

Conventional network management includes a Network Management System (NMS), a Traffic Management System (TMS), a Data Packet Inspector (DPI), and a Packet Analyzer.

However, NMS (Network Management System) focused on equipment and line monitoring has limitations in solving complex network issues. In addition, TMS (Traffic Management System) for network traffic management has a limitation in not supporting in-depth analysis of payload. In addition, DPI (Data Packet Inspector) and Packet Analyzer are very complicated and difficult to use, and have problems in that they require a high level of expertise.

Therefore, the present invention has been proposed to solve the above conventional problems, and the purpose of the present invention is to accurately and quickly identify the cause of various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis. automatic packet analysis that can provide customized network management services tailored to user needs by linking with various systems through information collection and analysis functions. It is to provide an intelligent network management device and method based on the same.

1 is a conceptual diagram of an automatic packet analysis-based intelligent network management device according to an embodiment of the present invention, FIG. 2 is a conceptual diagram showing detailed functions of each part in FIG. 1, and FIG. 3 is an intelligent network management device of FIG. 4 is a conceptual diagram showing detailed functions of the automatic diagnosis unit in FIG. 1, FIG. 5 is a conceptual diagram showing detailed functions of the one-click processing unit in FIG. 1, and FIG. 6 is a report in FIG. It is a conceptual diagram showing detailed functions of the preparation unit, and FIG. 7 is a conceptual diagram showing detailed functions of the user interface unit in FIG. 1 .

As shown in this, in the intelligent network management device 100 that performs network management, the intelligent network management device 100 provides accurate and fast causes with one click for various and complex network issues through automatic packet analysis. A control unit that provides a guide for identification and resolution, enables any network operator to manage the network easily and conveniently, and controls to provide customized network management services tailored to user needs by linking with various systems with information collection and analysis functions ( 110) and; An application data measurement unit 120 that measures data including network packets, SNMP TRAP, and SYSLOG information from the network equipment 210 of the data center or the remote intelligent network management device 220 under the control of the control unit 110, and ; a network performance analysis unit 130 under the control of the control unit 110 and analyzing network performance using the data measured by the application data measuring unit 120; an automatic diagnosis unit 140 under the control of the control unit 110 and automatically diagnosing a network state using a result analyzed by the network performance analysis unit 130; an event management unit 150 that receives the control of the control unit 110 and manages events including packet analysis events, SNMP TRAP events, and SYSLOG events; Under the control of the control unit 110, receiving the result of the automatic diagnosis unit 140, providing information necessary for network problem solving, including detailed network diagnosis information, meaning of the information, symptoms, expected causes, and countermeasures. a one-click processing unit 160 processing to provide a single click; a report preparation unit 170 under the control of the control unit 110 and generating a network diagnosis report based on packet analysis; A user interface unit 180 that receives the control of the control unit 110 and provides a user interface so that the user can manage the network.

The application data measuring unit 120 collects data types including network packets, SNMP TRAP, and SYSLOG, collects SPAN/Port Mirroring or Tap equipment, collects time is instant or schedule-based, collects data The storage is characterized by metadata and packet original (PCAP).

The network performance analysis unit 130 uses BPS, PPS, Latency or Timeout for network usage and performance analysis, uses TCP Session, UDP Session or HTTP Error for failure/event analysis, and analyzes application service (L7) uses HTTP, DNS, SMTP, POP3, IMAP, FTP Server trace or Client trace, L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis or payload analysis, and statistical and Trend analysis is characterized by using usage, performance indicators, failures, or events.

The automatic diagnosis unit 140 defines diagnosis items, measures the state of a diagnosis subject, provides symptoms of a diagnosis subject, provides expected causes, provides measures for each expected cause, and provides analysis results. The automatic diagnosis target includes performance, usage, UDP, TCP, or HTTP errors.

When a packet analysis event occurs, the event management unit 150 generates and manages three-step events of Warning, Critical, and Info, performs SNMP Trap event collection processing, supports SNMP v1, v2c or v3, and generates SYSLOG events. occurs, it collects and searches SYSLOG events, and performs classification by SYSLOG level.

