WO2022270767A1

WO2022270767A1 - Device for generating and managing information bundle for intelligent network management system, and method of same

Info

Publication number: WO2022270767A1
Application number: PCT/KR2022/007015
Authority: WO
Inventors: 김신규; 오현세
Original assignee: (주)소울시스템즈
Priority date: 2021-06-21
Filing date: 2022-05-17
Publication date: 2022-12-29
Also published as: KR102370114B1

Abstract

The present invention is to provide a device for generating and managing an information bundle for an intelligent network management system, and a method of same, which can: provide guidance for accurately and rapidly understanding the cause of and solving varied and complex network issues (performance, faults or the like) through a single click by generating and managing an information bundle; allow any network operator to easily and conveniently manage a network; and provide a user request-customized network management service linked with various systems through an information collection and analysis function.

Description

Information bundle creation management device and method of intelligent network management system

The present invention relates to an intelligent network management system, and in particular, creates and manages a bundle of information to provide a guide for accurate and quick cause identification and resolution with one click for various and complex network issues (performance, failure, etc.), An information bundle creation management device of an intelligent network management system that enables any network operator to manage the network easily and conveniently, and is suitable for providing customized network management services tailored to user needs by linking with various systems with information collection and analysis functions. and its method.

In general, intelligent network technology collectively refers to network and infrastructure technologies commonly used for the 4th industrial revolution and innovative growth based on intelligence, and in detail, software-defined networking (SDN), network functions virtualization (NFV), and network intelligence technology , low-latency/time-deterministic network technology, quantum information communication technology, network structure technology, transport network technology, and wired/wireless access technology.

In addition, the network intelligence technology repeats a series of procedures such as automatic collection of data and feedback for autonomous decision-making using artificial intelligence technologies such as machine learning. technology that automatically performs the functions of

The meaning of these intelligent networks is evolving over time, primarily leading to breakthroughs in computation and algorithms.

Prior art includes Korean Patent Registration No. 10-1998863 'System for Communication Failure Management and Maintenance of Network Equipment' and Korean Patent Registration No. 10-2133001 'Network Management Apparatus, Network Management System and Network Management Method'. has been disclosed.

If the network is down, it is directly related to the disruption of the business. In addition, business processing delays due to network performance degradation lead to direct losses for the organization. They answered that the average loss in the case of a single network outage is USD 402,542 in the US. (Source: The Rise of AIOps: How Data, Machine Learning, and AI Will Transform Performance Monitoring, Appdynamics News, 2018.12.17.) Therefore, it is necessary to minimize the network interruption situation.

The Uptime Institute, which evaluates the performance of networks, has studied publicly reported cases of network outages. Looking at this, among IT failures, network failures increased significantly from 19% in 2017 to 32% in 2018. Therefore, in the event of a network outage, a technology capable of quickly tracking the cause and suggesting a solution is required.

Conventional network management includes a Network Management System (NMS), a Traffic Management System (TMS), a Data Packet Inspector (DPI), and a Packet Analyzer.

However, NMS (Network Management System) focused on equipment and line monitoring has limitations in solving complex network issues. In addition, TMS (Traffic Management System) for network traffic management has a limitation in not supporting in-depth analysis of payload. In addition, DPI (Data Packet Inspector) and Packet Analyzer are very complicated and difficult to use, and have problems in that they require a high level of expertise.

Accordingly, the present invention has been proposed to solve the above conventional problems, and the object of the present invention is to generate and manage information bundles to accurately and accurately manage various and complex network issues (performance, failure, etc.) with one click. It provides a guide for quick cause identification and resolution, enables any network operator to easily and conveniently manage the network, and provides customized network management services tailored to user needs by linking with various systems with information collection and analysis functions. It is to provide an information bundle generation management device and method of an intelligent network management system.

1 is a conceptual diagram of an information bundle generation and management device of an intelligent network management system according to an embodiment of the present invention, and FIG. 2 is a detailed conceptual diagram showing an example of receiving and storing packet data in the packet capture unit of FIG. 3 is a detailed conceptual diagram showing an example of storing packets in the raw packet storage buffer in the packet capture unit of FIG. 1, and FIG. 4 is a detailed conceptual diagram showing an example of calculating and checking the size of accumulated data for each queue in the packet capture unit of FIG. 1. , FIG. 5 is a detailed conceptual diagram showing an example of selecting a location to store in a buffer for each queue in the packet capture unit of FIG. 1, and FIG. 7 is a conceptual diagram showing an example of raw data managed by the information bundle generator of FIG. 1, and FIG. 8 is a conceptual diagram showing an example of information data managed by the information bundle generator of FIG. 1. .

