WO2024038523A1

WO2024038523A1 - Conversion device, conversion method, and conversion program

Info

Publication number: WO2024038523A1
Application number: PCT/JP2022/031106
Authority: WO
Inventors: 勇樹三好; 千晴森岡; 裕平林; 里美井上
Original assignee: 日本電信電話株式会社
Priority date: 2022-08-17
Filing date: 2022-08-17
Publication date: 2024-02-22

Abstract

A conversion device (10) analyzes information concerning an input packet by means of hardware, determines whether or not to perform predetermined pre-processing by means of the hardware, and determines whether a packet to be subjected to the predetermined pre-processing by means of the hardware is a packet having a plurality of header samples contained therein or a packet having a single header sample contained therein. The conversion device (10) reconstructs a packet having a plurality of header samples contained therein into a packet having a single header sample contained therein. On the basis of fixed-length in-header information in the packet having a single header sample contained therein, the conversion device (10) performs, by means of the hardware, processing for attaching, to the packet, metadata including identification information indicating a group of the packet. The conversion device (10) performs, by means of software, processing for generating an analyzing packet corresponding to the group of the packet by using the attached metadata.

Description

Conversion device, conversion method and conversion program

The present invention relates to a conversion device, a conversion method, and a conversion program.

For network monitoring and traffic trend analysis, xFlow technology performs traffic aggregation and analysis by sampling packets and transmitting flow statistical information calculated from header information and the header part itself (header sample). be. There is also a packet encapsulation technique that embeds a packet in the payload of another packet and transfers it over a network.

As a method for analyzing encapsulated packets, there is a format conversion technique that enables extraction and analysis of packets inside the capsule in encapsulated packets and header sample xFlow packets. Furthermore, for encapsulated packets, there is a technique for registering in a database the correspondence between the packet header inside the capsule and the packet header outside the capsule.

Additionally, there is a technology that enables efficient aggregation and analysis of traffic inside the capsule in networks where encapsulated packets are transferred. In networks where encapsulated packets are transferred, technology is being developed that enables protocol groups to be identified based on the packet header information outside/inside the capsule, and to perform different processing and analysis for each attribute of the carrier, etc. Proposed.

In addition, a technology has been proposed in which packet analysis is performed in front-end hardware, and depending on the analysis result, front-end hardware processing, back-end software processing, and filtering based on non-processing targets are performed.

JP2019-097069A JP2021-090161A International Publication No. 2021/149245 Japanese Patent Application Publication No. 2020-174257

For xFlow packets with multiple header samples, in order to enable analysis by an external analyzer, the multiple header samples are split and reassembled into a single header sample, statistics are aggregated, and the analyzer is sent to the analyzer. Need to send.

Conventionally, when an xFlow packet with multiple header samples is received, software processes the division and reconstruction of the multiple header samples.

However, since this processing requires a high calculation cost due to software processing, it has been difficult to process a large amount of traffic information included in multiple header samples at high speed using software.

The present invention has been made in view of the above, and provides a conversion device, a conversion method, and a conversion program that can reduce software processing load, speed up processing, and increase the amount of traffic that can be processed. The purpose is to

In order to solve the above-mentioned problems and achieve the purpose, a conversion device according to the present invention analyzes input packet information using hardware, and determines whether or not to perform predetermined pre-processing using the hardware. and an analysis unit that determines whether a packet to be subjected to predetermined pre-processing by the hardware is a packet equipped with a plurality of header samples or a packet equipped with a single header sample; a reconstruction unit that reconstructs a packet carrying a single header sample into a packet carrying a single header sample; and a packet carrying a single header sample determined by the analysis unit; For packets equipped with a single header sample reconstructed by the reconstruction unit, an identification indicating a group of the packets based on information in a fixed length header of the packet equipped with the single header sample. an attaching unit that performs a process of attaching metadata including information to the packet using the hardware; and a process of generating an analysis packet corresponding to the group of packets using the metadata attached by the attaching unit. The invention is characterized in that it has a generation unit that performs this using software.

According to the present invention, it is possible to reduce the software processing load, increase the speed of processing, and increase the capacity of processable traffic.