The one-click processing unit 160, when the user clicks one or more of BPS, PPS, Latencies, Timeout, HTTP Error, and TCP Flag, provides detailed information about the clicked item, the meaning, symptoms, and expected causes of the information. , It provides information needed to solve network problems, including countermeasures, and provides network traffic status (Avg or Top) information when the BPS item is clicked, and Unicast, Multicast, Broadcast, or Unknown status information when the PPS item is clicked. When the Latencies item is clicked, the network response delay status information (by Avg, Top or IP) is provided. When the Timeout item is clicked, the network timeout status (by Avg, Top or IP) information is provided, and the HTTP Error When the item is clicked, HTTP Code state or URL comparison analysis status information is provided. When the TCP Flag item is clicked, TCP Zero Windows, Duplicate ACK, Retransmission, or Reset occurrence status information is provided. It provides user-specified time filter information, and is characterized in that it allows the user to manage the network by selecting a chart or graph.

8 is a flowchart illustrating an intelligent network management method based on automatic packet analysis according to an embodiment of the present invention.

As shown in this, when the network management is performed by the intelligent network management device 100, the application data measuring unit 120 receives network packets, SNMP, and data from the network equipment 210 of the data center or the remote intelligent network management device 220. A first step (ST1) of measuring data including TRAP and SYSLOG information; After the first step, the network performance analyzer 130 analyzes network performance using the data measured by the application data measurer 120 (ST2); A third step (ST3) of the automatic diagnosis unit 140 automatically diagnosing the state of the network using the result analyzed by the network performance analysis unit 130; After the third step, the one-click processing unit 160 receives the result of the automatic diagnosis unit 140 and is necessary for solving the network problem including detailed information of the network diagnosis, meaning of the information, symptom, expected cause, and action plan. a fourth step (ST4) of processing information to be provided with one click; After the fourth step, the user interface unit 180 provides a user interface so that the user can perform network management; a fifth step (ST5); and automatic packet analysis in the intelligent network management device 100 Provides a guide for accurate and quick cause identification and resolution with one click for various and complex network issues, enables any network operator to easily and conveniently manage the network, and interlocks with various systems with information collection and analysis functions. It is characterized in that it provides a customized network management service tailored to user needs.

An automatic packet analysis-based intelligent network management device and method according to the present invention provides a guide for accurately and quickly identifying and solving causes with one click for various and complex network issues (performance, failure, etc.) through automatic packet analysis In addition, it is possible for any network operator to manage the network easily and conveniently, and it is possible to provide customized network management services tailored to user needs by linking with various systems through information collection and analysis functions.

In addition, the present invention has the effect of providing all information necessary for problem solving, such as detailed information, meaning of the information, symptoms, expected causes, and measures, with a single click. In the prior art, the cause of the problem can be identified through an analysis process. However, there is a limitation that no action plan has been suggested.

In addition, the present invention makes it possible to clearly identify the cause of network problems with one click, to provide a troubleshooting guide (ADA: Automatic Diagnostics Analysis), and to approach problems without drilling down.

In addition, the present invention can be operated in one system (All-In-One) from information collection to analysis, diagnosis, and results, and provides optimal system selection options suitable for the operating environment (Portable, Rack Mount, Rugged PC, Cloud, etc.) This is possible, and immediate use (Zero Configuration) is possible without pre-setting work.

In addition, the present invention is a packet collection technology using a general NIC (Network Interface Controller), which has the advantage of not depending on the vendor, and has the advantage of not being affected by the user environment by internalizing the L7 protocol automatic classification engine, and interworking with EMS, SIEM, NMS, etc. (Rest API) There is a possible advantage, and there is an effect that a customizing service according to user needs is possible.

In addition, the present invention has the effect of reducing MTTR (Mean time to repair) by more than 1/5 while being about 1/4 cheaper than the price of a foreign solution for the same purpose. In the prior art, it takes about 1 to 2 weeks to collect system setting information, analyze it, and solve the problem of writing a report. On the other hand, the present invention has the advantage of being able to process information collection, analysis, report writing, and problem solving within about 2 to 3 days. (Here, the total time required to solve the problem is a general empirical value and may vary depending on the nature of the problem.) The present invention can shorten the pre-preparation (setup) time for collecting network information and reduce the time to identify the cause of the problem through analysis. can do. It can also reduce action and recovery time for problem resolution. In addition, the time to prepare the final report can be shortened.