As shown in this, in the information bundle creation and management device 100 of the intelligent network management system that performs network management, the information bundle creation and management device 100 generates and manages information bundles to issue various and complex network issues. (Performance, failure, etc.) with one click, it provides a guide for accurate and quick cause identification and resolution, enables any network operator to manage the network easily and conveniently, and works with various systems through information collection and analysis functions. a control unit 110 which controls to provide a customized network management service tailored to user needs; Under the control of the control unit 110, receiving packet data of the data center 200 through a network interface card (NIC), and generating an information bundle by bundling the received packet data into one data stream a packet capture unit 120 that collects packets of the data center 200 by generating raw data necessary for processing and storing the raw data in a raw packet storage buffer 121; Under the control of the control unit 110, metadata for packets collected by the packet capture unit 120 is generated, and the metadata includes packet check time, packet size, session ID, packet size, MAC address, and TCP information. It includes session information bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, and event information bundle, and simultaneously compresses data for each type of information bundle. an information bundle generating unit 130 for storing and storing; It is controlled by the control unit 110, receives the information bundle generated by the information bundle generator 130, generates performance indicators required for network management, and types of information to be used in the information bundle based on the generated performance indicators. and a performance analyzer 140 that selects and then analyzes the performance of the network to generate a performance index result and provides the result to the user.

As shown in FIGS. 4 to 6, the packet capture unit 120 calculates and checks the size of accumulated data for each queue by simultaneously performing each thread at once, selects a location to store in a buffer for each queue, and selects a location to store the data in a buffer for each queue. When the size of the data is larger than the remaining size of the buffer, the buffer is replaced with a new, empty buffer, a location to be saved is designated in advance, and then each thread simultaneously writes data to a single buffer.

The information bundle generating unit 130 stores session ID, client IP/port, server IP/port, L4 protocol, and L7 protocol information in the session information bundle; Stores session ID, transmission time (in seconds), data size transmitted from client to server per second, and data size transmitted from server to client per second in the BPS information bundle; Stores the session ID, transmission time (in seconds), the number of packets transmitted from the client to the server per second, and the number of packets transmitted from the server to the client per second in the PPS information bundle; storing a session ID, a transmission delay time from a client to a server, and a transmission delay time information from a server to a client in a round trip time (RTT) information bundle; Store overall session information and occurrence time information in the timeout information bundle; Time zone where TCP SYN occurred in the TCP information bundle, session information, TCP SYN, time zone where TCP RST occurred, TCP RST, session information, time zone where TCP DUP ACK occurred, TCP DUP ACK, session information, time zone where TCP packet retransmission occurred, and session Stores information such as TCP packet retransmission, occurrence time, and TCP other problem information such as problem types (TCP Zero Window, Port Reused, Out of Order); HTTP request/response headers, DNS query and response results, SMTP email sender ID, FTP/IMAP/POP3 error content information are stored in the Remarks information bundle; It is characterized in that event information generated when the event information bundle is greater than or less than a pre-defined threshold or greater than a variable rate is stored in the event information bundle.

9 is a flowchart showing a method for generating and managing an information bundle in an intelligent network management system according to an embodiment of the present invention, and FIG. 10 is a detailed flowchart of the information bundle generation step in FIG. 9 .

As shown in this, when the information bundle generation and management device 100 of the intelligent network management system performs information bundle generation, the information bundle generation and management device 100 receives packet data of the data center 200 receiving step (ST1); After the packet data receiving step, the packet capture unit 120 bundles the received packet data into one data stream, generates raw data necessary for generating an information bundle, and stores it in the raw packet storage buffer 121, The packets of the data center 200 are collected, but each thread simultaneously calculates and checks the size of the accumulated data for each queue, selects a location to store in the buffer for each queue, and determines the size of the data to be stored is greater than the remaining size of the buffer. a packet measuring step (ST2) of replacing the buffer with a new, empty buffer, designating a storage location in advance, and then performing data writing to a single buffer simultaneously by each thread; After the packet measurement step, the information bundle generator 130 generates metadata for the collected packets, and the metadata includes packet confirmation time, packet size, session ID, packet size, MAC address, and TCP information, Information that creates session information bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, and event information bundle, and simultaneously compresses and stores data for each type of information bundle a bundle generating step (ST3); After the information bundle generation step, the performance analysis unit 140 receives the generated information bundle, generates performance indicators required for network management, selects the type of information to be used from the information bundle based on the generated performance indicators, and then It is characterized by performing including; a performance analysis step (ST4) of generating a performance index result by analyzing performance and providing the result to the user.