FIG. 1 is a block diagram showing an example of the configuration of a communication system according to an embodiment. FIG. 2 is a diagram illustrating the flow of processing in the conversion apparatus shown in FIG. 1. FIG. 3 is a block diagram showing an example of the configuration of the conversion device shown in FIG. 1. FIG. 4 is a diagram illustrating reconstruction processing by the reconstruction unit shown in FIG. 3. FIG. 5 is a diagram illustrating reconstruction processing by the reconstruction unit shown in FIG. 3. FIG. 6 is a diagram illustrating adding metadata to an IPFIX packet. FIG. 7 is a diagram illustrating the flow of processing in the conversion device shown in FIG. 1. FIG. 8 is a diagram illustrating the flow of processing in the conversion device shown in FIG. 1. FIG. 9 is a diagram illustrating the circuit architecture of the reconstruction unit shown in FIG. 3. FIG. 10 is a flowchart illustrating an example of the processing procedure of the conversion process according to the embodiment. FIG. 11 is a diagram illustrating a conventional conversion technique. FIG. 12 is a diagram illustrating an example of a computer that implements a conversion device by executing a program.

Below, embodiments of a conversion device, a conversion method, and a conversion program according to the present application will be described in detail based on the drawings. Further, the present invention is not limited to the embodiments described below.

[Embodiment]
First, an embodiment will be described. The conversion device 10 according to the present embodiment offloads some processing to the preceding hardware and analyzes packets using the hardware. The conversion device 10 determines whether to perform hardware processing or subsequent software processing.

When determining that hardware processing is to be performed, the conversion device 10 further identifies the header information by protocol analysis, and converts the packet to either a packet with multiple header samples (multi-header sample packet) or a single header sample. packet (single header sample packet). For multiple header sample packets, the conversion device 10 uses upstream hardware to divide the multiple header samples and reconstruct them into a single header sample packet.

Then, the conversion device 10 writes metadata including grouping information to the end of the packet as a result of the analysis performed on the packet by the preceding hardware. Then, the conversion device 10 identifies the metadata in the subsequent software, and performs coordination between hardware and software by replacing the protocol analysis and grouping processing.

As a result, in the conversion device 10, by offloading some processing to the hardware, it is possible to reduce the amount of processing on the software side and perform flexible processing that differs depending on the attributes of the operator etc. at high speed. do. Furthermore, in the conversion device 10, by using hardware to process the division and reassembly of packets equipped with multiple header samples, it is possible to reduce the software processing load, which requires high calculation costs, and to process large volumes of traffic information at high speed. It becomes possible to do so.

[Communication system configuration]
FIG. 1 is a block diagram showing an example of the configuration of a communication system according to an embodiment. As shown in FIG. 1, the communication system 1 according to the embodiment includes a plurality of NW devices 2, a conversion device 10, and a plurality of analysis devices 3 (external devices). For example, the plurality of NW devices 2 and the conversion device 10 communicate via the network N. Note that the configuration shown in FIG. 1 is only an example, and the specific configuration and number of each device are not particularly limited.

The NW device 2 samples packets in the traffic to be monitored. For example, the NW device 2 may transfer the mirrored encapsulated packet to the conversion device 10, or may cut out the sampled packet header sample and transfer the xFlow packet in which the cut header sample is encapsulated to the conversion device 10. It's okay. At this time, the NW device 2 may include statistical information regarding the flow, such as the number of packets, in the xFlow packet to be transferred, or may transfer it to the conversion device 10 as a separate xFlow packet.

The conversion device 10 converts xFlow packets input from various NW devices 2 into xFlow packets in a format according to the processing content of the external analysis device 3. Specifically, the conversion device 10 identifies header information through protocol analysis, divides and reconstructs multiple header sample packets into single header sample packets, and then performs grouping based on conditions. Then, the conversion device 10 performs processing defined for each group and transmits the generated packets to the analysis device 3. For example, as a process defined for each group, the conversion device 10 aggregates statistics of inner headers of xFlow packets input from various NW devices 2, and converts xFlow packets that include at least statistical information indicating statistics of the determined inner headers. is generated and sent to the external analysis device 3.

Each analysis device 3 analyzes the traffic to be monitored and aggregates packets in the traffic to be monitored. For example, the analysis device 3 performs analysis and aggregation using statistical information included in the xFlow packet converted by the conversion device 10.

The conversion device 10 performs flexible format conversion processing based on packet header information. Here, the flow of format conversion processing in the conversion device will be explained using FIG. 2. FIG. 2 is a diagram illustrating the flow of processing in the conversion apparatus shown in FIG. 1. In addition, in the explanation here, explanations such as processing in which the conversion device 10 offloads some processing to hardware are omitted, and it is not stated whether the processing is performed by hardware or software. The overall flow of processing will be explained. Furthermore, processing for offloading some processing to hardware will be described later.

