JP2008193628A - Traffic information distribution and collection method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To more efficiently distribute traffic by enabling a packet length to be extracted or a distribution method to be changed in accordance with a class. <P>SOLUTION: An NW device 302 includes a sorting means 402, a class-by-class processing means 403, and a traffic information distribution data creation and distribution means 404. The sorting means 402 sorts received packets into respective classes. On the basis of a traffic information distribution technique determined for each class, the class-by-class processing means 403 selects any distribution technique of a packet extraction technique for extracting a part of packets or a flow aggregation technique for aggregating a flow. The traffic information distribution data creation and distribution means 404 creates a traffic information distribution protocol packet 450 constituted of traffic information by the distribution technique selected by the class-by-class processing means 403, and distributes the created packet to a traffic information collection device. Further, the class-by-class processing means 403 also checks a sampling or distribution amount limit for each class. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a method for efficiently monitoring traffic on a large-capacity network when monitoring traffic flowing on a network represented by the Internet, and more particularly to a method for distributing and collecting traffic information.

  In a large-scale and large-capacity network, it is not possible to monitor all the enormous traffic. Therefore, a method of estimating the total traffic amount by sampling the packet is adopted. In this case, it is necessary to reduce the sampling rate as the traffic volume increases. However, it is possible that abnormal traffic with a small traffic volume may not be detected, and an efficient traffic monitoring method. Is needed.

  The conventional flow statistics distribution protocols (sFlow (see Non-Patent Document 2), NetFlow (see Non-Patent Document 1)) sample all packets received on the IF (Interface) of an NW device (Network device). Has been done. The IPFIX protocol (see Non-Patent Document 3), which is one of the flow statistics distribution protocols, enables more flexible traffic measurement by combining filter conditions and sampling. However, the information distribution method is uniformly the same method. Applies. For this reason, if it is necessary to distribute more detailed traffic information according to the analysis of an application, more detailed traffic information must be distributed for other traffic, which increases the total information transfer amount. is there.

  Under such circumstances, as a method of extracting traffic more flexibly, it is possible to extract traffic that is temporarily detected as abnormal and prevent it from being buried in a large volume of traffic, based on flow conditions. Has been devised to flexibly implement flow statistics (see Patent Document 1).

  However, although a plan to filter a specific packet before sampling or a method of classifying a packet before sampling has been devised, a function that allows setting a traffic distribution method for each classified class, Currently does not exist. In addition, the problem that traffic information of other classes is not distributed due to the concentration of traffic in a specific class when classified is not solved.

Japanese Patent Application Laid-Open No. 2006-164038, “Method of DoS Attack or DDoS Attack, Network Device, and Analyzing Device”, Nippon Telegraph and Telephone Corporation RFC3954, “Cisco Systems NetFlow Services Export Version9”, October 2004 RFC3176, “InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks”, September 2001 draft-ietf-ipfix-Protocol-24.txt, “Specification of the IPFIX Protocol for the Exchange of IP Traffic Flow Information”, November 2006

  For the purpose of detecting abnormal traffic such as DDoS attack traffic, attention has been focused on flow statistics distribution protocols (sFlow, netFlow, IPFIX) for monitoring traffic flowing on the network. However, the amount of traffic flowing on the network is increasing year by year, and it is difficult to grasp the trend of complicated traffic only by increasing the sampling interval in the traffic monitoring method.

  In recent years, by using a filter function (access list function) implemented by NW devices, by selecting traffic and performing sampling, it is possible to narrow down only to packets that are desired to be extracted from a large volume of traffic and increase the sampling rate. Has proposed a function of monitoring by focusing on a specific packet (Patent Document 1, Non-Patent Document 3). This function has been shown to set the sampling rate for each class classified by filtering, but unauthorized traffic represented by botnets etc. has become more sophisticated, increasing the sampling rate and volume It is difficult to detect anomalies on the base.

  In recent years, there is a problem that illegal traffic cannot be detected unless analysis is performed up to the application (payload) part of the packet. As traffic increases year by year, it is important to maintain the scalability of the traffic extraction method. The issue is how to extract application information for traffic.