As shown in FIG. 10, the information bundle generating step (ST3) includes a buffer preparation step (ST11) of preparing a buffer to process data; After the buffer preparation step, a packet simultaneous processing step (ST12) of processing multiple packets at the same time through multi-threading by parsing the L2 to L4 headers of each packet in the buffer; a classifying step for each session (ST13) of classifying packets corresponding to the same session for each session based on the result of the simultaneous packet processing step; Extract data necessary for generating an information bundle for each session classified in the session-specific classification step, including session basic information, BPS, PPS, TCP DUP ACK / TCP retransmission, L7 protocol automatic recognition, and necessary data for each L7 protocol, L7 protocol automatic recognition reads within 20 bytes of the first packet of the session and analyzes the type of L7 protocol. Data necessary for each L7 protocol includes HTTP header, DNS query result interpretation, SMTP sending/receiving ID recognition, IMAP sending/receiving error information Data extraction step (ST14) for each session including; a data compression step (ST15) of simultaneously compressing data for each information bundle type after the data extraction step for each session; An information bundle file storage step (ST16) of storing the information generated after the data compression step in a single information bundle file and generating one file for each buffer to process the data.

An apparatus and method for generating and managing information bundles of an intelligent network management system according to the present invention generates and manages information bundles to accurately and quickly identify and resolve causes of various and complex network issues (performance, failure, etc.) with one click. It has the effect of providing a guide for user needs, making it easy and convenient for any network operator to manage the network, and providing customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

In addition, the present invention can be operated in one system (All-In-One) from information collection to analysis, diagnosis, and results, and provides optimal system selection options suitable for the operating environment (Portable, Rack Mount, Rugged PC, Cloud, etc.) This is possible, and immediate use (Zero Configuration) is possible without pre-setting work.

In addition, the present invention is a packet collection technology using a general NIC (Network Interface Controller), which has the advantage of not depending on the vendor, and has the advantage of not being affected by the user environment by internalizing the L7 protocol automatic classification engine, and interworking with EMS, SIEM, NMS, etc. (Rest API) There is a possible advantage, and there is an effect that a customizing service according to user needs is possible.

In addition, the present invention has the effect of reducing MTTR (Mean time to repair) by more than 1/5 while being about 1/4 cheaper than the price of a foreign solution for the same purpose. In the prior art, it takes about 1 to 2 weeks to collect system setting information, analyze it, and solve the problem of writing a report. On the other hand, the present invention has the advantage of being able to process information collection, analysis, report writing, and problem solving within about 2 to 3 days. (Here, the total time required to solve the problem is a general empirical value and may vary depending on the nature of the problem.) The present invention can shorten the pre-preparation (setup) time for collecting network information and reduce the time to identify the cause of the problem through analysis. can do. It can also reduce action and recovery time for problem resolution. In addition, the time to prepare the final report can be shortened.

In addition, in the case of the prior art, a network and solution operation expert is absolutely necessary for network management, whereas the present invention has the advantage that it can be operated even by a beginner network engineer.

1 is a conceptual diagram of a device for generating and managing information bundles of an intelligent network management system according to an embodiment of the present invention.

FIG. 2 is a detailed conceptual diagram showing an example of receiving and storing packet data in the packet capture unit of FIG. 1 .

FIG. 3 is a detailed conceptual diagram illustrating an example of storing packets in a raw packet storage buffer in the packet capture unit of FIG. 1 .

FIG. 4 is a detailed conceptual diagram showing an example of calculating and checking the size of accumulated data for each queue in the packet capture unit of FIG. 1 .

FIG. 5 is a detailed conceptual diagram showing an example of selecting a location to store in a buffer for each queue in the packet capture unit of FIG. 1 .

FIG. 6 is a detailed conceptual diagram showing an example in which each thread simultaneously writes data to a single buffer in the packet capture unit of FIG. 1 .

FIG. 7 is a conceptual diagram showing an example of raw data managed by the information bundle generating unit of FIG. 1 .

FIG. 8 is a conceptual diagram showing an example of information data managed by the information bundle generating unit of FIG. 1 .

9 is a flowchart showing a method for generating and managing information bundles of an intelligent network management system according to an embodiment of the present invention.

FIG. 10 is a detailed flowchart of the information bundle generating step in FIG. 9 .