As illustrated in FIG. 2, upon receiving an input of an encapsulated packet mirrored by the NW device 2 or an xFlow packet including a header sample, the conversion device 10 identifies the header information by protocol analysis (see FIG. 2). (See (1)).

Then, among the input packets, the conversion device 10 reconstructs the multiple header sample packets into single header sample packets (see (2) in FIG. 2), and then performs grouping based on conditions (see (2) in FIG. 2). (See 2 (3)). The example in FIG. 2 illustrates a case where the conversion device 10 classifies a packet into one of a plurality of groups "groups #1 to #3" based on conditions regarding both the outer header and the inner header. are doing.

Next, the conversion device 10 performs information shaping processing defined for each group (see (4) in FIG. 2). For example, in the example shown in FIG. 2, the conversion device 10 obtains inner header statistics for packets classified into group "#1" and generates an xFlow packet that includes at least statistical information indicating the inner header statistics. Then, the conversion device 10 transmits the generated xFlow packet to the xFlow analysis device 3A (also described as the destination “analysis A” in FIG. 2) as the destination.

Furthermore, for example, the conversion device 10 obtains statistics of the outer header for packets classified into group "#2" and generates an xFlow packet that includes at least statistical information indicating the statistics of the outer header. Then, the conversion device 10 transmits the generated xFlow packet to the xFlow analysis device 3B (also described as the destination “analysis B” in FIG. 2) as the destination.

Furthermore, for example, the conversion device 10 performs a process of removing the capsule header from the packets classified into the group “#3” and generating (formatting) the packets with the transmission destination rewritten to the external analysis device 3C. Then, the conversion device 10 transmits the generated packet to the packet capture device 3C (also described as the destination “capture C” in FIG. 2) as the destination. Note that the conversion device 10 may generate and transmit packets at any timing for each of the above-described processes.

For example, when performing statistical processing such as processing corresponding to groups "#1" and "#2", the conversion device 10 performs statistical processing when the number of grouped packets reaches a predetermined number, Generate and send a packet. Further, for example, when the conversion device 10 removes the capsule header and rewrites the transmission destination to the external analysis device 3 as in the process corresponding to the group “#3”, the conversion device 10 is grouped into the group “#3”. Each time, a packet is generated and sent.

In other words, the conversion device 10 groups input packets and performs different processing for each group, such as deleting the outer packet header of the capsule, statistical processing, and changing the destination IP address. This makes it possible to flexibly perform individual processing and analysis.

Furthermore, in the conversion device 10, by offloading some processing to hardware, the amount of processing on the software side is reduced, and it is possible to perform flexible processing that differs depending on the attributes of the business operator, etc. at high speed. . Furthermore, in the conversion device 10, hardware processes the division and reassembly of a plurality of header samples for packets equipped with a plurality of header samples, thereby reducing the software processing load that requires large calculation costs, and reducing the burden on large-volume traffic. It becomes possible to process information at high speed.

[Configuration of conversion device]
Next, the configuration of the conversion device 10 will be explained. FIG. 3 is a block diagram showing an example of the configuration of the conversion device 10 shown in FIG. 1.

As shown in FIG. 3, the conversion device 10 includes a packet analysis section 11, a reconstruction section 12, a metadata adding section 13, a generation section 14, and a rule information DB 15. Note that the conversion device 10 is configured such that a predetermined program is loaded into a computer, etc., including, for example, ROM (Read Only Memory), RAM (Random Access Memory), CPU (Central Processing Unit), etc., and the CPU executes the predetermined program. This is achieved by doing. Furthermore, the conversion device 10 has a communication interface that transmits and receives various information to and from other devices connected via a network or the like. For example, the conversion device 10 includes a NIC (Network Interface Card) and the like, and performs communication with other devices via a telecommunication line such as a LAN (Local Area Network) or the Internet.

The rule information DB 15 is a preset rule, and stores a rule for determining whether to offload some processing to the preceding hardware. For example, the rule information DB 15 determines which packets are to be subjected to predetermined pre-processing by hardware (packets to be hardware offloaded), depending on the information in one or both of the outer header and inner header of the input packet. , a determination rule for determining whether a packet is to be processed by software without performing predetermined pre-processing by hardware (a packet other than hardware offload) is stored. The rule information DB 15 stores a determination rule for determining whether a packet to be subjected to hardware processing is a multiple header sample packet or a single header sample packet.