In addition, in the case of the prior art, a network and solution operation expert is absolutely necessary for network management, whereas the present invention has the advantage that it can be operated even by a beginner network engineer.

1 is a conceptual diagram of an intelligent network management device based on automatic packet analysis according to an embodiment of the present invention.

FIG. 2 is a conceptual diagram showing detailed functions of each part in FIG. 1 .

3 is a conceptual diagram showing the connection between the intelligent network management device of FIG. 1 and an external device.

FIG. 4 is a conceptual diagram showing detailed functions of the automatic diagnosis unit in FIG. 1 .

5 is a conceptual diagram showing detailed functions of the one-click processing unit in FIG. 1 .

6 is a conceptual diagram showing detailed functions of the report preparation unit in FIG. 1 .

FIG. 7 is a conceptual diagram showing detailed functions of the user interface unit in FIG. 1 .

9 is a conceptual diagram showing an application example of the present invention.

10 is a conceptual diagram showing an example of constant network control in FIG. 9 .

11 is a conceptual diagram showing an example of integrated CCTV control in FIG. 9 .

FIG. 12 is a conceptual diagram showing an example of performance management after network separation in FIG. 9 .

13 is a conceptual diagram showing an example of network design in FIG. 9 .

A preferred embodiment of the automatic packet analysis-based intelligent network management device and method according to the present invention configured as described above will be described in detail based on the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention of a user or operator or precedent, and accordingly, the meaning of each term should be interpreted based on the contents throughout this specification. will be.

First of all, the present invention provides a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis, and allows any network operator to easily and conveniently manage the network. It is intended to provide customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

The intelligent network management device 100 that performs network management includes a control unit 110, an application data measurement unit 120, a network performance analysis unit 130, an automatic diagnosis unit 140, an event management unit 150, a one-click It may be configured to include a processing unit 160, a report writing unit 170, and a user interface unit 180.

The control unit 110 provides a guide for accurately and quickly identifying and resolving various and complex network issues with one click through automatic packet analysis in the intelligent network management device 100, and any network operator can easily and conveniently manage the network. It controls to provide customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

The application data measurement unit 120 is controlled by the controller 110 and measures data including network packets, SNMP TRAP, and SYSLOG information from the network equipment 210 of the data center or the remote intelligent network management device 220.

The network performance analyzer 130 is controlled by the controller 110 and analyzes network performance using data measured by the application data measurer 120 .

The automatic diagnosis unit 140 is controlled by the control unit 110 and automatically diagnoses the state of the network using the result analyzed by the network performance analysis unit 130 .

The event management unit 150 is controlled by the control unit 110 and manages events including packet analysis events, SNMP TRAP events, and SYSLOG events.

The one-click processing unit 160 is controlled by the control unit 110, receives the results of the automatic diagnosis unit 140, and network problems including detailed information of network diagnosis, meaning of the information, symptoms, expected causes, and countermeasures. It is processed to provide the information necessary for resolution with a single click.

The report preparation unit 170 is controlled by the control unit 110 and creates a network diagnosis report based on packet analysis.

The user interface unit 180 is controlled by the control unit 110 and provides a user interface so that the user can manage the network.

The types of data collected by the application data measuring unit 120 include network packets, SNMP TRAPs, and SYSLOGs. The collection method uses SPAN/Port Mirroring or Tap equipment. The point of collection is immediate or schedule-based. Throughput can be 500Mbps, 1G, 5G, 10G, etc. Collected data storage is metadata and packet origin (PCAP). The maximum storage capacity may be 76TB (Portable 32TB).

In addition, the application data measurement unit 120 receives data center information in the form of packets and manages the packet data in the form of information bundles. When packets are collected on the NIC, each packet is separately distributed and stored in individual queues (hardware buffers) inside the NIC to balance the load on the NIC. And the process of taking data out of the hardware buffer and processing it is done in the application program.