A preferred embodiment of the information bundle generation and management device and method of the intelligent network management system according to the present invention configured as described above will be described in detail based on the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention of a user or operator or precedent, and accordingly, the meaning of each term should be interpreted based on the contents throughout this specification. will be.

First, the present invention creates and manages information bundles to provide a guide for accurately and quickly identifying and solving causes with one click for various and complex network issues (performance, failure, etc.), and any network operator can easily and conveniently It is intended to provide customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

The information bundle generation and management device 100 of the intelligent network management system that performs network management may include a control unit 110, a packet capture unit 120, an information bundle generation unit 130, and a performance analysis unit 140. there is.

An external device connected to the information bundle creation and management device 100 may be a data center 200 or the like. The data center 200 measures data by connecting to a physical network (Physical NW) by Tapping or Port Mirroring. In addition, the network equipment 210 of the data center may be a virtualization environment including a virtual switch (vSwitch).

The control unit 110 creates and manages information bundles in the information bundle creation management device 100 to provide a guide for accurately and quickly identifying and solving causes with one click for various and complex network issues (performance, failure, etc.) It allows any network operator to manage the network easily and conveniently, and controls to provide customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

The packet capture unit 120 receives the packet data of the data center 200 through a network interface card (NIC) under the control of the control unit 110, and converts the received packet data into one data stream. The packets of the data center 200 are collected by generating raw data necessary for generating an information bundle by bundling and storing the raw data in the raw packet storage buffer 121 .

The information bundle generator 130 is under the control of the control unit 110 and generates metadata about the packets collected by the packet capture unit 120. The metadata includes packet check time, packet size, session ID, and packet size. , MAC address and TCP information are included, and session information bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, and event information bundle are created. Data is compressed and stored by type at the same time.

The performance analysis unit 140 is controlled by the control unit 110, receives the information bundle generated by the information bundle generator 130, generates performance indicators required for network management, and generates information based on the generated performance indicators. After selecting the type of information to be used in the bundle, it analyzes the performance of the network to generate performance index results and provides the results to the user.

The intelligent network management system of the present invention can automatically diagnose the network using information bundles. Looking at the contents of automatic diagnosis, it defines diagnosis items, measures the condition of the diagnosis subject, provides symptoms of the diagnosis subject, provides expected causes, provides countermeasures for each expected cause, and provides analysis results. Automatic diagnosis targets include performance, usage, UDP, TCP or HTTP errors.

Auto-diagnosis of the network includes network status, network usage and performance, faults/events, application services, auto-diagnosis, L2 to L7 analysis, statistics and trend analysis, and event handling functions, through these functions, auto-diagnosis of the network can be performed.

In the automatic diagnosis of the network status, the status of network equipment is identified through SNMP Trap information analysis, and Syslog data analysis is performed.

In the automatic diagnosis of network usage and performance, BPS (Bits Per Second), PPS (Packets Per Second), Latencies, and Timeout are automatically diagnosed.

Automatic diagnosis of failure/event performs automatic diagnosis on UDP Flag, TCP Resets, TCP Zero Windows, TCP Reuse, TCP Duplicate ACKs, and TCP Retransmission. It also performs automatic diagnosis for HTTP 4XX and HTTP 5XX.

Automatic diagnosis of application service performs automatic recognition of application service and detailed payload analysis. So, it performs automatic diagnosis for HTTP, DNS, SMTP, POP3, IMAP, and FTP.

Automatic diagnosis for problem causes and solutions is performed for TCP Retransmission, Hop Low, Microburst, RTT (Round Trip Time), TCP Reset, TCP Zero Windows, TCP DUP ACKs, and Timeout.

Automatic diagnosis of L2 ~ L7 analysis performs Mac usage analysis as Layer 2 analysis, Hop Account analysis as Layer 3 analysis, analysis by port (by source and destination) as Layer 4 analysis, and automatic diagnosis of application services through Layer 7 analysis. do.

Automatic diagnosis of statistics and trend analysis performs automatic diagnosis of performance indicators (BPS, PPS, Latency, Timeout), TCP related, HTTP error, Layer 7 analysis, and flow trend.

Automatic diagnosis of events performs threshold setting and control by performance, alarm generation and level setting, search and inquiry by alarm level, and automatic diagnosis of Syslog Server (Remote) and SNMP Trap Server. And Alarm/Event provides real-time network status monitoring and notification service.

When packets are collected in the NIC, the packet capture unit 120 separately distributes and stores each packet in an individual queue (hardware buffer) inside the NIC for load distribution in the NIC. And the process of taking data out of the hardware buffer and processing it is done in the application program.