  At present, packet filtering processing, sampling processing, packet copying, flow aggregation information counter processing, and the like are implemented in hardware, and are therefore faster. However, the packet creation process of the traffic information distribution protocol is often executed on the software of the main CPU of the NW device (router, switch, etc.) and often becomes a bottleneck of the distribution process. FIG. 1 shows the load status of the router when the cut-out size of the packet information to be distributed is 256 bytes (see Δ in FIG. 1) and 64 bytes (see ◆ in FIG. 1). The horizontal axis is distribution traffic information (Kpps), and the vertical axis is CPU usage rate%. The smaller the amount of distribution, the less the burden on the router.

  In the conventional technique, when the cut packet length to be distributed for analysis of the payload portion of a packet is increased, in the analysis, packets that do not require that information are also distributed with the same packet length. Efficiency. For this reason, by making it possible to change the packet length and the distribution method to be extracted according to the class, more efficient traffic distribution is possible.

  In addition, since the traffic volume is usually small, there are cases where the traffic volume suddenly increases even when the sampling of the class is increased. In that case, there is a problem that the CPU of the NW device becomes in a load state and traffic of other classes cannot be distributed, and other functions of the NW device are affected. This function avoids these problems by defining the maximum amount of traffic data to be distributed for each class.

  In addition, since the packet size effective for analysis varies depending on each application (an example of the effective packet size for each application is shown in FIG. 2), it is beneficial that the distribution method can be changed for each class.

  Of the inventions disclosed in this specification, the outline of typical ones will be briefly described as follows.

  A first invention is a traffic information distribution method in a traffic information distribution device that distributes traffic information to a traffic information collection device, wherein the traffic information distribution device includes classification means, class-specific processing means, traffic information distribution data creation and distribution And the classification means classifies the received packet into each class, and the class-specific processing means performs traffic determined for each class with respect to the packet classified into each class by the classification means. Based on the information distribution method, either a packet extraction method for extracting a part of the packet or a flow aggregation method for aggregating the flow is selected, and the traffic information distribution data creation / distribution means performs the class-specific processing Trough composed of each traffic information by the delivery method selected by the means Tsu create a click information distribution packet is traffic information distribution method for distributing the traffic information distribution packet to the traffic information collection device.

  2nd invention is the traffic information delivery method of 1st invention, Comprising: The delivery limit amount set to each class with respect to the packet classified into each class by the said classification | category process means by the said classification | category means If the limit amount is exceeded, the traffic information distribution method stops distribution of the traffic information and starts distribution of the traffic information when the limit amount is exceeded.

  3rd invention is the 1st or 2nd traffic information delivery method, Comprising: The sampling rate defined in each class with respect to the packet classified into each class by the said classifying means by the said classifying means And / or a traffic information distribution method for performing packet sampling based on a sampling algorithm.

  4th invention is the traffic information delivery method of 1st-3rd invention, Comprising: The said traffic information delivery apparatus has a filter condition setting table, The said filter condition setting table is the information regarding the header of a packet. A destination address, source address, protocol, destination port number, source port number, TCP flag, TOS, destination MAC address, source MAC address, label, IP version, packet length, and NW device route the packet Filter condition identifier and class identifier corresponding to one or more of reception IF information, transmission destination IF information, Next-Hop address, BGP Next-Hop address, Peering AS number, Origin AS number, and BGP Community, which are characteristic information for But In the traffic information distribution method, the classification unit classifies the received packet into each class based on the filter condition setting table.

  5th invention is the traffic information delivery method of 4th invention, Comprising: The said traffic information delivery apparatus has a traffic measurement information table, and the said traffic measurement information table respond | corresponds to the said class identifier, traffic delivery A traffic information distribution method in which one or more of a method, a sampling rate, a sampling algorithm, and a distribution amount limit are set, and the processing unit by class performs processing by class based on the traffic measurement information table It is.

  6th invention is the traffic information delivery method of 5th invention, Comprising: The said traffic information delivery data preparation delivery means adds the said filter condition identifier and / or the said class identifier to each traffic information of the said traffic information delivery packet. Is a traffic information distribution method to which is added.