Additionally, the rule information DB 15 stores rules for specifying a hardware processing portion and a software processing portion in a packet. For example, the rule information DB 15 stores rules for specifying a hardware processing portion and a software processing portion for each type of packet.

Additionally, the rule information DB 15 stores grouping conditions, which are conditions for grouping input packets. Further, for example, the rule information DB 15 stores, as a grouping condition, a condition regarding information included in one or both of the outer header and the inner header.

Additionally, the rule information DB 15 stores processes defined for each group. That is, the rule information DB 15 stores the details of the processing to be performed for each group for each grouped packet. For example, the rule information DB 15 stores processing details and destinations of generated analysis packets in association with group IDs. Note that the information stored in the rule information DB 15 described above is set in advance by the operator, and can be changed, added, or deleted as appropriate.

The packet analysis unit 11 analyzes the input packet information using hardware, and determines whether or not to perform predetermined pre-processing using the hardware. For example, upon receiving an input of an encapsulated packet (RAW packet) or an xFlow packet including a header sample that is the header portion itself, the packet analysis unit 11 performs protocol analysis on the encapsulated packet or xFlow packet using hardware.

Then, for example, the packet analysis unit 11 determines whether or not to perform predetermined pre-processing by hardware, and also determines whether or not to perform predetermined pre-processing using hardware, and also determines whether or not to perform predetermined pre-processing using hardware. Determine if there is. In other words, the packet analysis unit 11 refers to the determination rules stored in the rule information DB 15 and determines whether the input packet is a hardware offload target packet and a multi-header sample packet, or a hardware offload target packet. to determine whether it is a single header sample packet or a packet other than hardware offload.

As a result, for example, if the packet analysis unit 11 determines that the packet is a non-hardware offload packet, it causes the generation unit 14 (software) to perform the following processing.

For example, when the packet analysis unit 11 determines that the packet is a hardware offload target packet and is a multi-header sample packet, the packet analysis unit 11 refers to the information stored in the rule information DB 15, and the reconstruction unit 12 (hardware) performs the following processing.

For example, if the packet analysis unit 11 determines that the packet is a hardware offload target packet and is a single header sample packet, the packet analysis unit 11 refers to the information stored in the rule information DB 15 and determines the hardware processing portion of the packet. The software processing part is specified, and the metadata adding unit 13 (hardware) is made to perform the following processing.

Here, for example, when the packet analysis unit 11 receives an input of an L2TP packet that is an encapsulated packet, it includes the "first Ether header", "first IPv4/IPv6 header" and "UDP (User Datagram Protocol)". The "header" is specified as the hardware processing part, and the "second IPv4/IPv6 header" is specified as the software processing part. For example, the information in the fixed-length header outside the capsule is easily determined even if it is processed in hardware, so it is processed in hardware. Further, for example, the information in the variable length header and the capsule inner header needs to be read in bit units and is a hardware processing part.

For example, when the packet analysis unit 11 receives an input of an IPFIX packet that is an xFlow packet including a header sample, the packet analysis unit 11 inputs the "IPFIX Ether header", the "IPFIX IPv4/IPv6 header", and the L2TP header in the IPFIX set. The "first Ether header," "first IPv4/IPv6 header," and "UDP header" in sampling are identified as the hardware processing part, and the "second IPv4/IPv6 header" in L2TP header sampling is identified as the software processing part. do.

The reconstruction unit 12 reconstructs the multiple header sample packet into a single header sample packet. The reconstruction unit 12 divides the multiple header sample packet into a header part and each data part. Then, the reconstruction unit 12 reconstructs it into a single header sample packet according to the number of data. The reconstruction unit 12 outputs each reconstructed single header sample packet to the metadata adding unit 13.

4 and 5 are diagrams illustrating the reconstruction process by the reconstruction unit 12 shown in FIG. 3. 4 and 5, the reconstruction process of an IPFIX packet having two samples will be described.

As shown in FIG. 4, the reconstruction unit 12 obtains the data length of the entire IPFIX multisample and the data length of each sample from FlowSet Length and string_len_short stored in the IPFIX header, and Divide into parts. In the example of FIG. 4, the data is divided into an L2/L3 header section, an IPFIX header section, sample data S1, and sample data S2.