So, the packet capture unit 120 creates a predetermined number of queues in the NIC hardware itself. Also, the packet capture unit 120 allocates a separate thread for reading NIC data. At this time, one is assigned to each queue. In addition, the packet capture unit 120 creates in advance a separate buffer capable of moving and storing raw packets in the NIC internal queue. Also, whether or not packets are accumulated in the queue can be checked automatically or manually. If there is an automatic check, there is a delay between the system checking the queue and notifying the program of the result. This is the process of "Checking the queue in the system → Sending messages to the program → Processing messages in the program → Processing the queue". At this time, the processes of 'sending messages to the program' and 'processing messages in the program' are the causes of delay. So, the delay is avoided by manual control based on an infinite loop. In other words, delay is avoided by performing the process of "checking the queue in the program → processing the queue → repeating".

4 is a detailed conceptual diagram showing an example of calculating and checking the size of accumulated data for each queue in the packet capture unit of FIG. 1, and FIG. 5 is a detailed example of selecting a location to store in a buffer for each queue in the packet capture unit of FIG. 1 6 is a detailed conceptual diagram showing an example in which each thread simultaneously writes data to a single buffer in the packet capture unit of FIG. 1 .

Therefore, as shown in FIG. 4 , the packet capture unit 120 calculates and checks the size of accumulated data for each queue by simultaneously executing each thread at once.

Also, as shown in FIG. 5, the packet capture unit 120 selects a location to store in a buffer for each queue. At this time, if the size of the data to be stored is larger than the remaining size of the buffer, the buffer is replaced with a new, empty buffer.

Also, as shown in FIG. 6, the packet capture unit 120 designates a storage location in advance, and then each thread simultaneously writes data to a single buffer. In general, when multiple threads simultaneously write data to a single buffer, a problem may arise when multiple threads simultaneously write data to the same location, but in this case, there is no problem because the areas where data are written do not overlap. Since the packet capture unit 120 specifies the storage location in advance, there is no room for memory waste. In the case of the prior art, since it uses a single thread, the writing speed is limited (up to around 10 Gbps), or the speed problem is solved by using separate FPGA-based hardware, whereas the present invention is purely 100% software-based. It has the advantage of enabling high-speed processing.

The information bundle generating unit 130 manages a buffer for storing a plurality of packets, and each packet includes an L2 header, an L3 header, an L4 header, and a packet body (body and payload).

The information bundle structure of the information bundle generator 130 consists of a structure such as 'first time stored, last time stored, information block 1, information block 2, information block 3, ..., information block n' there is.

The structure of the information block consists of 'compressed size, actual size, compressed binary information data'.

Among the previous information data, the fixed length consists of a structure such as 'fixed width data 1, fixed width data 2, fixed width data 3, fixed width data 4, ..., fixed width data n'.

Among the previous information data, variable length is 'fixed-width data 1 (including variable-length information), variable-length data 1, fixed-width data 2 (including variable-length information), variable-length data 2, fixed-width data 3 (including variable-length information) , variable length data 3, ..., fixed width data n (including variable length information), and variable length data n'.

The information bundle generator 130 generates metadata for individual packets. Metadata includes packet confirmation time, packet size, session ID, packet size, MAC address, and various types of TCP-specific information.

The information bundle generated by the information bundle generator 130 includes a session information bundle, a BPS information bundle, a PPS information bundle, an RTT information bundle, a timeout information bundle, a TCP information bundle, a Remarks information bundle, an event information bundle, and the like.

The session information bundle stores session ID, client IP/port, server IP/port, L4 protocol, and L7 protocol information.

The BPS information bundle stores session ID, transmission time (in seconds), data size transmitted per second from client to server, and data size information transmitted from server to client per second.

The PPS information bundle stores the session ID, transmission time (in seconds), the number of packets transmitted per second from the client to the server, and the number of packets transmitted per second from the server to the client.

The RTT (Round Trip Time) information bundle stores session ID, transmission delay time from client to server, and transmission delay time information from server to client.

The entire session information and occurrence time information are stored in the timeout information bundle.

The TCP information bundle includes the time zone of TCP SYN and session information, TCP SYN, the time zone and session information of TCP RST, TCP RST, the time zone of TCP DUP ACK and session information, TCP DUP ACK, the time zone and session of TCP packet retransmission It stores information such as TCP packet retransmission, occurred time zone, and TCP other problem information such as the type of problem (TCP Zero Window, Port Reused, Out of Order).

The Remarks information bundle stores HTTP request/response headers, DNS query and response results, SMTP email sender ID, FTP/IMAP/POP3 error content information.