  A seventh invention is a traffic information collecting method in a traffic information collecting device that collects traffic information from the traffic information distributing device that distributes traffic information by the traffic information distributing method of the sixth invention, wherein the traffic information Based on the class identifier and / or filter condition identifier added to each traffic information collected by the traffic information distribution device, the collection device sends traffic information to an appropriate traffic analysis device from the group of traffic analysis devices. Is a traffic information collection method.

  According to the present invention, the packet length to be extracted and the distribution method can be changed according to the class, thereby enabling more efficient traffic distribution. In addition, by specifying the maximum amount of traffic data to be distributed for each class, the CPU of the NW device becomes in a load state, and other classes of traffic cannot be distributed, and other functions of the NW device are also affected. It is possible to avoid the occurrence of problems such as The sampling rate and sampling protocol can be changed for each class.

  Embodiments of the present invention classify packets prior to sampling, and for certain traffic, for example, increase the sampling rate to monitor and analyze packet information including the payload portion of the application, otherwise For traffic, more efficient measurement is performed that enables distribution of traffic information after further aggregation. This also enables more detailed traffic monitoring and analysis while maintaining the scalability of measuring traffic in a large-scale network. That is, according to the present embodiment, IP packets received by an NW device (router, switch) or the like are classified into a plurality of classes based on a plurality of filter conditions, and a sampling rate, a sampling algorithm, By defining the information distribution method and distribution limit amount to the traffic information collecting device, a traffic information distribution method according to the traffic analysis method for each application of the packet is made possible. This function is assumed to be installed in an NW device (router, switch) or the like.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 3 shows an overall schematic diagram. In FIG. 3, reference numeral 301 denotes a network, and reference numeral 302 denotes an NW device arranged on the network 301. In the figure, four NW devices 302-1 to 302-4 are arranged, but any number is possible. A traffic information collecting device 303 collects traffic information. Reference numeral 304 denotes a traffic analysis device group. In the figure, the traffic analysis device group 304 includes an abnormal packet collection / analysis device 311, an unroutable / unused address traffic analysis device 312, a signature analysis device 313, a TCP status analysis / ICMP analysis device 314, a VoIP quality analysis device 315, a protocol. Although it is configured from the Analyzer 316, this is merely an example, and it may be configured by only some of these analyzers, or may include other analyzers. Moreover, since these analyzers should just use the apparatus generally used, the detailed description is abbreviate | omitted.

  The NW device 302 has a hierarchical flow statistics function. The hierarchical flow statistical function is a function for classifying into a class and performing flow statistics according to usage such as importance. When a packet flowing on the network 301 is input, the NW device 302 classifies each class before sampling, processes each class, creates traffic information distribution data, and uses a flow distribution protocol to generate traffic information. Information distribution data is distributed to the traffic information collection device 303. The NW device 302 is typically a router, a switch, or the like, but can be said to be a traffic information distribution device if attention is paid to the traffic information distribution function.

  The traffic information collecting device 303 distributes the traffic information distribution data received from the NW devices 302-1 to 302-4 on the network 301 into class units / filter condition units, and each analysis device 311 to 316 in the traffic analysis device group 304. Deliver to.

  Each analysis device 311 to 316 of the traffic analysis device group 304 performs each analysis using the traffic information distributed and distributed from the traffic information collection device 303.

  FIG. 4 shows a configuration diagram of the NW device 302 having this function. Reference numeral 401 denotes an IF, and packets 441 to 443 flow into the NW device 302 through the IF 401.

  A classification unit 402 classifies traffic into classes according to filter conditions. Based on the filter condition setting table 700, the classifying unit 402 classifies received packets hierarchically into classes. The filter condition table 700 will be described later with reference to FIG.

  Reference numeral 403 denotes class-specific processing means for processing the packets classified into classes by the classification means 402 for each class. The class processing unit 403 performs class processing based on the traffic measurement information table 800. The traffic measurement information table 800 will be described later with reference to FIG.