The application data measurement unit 120 creates a pre-specified number of queues in the NIC hardware itself. Then, a separate thread is allocated to read the data of the NIC. At this time, one is assigned to each queue. In addition, a separate buffer is created in advance to move and store raw packets in the NIC internal queue. Also, whether or not packets are accumulated in the queue can be checked automatically or manually. If there is an automatic check, there is a delay between the system checking the queue and notifying the program of the result. This is the process of "Checking the queue in the system → Sending messages to the program → Processing messages in the program → Processing the queue". At this time, the processes of 'sending messages to the program' and 'processing messages in the program' are the causes of delay. So, the delay is avoided by manual control based on an infinite loop. In other words, delay is avoided by performing the process of "checking the queue in the program → processing the queue → repeating".

In addition, the application data measuring unit 120 calculates and checks the size of the accumulated data for each queue by executing each thread at once and at the same time. Then, for each queue, the location to be stored in the buffer is selected. At this time, if the size of the data to be stored is larger than the remaining size of the buffer, the buffer is replaced with a new, empty buffer. Also, after specifying the storage location in advance, each thread simultaneously writes data to a single buffer. In general, when multiple threads simultaneously write data to a single buffer, a problem may arise when multiple threads simultaneously write data to the same location, but in this case, there is no problem because the areas where data are written do not overlap. Since the storage location is specified in advance, there is no room for memory waste. In the case of the prior art, since it uses a single thread, the writing speed is limited (up to around 10 Gbps), or the speed problem is solved by using separate FPGA-based hardware, whereas the present invention is purely 100% software-based. It has the advantage of enabling high-speed processing.

In addition, the application data measuring unit 120 manages a buffer for storing a plurality of packets, and each packet includes an L2 header, an L3 header, an L4 header, and a packet body (body and payload). The information bundle structure consists of 'the first time to be saved, the last time to be saved, information block 1, information block 2, information block 3, ..., information block n'. The structure of the information block consists of 'compressed size, actual size, compressed binary information data'. Among the previous information data, the fixed length consists of a structure such as 'fixed width data 1, fixed width data 2, fixed width data 3, fixed width data 4, ..., fixed width data n'. Among the previous information data, variable length is 'fixed-width data 1 (including variable-length information), variable-length data 1, fixed-width data 2 (including variable-length information), variable-length data 2, fixed-width data 3 (including variable-length information) , variable length data 3, ..., fixed width data n (including variable length information), and variable length data n'.

The application data measurement unit 120 generates metadata for individual packets. Metadata includes packet confirmation time, packet size, session ID, packet size, MAC address, and various types of TCP-specific information. The information bundle includes session information bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, and event information bundle. The session information bundle stores session ID, client IP/port, server IP/port, L4 protocol, and L7 protocol information. The BPS information bundle stores session ID, transmission time (in seconds), data size transmitted per second from client to server, and data size information transmitted from server to client per second. The PPS information bundle stores the session ID, transmission time (in seconds), the number of packets transmitted per second from the client to the server, and the number of packets transmitted per second from the server to the client. The RTT (Round Trip Time) information bundle stores session ID, transmission delay time from client to server, and transmission delay time information from server to client. The entire session information and occurrence time information are stored in the timeout information bundle. The TCP information bundle includes the time zone of TCP SYN and session information, TCP SYN, the time zone and session information of TCP RST, TCP RST, the time zone of TCP DUP ACK and session information, TCP DUP ACK, the time zone and session of TCP packet retransmission It stores information such as TCP packet retransmission, occurred time zone, and TCP other problem information such as the type of problem (TCP Zero Window, Port Reused, Out of Order). The Remarks information bundle stores HTTP request/response headers, DNS query and response results, SMTP email sender ID, FTP/IMAP/POP3 error content information. The event information bundle stores event information that occurs when the value is above or below a pre-defined threshold or above a variable rate.

The network performance analyzer 130 analyzes network usage and performance using BPS, PPS, Latency or Timeout. Failure/event analysis uses TCP Session, UDP Session or HTTP Error. Application service (L7) analysis uses HTTP, DNS, SMTP, POP3, IMAP, FTP Server trace or Client trace. L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis, or payload analysis. Statistics and trend analysis use usage, performance metrics, failures, or events.