The event information bundle stores event information that occurs when the value is above or below a pre-defined threshold or above a variable rate.

In the packet data receiving step (ST1), when the information bundle generation and management device 100 of the intelligent network management system performs the information bundle generation, the information bundle generation and management device 100 receives the packet data of the data center 200.

In the packet measurement step (ST2), after the packet data reception step, the packet capture unit 120 bundles the received packet data into one data stream to generate raw data necessary for generating an information bundle, and the raw packet storage buffer 121 ), and collects the packets of the data center 200, but each thread simultaneously calculates and checks the size of accumulated data for each queue, selects a location to store in the buffer for each queue, and determines the size of data to be stored If it is larger than the remaining size of the buffer, the buffer is replaced with a new, empty buffer, and after designating the storage location in advance, each thread simultaneously writes data to a single buffer.

In the information bundle generating step (ST3), after the packet measurement step, the information bundle generating unit 130 generates metadata for the collected packets, and the metadata includes packet confirmation time, packet size, session ID, packet size, and MAC address. and TCP information, and generates session information bundles, BPS information bundles, PPS information bundles, RTT information bundles, timeout information bundles, TCP information bundles, Remarks information bundles, and event information bundles, and simultaneously for each type of information bundle. Data is compressed and stored.

In the performance analysis step (ST4), after the information bundle generation step, the performance analysis unit 140 receives the generated information bundle, generates performance indicators required for network management, and information to be used in the information bundle based on the generated performance indicators. After selecting the type, the performance of the network is analyzed to generate performance index results and the results are provided to the user.

Therefore, in the buffer preparation step ST11 of the information bundle generating step ST3, a buffer to process data is prepared.

In the simultaneous packet processing step (ST12), after the buffer preparation step, L2 to L4 headers of each packet in the buffer are analyzed through parsing, and multiple packets are simultaneously processed through multi-threading.

In the classification step for each session (ST13), packets corresponding to the same session are classified for each session based on the result of the simultaneous packet processing step.

In the data extraction step for each session (ST14), data necessary for generating an information bundle is extracted for each session classified in the classification step for each session. At this time, basic session information, BPS, PPS, TCP DUP ACK/TCP retransmission, L7 protocol automatic recognition, and necessary data for each L7 protocol are included. In addition, L7 protocol automatic recognition reads within 20 bytes of the first packet of the session and analyzes the type of L7 protocol. For example, if the structure of the first packet at the time of client request is the same as SMTP and FTP (both start with USER), the type of L7 protocol is analyzed by checking the contents of the first packet of the server response data. In addition, necessary data for each L7 protocol includes HTTP header, DNS query result interpretation, SMTP transmission/reception ID recognition, and IMAP transmission/reception error information.

In the data compression step (ST15), after the data extraction step for each session, each information bundle type (session information bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, event information bundle) ) and simultaneously compress the data.

In the information bundle file storage step (ST16), the information generated after the data compression step is stored in a single information bundle file, and one file is created for each buffer to process the data.

The performance analyzer 140 performs a function of diagnosing whether there is a problem in a network or service by analyzing the generated performance index as a separate criterion. Depending on post-analysis conditions, the contents and types that can be processed are different.

When generating performance indicators in the performance analyzer 140, BPS, PPS, latency, and timeout performance indicators may be used as basic performance indicators. In addition, performance indicators of the number of flows created by time and by IP can be used. In addition, as TCP-specific performance indicators (generation trend by time zone in seconds), TCP RST, TCP Zero Windows, TCP DUP ACKS, TCP retransmission, TCP port reuse, and TCP packet reversal performance indicators can be used. In addition, the performance index of the TCP or UDP-based service providing IP list can be used. In addition, the performance index of each IP MAC address (suspicion of MAC spoofing or IP overlapping in case of multiple) can be used. In addition, performance indicators of data usage by port number can be used. In addition, performance indicators of L7 protocol-specific data (analysis by DNS query result (success, error, etc.), HTTP connection status, data transmission volume measurement by SMTP sender/receiver, etc.) can be used.

The performance analyzer 140 may perform analysis for each performance indicator using these performance indicators. Analysis by these performance indicators includes BPS-based analysis, PPS-based analysis, Timeout-based analysis, TCP RST-based analysis, TCP Zero Windows analysis, TCP DUP ACK analysis, TCP retransmission analysis, TCP port reuse analysis, TCP packet out-of-order analysis, HTTP error Status analysis, additional analysis of performance indicators, etc. may be included.