Then, as shown in FIG. 5, the reconstruction unit 12 reconstructs the IPFIX packet of the single header sample according to the number of samples. The reconstruction unit 12 reconstructs a single header sample IPFIX packet including the sample data S1 based on the L2/L3 header section, the IPFIX header section, and the sample data S1. Then, the reconstruction unit 12 reconstructs a single header sample IPFIX packet including the sample data S2 based on the L2/L3 header section, the IPFIX header section, and the sample data S2.

The metadata adding unit 13 inputs metadata including identification information indicating a group of input packets based on the fixed length header information in the single header sample packet input by the packet analysis unit 11 or the reconstruction unit 12. The processing to add to the packet is performed by hardware.

For example, the metadata adding unit 13 refers to the rules stored in the rule information DB 15, obtains information in the header identified by the packet analysis unit 11 as a hardware processing part, and performs grouping based on the information in the header. The processing for determining the grouping ID and adding metadata including the grouping ID to the packet is performed by hardware. Further, for example, the metadata adding unit 13 performs information shaping processing to change the source IP address of the packet to the IP address of the conversion device 10 and change the destination IP address to the IP address of the analysis device 3.

Thereafter, the metadata adding unit 13 adds metadata that follows the rules based on the information in the header identified as the hardware processing part. For example, the metadata includes protocol analysis results such as the protocol type and header length of each header, and grouping primary identification results.

FIG. 6 is a diagram illustrating adding metadata to IPFIX packets. As illustrated in FIG. 6, for example, the metadata adding unit 13 creates metadata (Meta1, Meta2) corresponding to each sample and adds it to the IPFIX packet.

For example, the metadata adding unit 13 adds metadata including "number of VLANs", "number of MPLS labels", "various header positions", and "xFlow packet type" to the IPFIX packet. The metadata adding unit 13 inserts 0 to 3 bytes of padding between the reconfigured IPFIX packet and the metadata, aligns it to 4 bytes, and adds the metadata. The metadata adding unit 13 performs padding according to the packet length after reconfiguration.

For example, the metadata adding unit 13 may also add, for the L2TP packet, "VLAN number," "MPLS label number," "IP header position," "grouping ID based on the rule table," "transmission source before information shaping." IP address and destination IP address.

The generation unit 14 performs a process of generating analysis packets corresponding to a group of packets using the metadata added by the metadata addition unit 13 when predetermined pre-processing by hardware is performed. This is done by software. For example, the generation unit 14 acquires a grouping ID included in the metadata assigned by the metadata assignment unit 13, and refers to the rule information DB 15 to determine a process corresponding to the grouping ID.

In addition, if predetermined pre-processing by hardware is not performed, the generation unit 14 performs packet protocol analysis processing and grouping processing by software, and then performs processing corresponding to the group to generate packets. Perform the process to generate. Thereafter, the generation unit 14 transmits the generated packet to the analysis device 3.

For example, the generation unit 14 may perform a process of generating an analysis packet corresponding to a group by aggregating the statistics of the inner header and generating an xFlow packet that includes at least statistical information indicating the statistics of the inner header; A process of aggregating statistics and generating an xFlow packet that includes at least statistical information indicating the statistics of the outer header, and a process of generating (shaping) a packet with the outer header removed and the destination rewritten to the external analysis device 3. Execute one or more of the following processes. Note that the process of generating a packet by the generation unit 14 includes a process of generating a new packet for analysis, and a process of rewriting or deleting the information of the input packet to format it into a packet for analysis. shall include.

Here, the flow of processing in the conversion device 10 will be explained using FIGS. 7 and 8. 7 and 8 are diagrams illustrating the flow of processing in the conversion device 10 shown in FIG. 1. In the example of FIG. 8, a case will be described in which, as a process of generating a packet for analysis, statistics of the inner header are totaled and an xFlow packet including statistical information indicating the statistics of the inner header is generated.

As illustrated in FIG. 7, when the hardware of the conversion device 10 receives a packet input, the input packet is either a non-hardware offload packet or a single header sample packet of a hardware offload target packet. It is determined whether there is a sample packet with multiple headers of the packet to be hardware offloaded (for example, xFlow). In other words, the conversion device 10 analyzes the packet using the front-end hardware, and depending on the analysis result, it determines whether the packet is a multiple-header sample packet to be processed by the front-end hardware (high-speed processing), or whether it is a single-header sample packet to be processed by the front-end hardware. Analyze whether the packet is a sample packet or a packet to be subjected to subsequent software processing (low-speed processing).