In addition, the network performance analyzer 130 includes performance indicators of BPS, PPS, latency, and timeout in basic performance indicators and generates them. In addition, additional performance indicators include performance indicators of the number of flows generated by time and by IP, TCP performance indicators, performance indicators of IP lists that provide TCP-based services, IP lists that provide UDP-based services, performance indicators of MAC addresses for each IP, and data for each port number. Create one or more performance indicators from the performance indicators of usage status or performance indicators for each L7 protocol. TCP performance indicators include TCP RST, TCP Zero Windows, TCP DUP ACKS, TCP retransmission, TCP port reuse, and TCP packet out-of-order performance indicators. L7 performance indicators for each protocol include analysis by DNS query result, HTTP connection status, SMTP Performance indicators of data transmission amount measurement for each sender/receiver may be included.

The network performance analyzer 130 determines whether the performance index to be analyzed is BPS-based analysis, PPS-based analysis, Timeout-based analysis, TCP RST-based analysis, TCP Zero Windows analysis, TCP DUP ACK analysis, TCP retransmission analysis, TCP port reuse analysis, Determine which performance indicator analysis is used among TCP packet order reversal analysis, HTTP error status analysis, and additional performance indicator analysis.

If the performance indicator analysis is BPS-based analysis, the network performance analyzer 130 analyzes the traffic as 'traffic surge' if the traffic is 85% or more of the total available bandwidth, and if the traffic surge condition lasts for more than 60 seconds, it is classified as 'traffic excessive state persistence'. If more than 50% of the total traffic is concentrated on a single IP, it is analyzed as 'concentration of traffic to a specific IP', and if the traffic in use is less than 2% of the total available bandwidth, it is analyzed as 'suspected network failure'. In PPS-based analysis, if broadcast packets occupy more than 70% of all packets, it is analyzed as 'high bandwidth occupancy due to rapid increase in broadcast packets', and if non-IP packets occupy more than 50% of all packets If it does, it is analyzed as 'unknown packets occupies a large amount of bandwidth'. In the case of timeout-based analysis, if timeouts occur for more than 20 IPs per second during the period specified by the user, it is analyzed as 'suspicion of unavailability of service due to network interface shutdown or equipment outage', and if more than 10 IPs per second occur simultaneously during the period specified by the user ~ If timeout occurs for less than 20 IPs, it is analyzed as 'suspicion of service interruption due to cable or GBIC (Giga Bitrate Interface Converter) failure'. In the case of TCP RST-based analysis, if the same server sends RST more than 10 times per second, it is analyzed as 'when a request comes in to a destination port that does not exist on the server side, or when a connection is attempted to a port that has already been disconnected.' And, if the same client sends RST 5 or more times per second, it is analyzed as 'if the application wants to terminate the connection using Reset instead of FIN', and if the same client/server generates RST 3-4 times per second If this is the case, it is analyzed as 'a case where either the server or the client terminates without notifying the termination'. In the case of TCP Zero Windows analysis, if the TCP Zero Window phenomenon occurs more than 10 times per second, it is analyzed as 'suspicion of zero window creation due to errors in security devices such as firewalls and IPS or WAN accelerators'. In case of TCP DUP ACK analysis, if DUP ACK occurs more than 60 times per second in a specific IP, it is analyzed as 'Network Congestion'. In the case of TCP retransmission analysis, if TCP retransmission occurs more than 1000 times per second in a specific IP, it is analyzed as 'suspicion of loop occurrence in the duplication section'. In TCP port reuse analysis, if TCP port reuse is confirmed more than 3 times per second, it is analyzed as 'client-side local port exhaustion and server time wait state maintenance suspicion'. In the case of TCP packet out-of-order analysis, if out-of-order occurs more than 3 times per second, it is analyzed as 'suspicion of TCP segment loss due to packet loss'. In the case of HTTP error status analysis, if the status code is HTTP 4XX and the same phenomenon is found in less than 10 IPs, it is recognized as a 'user input problem' and analyzed. If the same phenomenon is found, it is recognized as 'there is a problem in the server or client code' and analyzed. If the performance index is additionally analyzed, the performance index is added and analyzed according to the addition of the system setting or the addition of the user.

Looking at the contents of automatic diagnosis in the automatic diagnosis unit 140, diagnosis items are defined, the condition of the diagnosis subject is measured, symptoms of the diagnosis subject are provided, expected causes are provided, and measures for each expected cause are provided. and provide analysis results. Automatic diagnosis targets include performance, usage, UDP, TCP or HTTP errors.