BPS-based analysis analyzes 'traffic surge' if the traffic is 85% or more of the total available bandwidth. If the traffic surge condition lasts for more than 60 seconds, it is analyzed as 'excessive traffic condition continued'. If more than 50% of total traffic is concentrated on a single IP, it is analyzed as 'concentration of traffic to a specific IP'. In order to check the corresponding criteria, ranking data can be additionally created in addition to BPS. This is because BPS does not have classification details for each IP. In addition, if the traffic in use is less than 2% of the total available bandwidth, it can be analyzed as 'suspect network failure'.

In PPS-based analysis, if broadcast packets occupy more than 70% of the total packets, it can be analyzed as 'high bandwidth occupancy due to rapid increase in broadcast packets'. This is because most packets are unicast, and broadcast packets are rarely used. If packets other than IP packets occupy more than 50% of the total packets, it can be analyzed as 'unknown packets occupy a large amount of bandwidth'.

Timeout-based analysis can be analyzed as 'suspicion of unavailability of service due to network interface shutdown or equipment outage' if timeout occurs for more than 20 IPs per second during the period specified by the user. If timeout occurs for more than 10 to less than 20 IPs per second at the same time during the period specified by the user, it can be analyzed as 'suspicion of service interruption due to cable or GBIC (Giga Bitrate Interface Converter) failure'. .

TCP RST-based analysis, if the same server sends RST more than 10 times per second, 'in the case of a request coming in to a destination port that does not exist on the server side or trying to connect to a port that has already been disconnected' can be analyzed. If the same client sends RST more than 5 times per second, it can be analyzed as 'when the application tries to terminate the connection by using Reset instead of FIN'. If the same client/server generates RST 3 to 4 times per second, it can be analyzed as 'when either the server or the client terminates without notifying the termination (application crash or power off, etc. suspected)'.

TCP Zero Windows analysis can be analyzed as 'suspicion of zero window creation due to errors in security devices such as firewalls and IPS or WAN accelerators' if the TCP Zero Window phenomenon occurs more than 10 times per second.

TCP DUP ACK analysis can be analyzed as 'Network Congestion' if DUP ACKs occur more than 60 times per second in a specific IP.

TCP retransmission analysis can be analyzed as 'suspicion of loop occurrence in the duplication section' if TCP retransmission occurs more than 1000 times per second in a specific IP.

TCP port reuse analysis can be analyzed as 'client-side local port exhaustion and server time wait status maintenance suspicion' if TCP port reuse is confirmed more than 3 times per second.

TCP packet out-of-order analysis can be analyzed as 'suspicion of TCP segment loss due to packet loss' if out-of-order occurs more than three times per second.

In the HTTP error status analysis, if the status code is HTTP 4XX and the same phenomenon is found in less than 10 IPs, it can be recognized as a 'user input problem' and analyzed. If the status code is HTTP 5XX or HTTP 4XX and the same phenomenon is found in more than 10 IPs, 'there is a problem in the server or client code' and can be analyzed.

Performance indicator addition analysis is to analyze by adding performance indicators according to the addition of system settings or the addition of users.

As such, the present invention creates and manages a bundle of information to provide a guide for accurately and quickly identifying and solving various and complex network issues (performance, failure, etc.) It enables management, and provides customized network management services tailored to user needs by linking with various systems with information collection and analysis functions.

Although the present invention has been described in more detail by way of examples above, the present invention is not necessarily limited to these examples, and may be variously modified without departing from the spirit of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

Claims

In the information bundle generation management device of an intelligent network management system that performs network management,

The information bundle creation and management device generates and manages information bundles to provide a guide for accurate and quick cause identification and resolution with one click for various and complex network issues, and any network operator can easily and conveniently manage the network. a control unit that controls to provide customized network management services tailored to user needs by linking with various systems through information collection and analysis functions;

Under the control of the control unit, the packet data of the data center is received through the network interface card, the received packet data is bundled into one data stream, and raw data necessary for generating an information bundle is generated, and stored in the raw packet storage buffer. a packet capture unit for storing and collecting packets of the data center;

Under the control of the control unit, metadata for packets collected by the packet capture unit is generated, and the metadata includes packet check time, packet size, session ID, packet size, MAC address, and TCP information, and session information Generate bundle, BPS information bundle, PPS information bundle, RTT information bundle, timeout information bundle, TCP information bundle, Remarks information bundle, and event information bundle, and create information bundles that simultaneously compress and store data for each type of information bundle wealth;