For example, if the conversion device 10 performs subsequent software processing without performing preceding hardware processing, the conversion device 10 performs packet protocol analysis processing and grouping processing using software as internal software processing, and then performs group processing. As a process, statistics of the inner header are totaled, and an xFlow packet including at least statistical information indicating the statistics of the inner header is generated.

At this time, the hardware at the front stage of the conversion device 10 determines whether the input packet is a packet equipped with a plurality of header samples based on the variable in the xFlow IP header of the input packet (( 1)).

If the front-end hardware determines that the packet has multiple header samples, it divides the multiple header samples, reconstructs the packet, and collaborates with other existing functional units. For example, as shown in FIG. 8, the front-end hardware divides and restores a packet carrying three header samples to reconstruct it into three single header sample packets. In this way, by adding the function of reassembling a single header sample packet to the front-end hardware, there is no need to change the rear-end hardware (HW) processing and software (SW) processing (see Figure 8). (2)).

Then, the conversion device 10 performs in-hardware processing on the single header sample packet that is the input packet or the reconstructed single header sample packet, and performs grouping based on the information in the header. After performing information shaping processing (chaining destination selection, etc.) to change the IP address and destination IP address, metadata that conforms to the rules is added based on the information in the header identified as the hardware processing part.

Subsequently, the conversion device 10 identifies the metadata added in the hardware processing as the software processing, and determines the processing content using the grouping ID included in the metadata. Then, the conversion device 10 performs a process within the software to analyze the inner header, aggregate the statistics of the inner header, and generate an xFlow packet that includes at least statistical information indicating the statistics of the inner header.

In this way, the conversion device 10 divides the multiple header samples and reconstructs them into a single header sample packet based on the analysis result performed by the previous stage hardware, and then converts the grouping information into a single header sample packet. Writes the included metadata to the end of the packet.

In the conversion device 10, the metadata identification process replaces the computationally expensive protocol analysis and grouping process in the subsequent software, allowing hardware and software to cooperate. The conversion device 10 realizes the protocol analysis processing and grouping processing using software through the metadata adding processing using hardware and the metadata reading processing using software, thereby making it possible to omit software protocol analysis with high calculation costs. can. Therefore, by offloading some processing to hardware, it is possible to reduce the amount of processing on the software side.

In the conversion device 10, the front-stage hardware performs processing that the hardware is good at, such as uniformity processing, and the rear-stage software performs flexible judgments and complex processing, such as processing based on internal information of encapsulated packets. This makes it possible to process even large-volume traffic at high speed while reducing the amount of processing on the software side. Furthermore, in the conversion device 10, by using hardware to process the division and reassembly of packets equipped with multiple header samples, it is possible to reduce the software processing load, which requires high calculation costs, and to process large volumes of traffic information at high speed. It becomes possible to do so.

[Circuit architecture]
FIG. 9 is a diagram illustrating the circuit architecture of the reconstruction unit 12 shown in FIG. 3. As shown in FIG. 9, the circuit architecture of the reconstruction unit 12 includes a write address calculation/data distribution unit, a plurality of block RAMs, and a data selection/shaping unit. As the Block RAM, a Block RAM corresponding to the MAC to IPFIX header section, a Block RAM corresponding to sample data, and a Block RAM corresponding to each metadata are provided. The header section, sample data, and metadata are stored in corresponding block RAMs. The front-end hardware reconstructs an IPFIX packet of a single header sample according to the number of samples at the time of output.

Various types of information of the input multiple header sample packets are written to the corresponding Block RAM by the write address calculation/data distribution section, and the Block RAM records the memory address information ((1) in FIG. 9). .

The write address calculation/data distribution unit sends various information and data addresses for the number of samples to the data selection/formation unit ((2) in FIG. 9). The write address calculation/data distribution unit transmits the address information and the number of multi-samples to the data selection/formation unit via a FIFO (First-In First Out). The data selection/shaping unit reconstructs a single header sample packet by reading data for the number of samples from each Block RAM according to the received address information and the number of multi-samples ((3) in FIG. 9). In the circuit architecture of FIG. 9, by exchanging address information instead of data itself, data transmission between circuits can be performed economically ((4) in FIG. 9).