Event management targets in the event management unit 150 include events by packet analysis, SNMP TRAP events, SYSLOG events, and the like. When a packet analysis event occurs, it creates and manages the 3-step events of Warning, Critical, and Info, performs SNMP Trap event collection processing, and supports SNMP v1, v2c or v3. When a SYSLOG event occurs, SYSLOG event collection and search are performed, and classification by SYSLOG level is performed.

The report writer 170 creates a packet analysis-based diagnosis report, and creates a report including performance and usage, UDP/TCP analysis, and application analysis. Looking at the report creation function in the report creation unit 170, it includes period, IP, Port, and Tag filtering. It also allows you to select report item selections. For example, it can provide 16 selection options including network status, network usage and performance, failures/events, application services, automatic diagnosis, L2 to L7 analysis, statistics and trend analysis, and events. It also provides the ability to select the report title, date, and logo. In addition, an opinion input window for each report item is provided. In addition, a comprehensive opinion input window is provided. It can also provide, for example, four report templates. It also provides a report preview feature. It also provides the ability to create PDF and Tab Separated Values (TSV) files. In addition, it provides a download function for raw data storage and management by providing a RAW Data download function.

The external device may be a network equipment 210 of a data center or a remote intelligent network management device 220 or the like. The network equipment 210 of the data center connects to the physical network (Physical NW) through Tapping or Port Mirroring and measures data. In addition, the network equipment 210 of the data center may be a virtualization environment including a virtual switch (vSwitch). The remote intelligent network management device 220 may be a device installed in a remote office.

In the intelligent network management device 100, the application data measuring unit 120 measures raw data and generates meta information. Raw data becomes Network packet, SNMP Trap, Syslog, etc. These Raw Dates are stored and parsed to generate meta information. Through meta information generation, network state, usage, performance, failure and event information extraction, service automatic recognition, classification, etc. are performed and stored.

The automatic diagnosis unit 140 automatically diagnoses the network through network status, network use and performance, failure/event, application service, automatic diagnosis, L2 to L7 analysis, statistics and trend analysis, and event processing.

In the automatic diagnosis of the network status, the status of network equipment is identified through SNMP Trap information analysis, and Syslog data analysis is performed.

In the automatic diagnosis of network usage and performance, BPS (Bits Per Second), PPS (Packets Per Second), Latencies, and Timeout are automatically diagnosed.

Automatic diagnosis of failure/event performs automatic diagnosis on UDP Flag, TCP Resets, TCP Zero Windows, TCP Reuse, TCP Duplicate ACKs, and TCP Retransmission. It also performs automatic diagnosis for HTTP 4XX and HTTP 5XX.

Automatic diagnosis of application service performs automatic recognition of application service and detailed payload analysis. So, it performs automatic diagnosis for HTTP, DNS, SMTP, POP3, IMAP, and FTP.

Automatic diagnosis for problem causes and solutions is performed for TCP Retransmission, Hop Low, Microburst, RTT (Round Trip Time), TCP Reset, TCP Zero Windows, TCP DUP ACKs, and Timeout.

Automatic diagnosis of L2 ~ L7 analysis performs Mac usage analysis as Layer 2 analysis, Hop Account analysis as Layer 3 analysis, analysis by port (by source and destination) as Layer 4 analysis, and automatic diagnosis of application services through Layer 7 analysis. do.

Automatic diagnosis of statistics and trend analysis performs automatic diagnosis of performance indicators (BPS, PPS, Latency, Timeout), TCP related, HTTP error, Layer 7 analysis, and flow trend.

Automatic diagnosis of events performs threshold setting and control by performance, alarm generation and level setting, search and inquiry by alarm level, and automatic diagnosis of Syslog Server (Remote) and SNMP Trap Server. And Alarm/Event provides real-time network status monitoring and notification service.

When a user clicks one or more of BPS, PPS, Latencies, Timeout, HTTP Error, and TCP Flag, the one-click processing unit 160 provides detailed information about the clicked item, meaning, symptom, expected cause, and action of the information. Provides all information needed to solve network problems, including solutions.

Conventional competing technologies can identify the cause of a problem through a complicated analysis process, but have limitations in not being able to suggest countermeasures.