Under the control of the control unit, receive the information bundle generated by the information bundle generator, generate performance indicators required for network management, select the type of information to be used from the information bundle based on the generated performance indicators, and then perform the performance of the network. a performance analyzer for generating a performance index result by analyzing and providing the result to a user;

An information bundle generation management device of an intelligent network management system, characterized in that configured to include.
The method according to claim 1, wherein the packet capture unit,

Each thread simultaneously calculates and checks the size of the accumulated data for each queue, selects a location to store in the buffer for each queue, and replaces the buffer with a new, empty buffer when the size of the data to be stored is larger than the remaining size of the buffer. An information bundle creation management device of an intelligent network management system, characterized in that each thread simultaneously writes data to a single buffer after specifying a location to store in advance.
The method according to claim 1, wherein the information bundle generating unit,

storing session ID, client IP/port, server IP/port, L4 protocol, and L7 protocol information in the session information bundle; Stores session ID, transmission time (in seconds), data size transmitted from client to server per second, and data size transmitted from server to client per second in the BPS information bundle; Stores the session ID, transmission time (in seconds), the number of packets transmitted from the client to the server per second, and the number of packets transmitted from the server to the client per second in the PPS information bundle; storing the session ID, the transmission delay time from the client to the server, and the transmission delay time information from the server to the client in the RTT information bundle; Store overall session information and occurrence time information in the timeout information bundle; Time zone where TCP SYN occurred in the TCP information bundle, session information, TCP SYN, time zone where TCP RST occurred, TCP RST, session information, time zone where TCP DUP ACK occurred, TCP DUP ACK, session information, time zone where TCP packet retransmission occurred, and session stores information such as TCP packet retransmission, occurrence time period, and TCP other problem information, such as the type of problem; HTTP request/response headers, DNS query and response results, SMTP email sender ID, FTP/IMAP/POP3 error content information are stored in the Remarks information bundle; An information bundle generation management device of an intelligent network management system, characterized in that for storing event information that occurs when the event information bundle is above or below a user-defined threshold or above a variable cost.
a packet data receiving step of receiving packet data from a data center at the information bundle creation and management device when the information bundle creation and management device of the intelligent network management system performs information bundle generation;

After the packet data receiving step, the packet capture unit generates raw data necessary for generating an information bundle by bundling the received packet data into one data stream, stores it in a raw packet storage buffer, and collects the packets of the data center; , each thread simultaneously calculates and checks the size of the accumulated data for each queue, selects a location to store in the buffer for each queue, and if the size of the data to be stored is larger than the remaining size of the buffer, the buffer is replaced with a new empty buffer. a packet measuring step in which each thread simultaneously writes data to a single buffer after designating a storage location in advance;

After the packet measurement step, the information bundle generation unit generates metadata for the collected packets, and the metadata includes packet confirmation time, packet size, session ID, packet size, MAC address, and TCP information, session information bundle, An information bundle generation step of generating BPS information bundles, PPS information bundles, RTT information bundles, timeout information bundles, TCP information bundles, Remarks information bundles, and event information bundles, and simultaneously compressing and storing data for each type of information bundle; ;

After the information bundle generation step, the performance analysis unit receives the generated information bundle, generates performance indicators required for network management, selects the type of information to be used from the information bundle based on the generated performance indicators, and analyzes the performance of the network. A performance analysis step of generating a performance index result and providing the result to a user;

Information bundle generation management method of an intelligent network management system, characterized in that performed by including
The method according to claim 4, wherein the information bundle generating step,

a buffer preparation step of preparing a buffer to process data;

After the buffer preparation step, a simultaneous packet processing step of processing multiple packets at the same time through multi-threading by parsing the L2 to L4 headers of each packet in the buffer;

a classification step for each session of classifying packets corresponding to the same session for each session based on the result of the simultaneous packet processing step;

Extract data necessary for generating an information bundle for each session classified in the session-specific classification step, including session basic information, BPS, PPS, TCP DUP ACK / TCP retransmission, L7 protocol automatic recognition, and necessary data for each L7 protocol, L7 protocol automatic recognition reads within 20 bytes of the first packet of the session and analyzes the type of L7 protocol. Data necessary for each L7 protocol includes HTTP header, DNS query result interpretation, SMTP sending/receiving ID recognition, IMAP sending/receiving error information Data extraction step for each session including;

a data compression step of simultaneously compressing data for each information bundle type after the data extraction step for each session;

an information bundle file storage step of storing the information generated after the data compression step in a single information bundle file and generating one file for each buffer to process data;

An information bundle creation management method of an intelligent network management system, characterized in that performed by including.