By employing the circuit architecture of FIG. 9, the reconstruction unit 12 divides a multi-header sample packet and reconstructs it into a single header sample packet. As a result, the reconstruction unit 12 can process the division of a multi-header sample packet into multiple header samples and the reassembly into a single header sample packet using hardware, thereby processing large amounts of traffic information at high speed. becomes possible.

[Conversion processing procedure]
Next, the processing procedure of the packet conversion process executed by the conversion device 10 will be described. FIG. 10 is a flowchart illustrating an example of the processing procedure of the conversion process according to the embodiment.

As shown in FIG. 10, when the packet analysis unit 11 of the conversion device 10 receives a packet input (step S101: Yes), it analyzes the information of the input packet using hardware, and performs pre-processing using the hardware. It is determined whether to do so (step S102).

As a result, if the packet analysis unit 11 determines that the information of the input packet is to be analyzed by hardware (step S102: Yes), it determines whether the input packet is a multi-header sample packet. (Step S103).

If the packet is a multi-header sample packet (step S103: Yes), the reconstruction unit 12 performs packet reconstruction in which the plural header samples of the multi-header sample packet are divided and reconstructed into a single header sample packet (step S104). ).

If it is determined that the packet is not a multi-header sample packet (step S103: No), or after the packet analysis unit 11 reconstructs the packet, the metadata adding unit 13 adds information based on the fixed-length header information of the single-header sample packet. Then, metadata is added (step S105). Next, the generation unit 14 uses software to identify the metadata (step S106), and uses software to generate an analysis packet according to the grouping ID included in the metadata (step S109).

Further, in step S102, if the packet analysis unit 11 determines that the input packet information is not to be analyzed by hardware (step S102: No), the generation unit 14 performs protocol processing by software (step S107), grouping processing is performed by software (step S108). Next, the generation unit 14 generates an analysis packet using software according to the grouping result (step S109).

[Effects of embodiment]
FIG. 11 is a diagram illustrating a conventional conversion technique. As shown in FIG. 11, in the conventional conversion technology, when a multi-header sample packet is received, the format is converted by performing software processing as a packet that is not subject to hardware offload. As described above, in the conventional conversion technology, multi-header sample packets are not subject to hardware offloading, resulting in software processing with high calculation costs, resulting in an increase in calculation costs. For this reason, with conventional conversion techniques, it has been difficult to process large amounts of traffic information contained in a multi-header sample packet at high speed using software.

In contrast, the conversion device 10 according to the embodiment analyzes the information of the input packet using hardware, determines whether or not to perform predetermined pre-processing by the hardware, and determines whether or not to perform predetermined pre-processing on the packets that are to be processed by the hardware. It is determined whether the packet is a multiple header sample packet or a single header sample packet. If the conversion device 10 determines to perform the pre-processing and determines that the packet is a multi-header sample packet, the converter 10 uses hardware to divide the multiple header samples of the multi-header sample packet and re-create it into a single header sample packet. To construct.

A single header sample packet that has been determined to undergo pre-processing or a single header sample packet after reassembly is processed by hardware with identification information indicating a group of packets based on the information in the fixed length header of the packet. The process of adding the included metadata to the packet is performed by hardware. Then, the conversion device 10 uses software to generate a packet for analysis corresponding to the group of packets using the attached metadata. Therefore, the conversion device 10 can perform flexible processing that differs depending on the attributes of business operators and the like at high speed.

In other words, the conversion device 10 writes metadata including the analysis results performed by the preceding hardware and grouping information to the end of the packet. In the conversion device 10, the metadata identification process replaces the protocol analysis and grouping process in the subsequent software, so that the hardware and software can cooperate.

Furthermore, when the conversion device 10 receives a packet equipped with a plurality of header samples, by processing the division and reconstruction of the plurality of header samples using hardware, it is possible to reduce the software processing load that requires a large calculation cost.

In this way, in the conversion device 10, by reducing the amount of processing on the software side, it becomes possible to process a large amount of traffic information at high speed.

[About the system configuration of the embodiment]
Each component of the conversion device 10 shown in FIG. 1 is functionally conceptual, and does not necessarily need to be physically configured as shown. In other words, the specific form of distributing and integrating the functions of the conversion device 10 is not limited to what is shown in the diagram, and all or part of it can be functionally or physically distributed in arbitrary units depending on various loads and usage conditions. It can be configured to be distributed or integrated.

Furthermore, all or any part of each process performed in the conversion device 10 may be realized by a CPU and a program that is analyzed and executed by the CPU. Moreover, each process performed in the conversion device 10 may be realized as hardware using wired logic.

Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can also be performed manually. Alternatively, all or part of the processes described as being performed manually can also be performed automatically using known methods. In addition, the information including the processing procedures, control procedures, specific names, and various data and parameters described above and illustrated can be changed as appropriate, unless otherwise specified.

[program]
FIG. 12 is a diagram showing an example of a computer that implements the conversion device 10 by executing a program. Computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These parts are connected by a bus 1080.

The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090. Disk drive interface 1040 is connected to disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into disk drive 1100. Serial port interface 1050 is connected to, for example, mouse 1110 and keyboard 1120. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the conversion device 10 is implemented as a program module 1093 in which code executable by the computer 1000 is written. Program module 1093 is stored in hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration of the conversion device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Further, the setting data used in the processing of the embodiment described above is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary and executes them.

Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program module 1093 and program data 1094 may then be read by CPU 1020 from another computer via network interface 1070.

Although the embodiments applying the invention made by the present inventor have been described above, the present invention is not limited by the description and drawings that form part of the disclosure of the present invention according to the present embodiments. That is, all other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of the present invention.

1 Communication system 2 NW device 3 Analysis device 10 Conversion device 11 Packet analysis section 12 Reconstruction section 13 Metadata addition section 14 Generation section 15 Rule information DB

Claims

The information of the input packet is analyzed by hardware, and it is determined whether or not to perform predetermined pre-processing by the hardware, and the packets that undergo predetermined pre-processing by the hardware are equipped with multiple header samples. an analysis unit that determines whether the packet is a packet with a single header sample or a packet with a single header sample;
a reconstruction unit that reconstructs the packet carrying the plurality of header samples into a packet carrying a single header sample;
Regarding a packet equipped with a single header sample determined by the analysis section or a packet equipped with a single header sample reconstructed by the reconstruction section, the single header sample is mounted. an attaching unit that uses the hardware to perform a process of attaching metadata including identification information indicating a group of the packets to the packets based on fixed-length header information in the packets;
a generation unit that uses software to generate a packet for analysis corresponding to the group of packets using the metadata assigned by the assignment unit;
A conversion device characterized by having:
The reconstruction unit divides the packet carrying the plurality of header samples into a header part and each data part, and reconstructs the packet into a packet carrying the single header sample according to the number of data parts. The conversion device according to claim 1, characterized in that:
The analysis unit identifies a hardware processing part and a software processing part in the packet,
The assigning unit acquires the information in the header identified as a hardware processing part by the analyzing unit, performs grouping based on the information in the header to determine the identification information, and metadata including the identification information. 2. The conversion device according to claim 1, wherein the processing to be added to the packet is performed by the hardware.
A conversion method performed by a conversion device, the conversion method comprising:
The information of the input packet is analyzed by hardware, and it is determined whether or not to perform predetermined pre-processing by the hardware, and the packets that undergo predetermined pre-processing by the hardware are equipped with multiple header samples. an analysis step of determining whether the packet is a packet with a single header sample or a packet with a single header sample;
a reconstruction step of reconstructing the packet carrying the plurality of header samples into a packet carrying a single header sample;
Regarding a packet equipped with a single header sample determined in the analysis step or a packet equipped with a single header sample reconstructed in the reconstruction step, the single header sample is mounted. an attaching step of performing a process of attaching metadata including identification information indicating a group of the packets to the packets based on fixed-length header information in the packets, using the hardware;
a generation step of using software to generate a packet for analysis corresponding to the group of packets using the metadata added in the adding step;
A conversion method characterized by having the following.
The information of the input packet is analyzed by hardware, and it is determined whether or not to perform predetermined pre-processing by the hardware, and the packets that undergo predetermined pre-processing by the hardware are equipped with multiple header samples. an analysis step of determining whether the packet is a packet with a single header sample or a packet with a single header sample;
a reconstruction step of reconstructing the packet carrying the plurality of header samples into a packet carrying a single header sample;
Regarding the packet carrying the single header sample determined in the analysis step or the packet carrying the single header sample reconstructed in the reconstructing step, the single header sample is carried. a step of adding, by the hardware, metadata including identification information indicating the group of the packets to the packets based on fixed-length header information in the packets;
a generation step in which software performs a process of generating analysis packets corresponding to the group of packets using the metadata added in the attachment step;
A conversion program that allows a computer to execute