Therefore, the one-click processing unit 160 provides network traffic status (Avg or Top) information when the BPS item is clicked, Unicast, Multicast, Broadcast, or Unknown status information when the PPS item is clicked, and Latencies item is the original status information. When clicked, network response delay status information (by Avg, Top or IP) is provided. When the Timeout item is clicked, network Timeout status (by Avg, Top or IP) information is provided. When the HTTP Error item is clicked, HTTP Code Provides state or URL comparison analysis status information, provides TCP Zero Windows, Duplicate ACK, Retransmission, or Reset occurrence status information when the TCP Flag item is clicked, provides descriptions and causes of occurrence for each item, and user-specified time filter It provides information and allows the user to manage the network by selecting a chart or graph.

The report writer 170 generates a diagnosis report with one click without separate analysis or diagnosis work. Users can designate a desired period, insert a user logo, and provide a window for inputting general opinions.

The user interface unit 180 provides a dashboard UI (User Interface), statistics UI, analysis tool UI, payload tracking UI, report UI, automatic diagnostic analysis UI, event UI, system setting UI, and the like.

In the first step (ST1), when the intelligent network management device 100 performs network management, the application data measurement unit 120 receives network packets from the network equipment 210 of the data center or the remote intelligent network management device 220, Measure data including SNMP TRAP and SYSLOG information.

In the second step (ST2), the network performance analyzer 130 analyzes network performance using the data measured by the application data measurer 120 after the first step.

In the third step (ST3), the automatic diagnosis unit 140 automatically diagnoses the state of the network using the result analyzed by the network performance analysis unit 130.

In the fourth step (ST4), after the third step, the one-click processing unit 160 receives the result of the automatic diagnosis unit 140, and includes detailed information of the network diagnosis, meaning of the information, symptom, expected cause, and action plan. It processes to provide information needed to solve network problems with a single click.

In the fifth step (ST5), after the fourth step, the user interface unit 180 provides a user interface so that the user can manage the network.

Therefore, the intelligent network management device 100 provides a guide for accurate and quick cause identification and resolution with one click for various and complex network issues through automatic packet analysis, so that any network operator can easily and conveniently manage the network. and provides customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

Therefore, the present invention makes it possible to perform constant network control, performance, and failure event management of a business network through constant network control. Also, through CCTV integrated control, performance and failure management can be performed. In addition, it enables network performance improvement, network structure and configuration diagnosis through performance management after network separation. It also enables capacity optimization design through network design.

Therefore, it is possible to check usage and health (network operation status), monitor performance, monitor and solve problems, detect and warn abnormal behavior, optimize services, and provide regular reports through constant network control.

Through CCTV integrated control, usage and health (network operation status) checks, performance monitoring, failure monitoring and resolution, abnormal behavior detection and warning, service optimization, and provision of regular reports become possible.

After network separation, performance management can solve network performance problems. Therefore, it can contribute to VDI (Virtual Desktop Infrastructure) environment, physical network separation, and logical network separation.

13 is a conceptual diagram showing an example of network design in FIG. 9 .

Therefore, when designing a network, it becomes possible to check usage and health (network operation status), monitor performance, optimize services, and provide analysis reports.

As such, the present invention provides a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) with one click through automatic packet analysis, and enables network operators to easily and conveniently manage the network. It provides customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

Although the present invention has been described in more detail by way of examples above, the present invention is not necessarily limited to these examples, and may be variously modified without departing from the spirit of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

Claims

An intelligent network management device for managing a network,

The intelligent network management device automatically analyzes packets to provide a one-click accurate and quick guide for identifying and solving various and complex network issues, enabling any network operator to easily and conveniently manage the network. a control unit that controls to provide customized network management services tailored to user needs in conjunction with various systems through collection and analysis functions;

an application data measuring unit that measures data including network packets, SNMP TRAP, and SYSLOG information from network equipment of a data center or a remote intelligent network management device under the control of the control unit;

a network performance analysis unit under the control of the control unit and analyzing network performance using the data measured by the application data measurement unit;

an automatic diagnosis unit for automatically diagnosing a state of the network under the control of the control unit and using a result analyzed by the network performance analysis unit;

an event management unit that is controlled by the control unit and manages events including packet analysis events, SNMP TRAP events, and SYSLOG events;

Under the control of the control unit, receive the results of the automatic diagnosis unit, process to provide information necessary for solving network problems, including detailed information of network diagnosis, meaning of the information, symptom, expected cause, and action plan, with one click a one-click processing unit;

a report preparation unit under the control of the control unit and creating a network diagnosis report based on packet analysis;

a user interface unit that is controlled by the control unit and provides a user interface so that a user can perform network management;

Intelligent network management device based on automatic packet analysis, characterized in that configured to include.
The method according to claim 1, wherein the application data measuring unit,

The types of collected data include network packets, SNMP TRAP, and SYSLOG, the method of collection is using SPAN/Port Mirroring or Tap equipment, the point of collection is immediate or based on schedule, and the storage of collected data is metadata and original packet (PCAP) An intelligent network management device based on automatic packet analysis, characterized in that.
The method according to claim 1, wherein the network performance analysis unit,

Network usage and performance analysis uses BPS, PPS, Latency or Timeout, failure/event analysis uses TCP Session, UDP Session or HTTP Error, and application service (L7) analysis uses HTTP, DNS, SMTP, POP3, IMAP , FTP server tracking or client tracking is used, and L2 to L4 analysis is performed by Mac usage analysis, hop count analysis, UDP port analysis, TCP port analysis, or payload analysis. or an intelligent network management device based on automatic packet analysis, characterized in that using an event.
The method according to claim 1, wherein the automatic diagnosis unit,

Define diagnosis items, measure the condition of diagnosis subjects, provide symptoms of diagnosis subjects, provide expected causes, provide action methods for each expected cause, and provide analysis results. An intelligent network management device based on automatic packet analysis, characterized in that it includes UDP, TCP or HTTP errors.
The method according to claim 1, wherein the event management unit,

When a packet analysis event occurs, it generates and manages 3-step events of Warning, Critical, and Info, performs SNMP Trap event collection processing, performs SNMP v1, v2c or v3 support, and collects and searches SYSLOG events when a SYSLOG event occurs. An intelligent network management device based on automatic packet analysis, characterized in that it performs classification by SYSLOG Level.
The method according to claim 1, wherein the one-click processing unit,

When a user clicks one or more of BPS, PPS, Latencies, Timeout, HTTP Error, and TCP Flag, it is possible to solve network problems including detailed information about the clicked item, meaning of the information, symptoms, expected causes, and countermeasures. Provides necessary information, provides network traffic status (Avg or Top) information when the BPS item is clicked, Unicast, Multicast, Broadcast or Unknown status information when the PPS item is clicked, and provides information on the status of Unknown when the PPS item is clicked. Provides network response delay status information (by Avg, Top or IP), and provides network timeout status (by Avg, Top or IP) when the Timeout item is one-clicked, and HTTP Code state or Provides URL comparison and analysis status information, provides TCP Zero Windows, Duplicate ACK, Retransmission, or Reset occurrence status information when the TCP Flag item is clicked, provides descriptions and causes of occurrence for each item, and provides user-specified time filter information An intelligent network management device based on automatic packet analysis, characterized in that it provides a user to manage a network by selecting a chart or graph.
A first step of measuring data including network packets, SNMP TRAP, and SYSLOG information from network equipment in a data center or a remote intelligent network management device in an application data measuring unit when network management is performed by the intelligent network management device;

a second step of analyzing network performance by the network performance analysis unit after the first step using the data measured by the application data measurement unit;

a third step of automatically diagnosing the state of the network using the results analyzed by the network performance analyzer by the automatic diagnosis unit;

After the third step, the one-click processing unit receives the results of the automatic diagnosis unit, and provides information necessary for solving network problems, including detailed network diagnosis information, meaning of the information, symptoms, expected causes, and countermeasures, with one click. A fourth step of processing to do so;

A fifth step of allowing the user to perform network management by providing a user interface by the user interface after the fourth step; and

Automatic packet analysis in the intelligent network management device provides one-click accurate and quick cause identification and solution guide for various and complex network issues, enables network operators to easily and conveniently manage the network, and provides information An intelligent network management method based on automatic packet analysis, characterized by providing customized network management services tailored to user needs by linking with various systems with collection and analysis functions.