  FIG. 4 shows an example in which the classification unit 402 classifies the received SIP packet 441, icmp packet 442, and Other packet (other packets) 443 into class # 1, class # 2, and class # 3, respectively.

  The class-specific processing unit 403 samples the SIP packet 441 classified into the class # 1 at a rate = 1/1 as indicated by 410 (411), and selects an information distribution method (412). The delivery limit amount is checked (413). Also, the class-specific processing unit 403 samples the icmp packet 442 classified into the class # 2 at a rate = 1/100 as indicated by 420 (421), and selects an information distribution method (422) ), The delivery limit amount is checked (423). Further, the class processing means 403 samples the Other packet 443 classified into the class # 3 at a rate = 1/10000 as shown by 430 (431), and selects an information distribution method (432) ), The distribution limit amount is checked (433). In FIG. 4, the classifying unit 402 classifies into three classes, and the class-by-class processing unit 403 performs processing for each of the three classes. In general, however, the classifying unit 402 classifies received packets into a plurality of classes. The class-based processing unit 403 classifies the packets classified into a plurality of classes by the classifying unit 402, and extracts a part of the packets based on the processing for each class, for example, a traffic information distribution method. Any one of the distribution methods of the packet extraction method or the flow aggregation method of collecting flows may be selected.

  Reference numeral 404 denotes traffic information distribution data creation / distribution means for creating traffic information distribution data based on the data from the class-specific processing means 403 and distributing the traffic information distribution protocol packet 450 to the traffic information collection device 303. The traffic information distribution protocol packet 450 is a traffic information distribution packet for distributing traffic information by a traffic information distribution protocol. That is, the traffic information distribution data creation / distribution means 404 creates a traffic information distribution packet constituted by each traffic information by the distribution method selected by the class-specific processing means 403, and uses the traffic information distribution packet as the traffic information collection device 303. Deliver to.

Hereinafter, the process of the class-specific processing unit 403 of the NW device 302 will be described in more detail.
In sampling 411, 421, 431, for example, when N packets are extracted by passing M packets, the sampling rate is N / M. As for the sampling algorithm, it is possible to select whether to sample randomly, extract regularly, or sample packets in a time period.

  In the information distribution method selection 412, 422, and 432, the information distribution method to the traffic information collecting device is roughly divided into two. One is a method in which a part of a packet is cut out, copied and distributed (hereinafter referred to as a packet extraction method), and the other is flow identification information (a transmission source included in the IP header). / Destination IP address, transmission source / destination port number, protocol) and a method of distributing and distributing the number of packets and the number of bytes (hereinafter referred to as a flow aggregation method).

In the packet extraction method, parameters relating to the distribution method can be specified for each class. The parameters that can be specified are shown below.
Packet copy start header information: A header type (Ethernet header, IP header, UDP, TCP header) is specified as copy start location information for distribution in the extracted packet.
Offset information: an offset value (byte) indicating a packet extraction start portion from the header type.
Extraction maximum length: This is the maximum length (bytes) that can be copied from the cutout start portion of the packet.

Also in the flow aggregation method, parameters relating to the distribution method can be specified for each class. The parameters that can be specified are shown below.
Flow key information: In addition to aggregating the above-described flow identification information as key information, IP / UDP / TCP header, Ethernet header, and Label header attribute information, reception / output IF numbers, packet routing characteristic information (Next-Hop) , BGP Next-hop, originAS, peerAS, etc.). Based on this key information, flow entry information is created. Thereafter, when packets having the same key information are extracted, integration processing is performed on the total attribute information of this entry. If there is no corresponding flow entry in the extracted packet, it is newly created.
Aggregated attribute information: Specifies attribute information to be aggregated when aggregation is performed based on flow keys. For example, the number of packets, the total of packet lengths (total number of bytes), and the like are applicable.
Timeout information: When aggregation is performed based on certain identification information, if there is no change in the aggregate attribute information related to the identification information within a certain period, this flow entry information is deleted and traffic information is deleted. This is a timeout value (seconds) that determines that this information is distributed to the collection device.

  As described above, the traffic information of each class is distributed to the traffic information collection device 303 by the traffic information distribution method determined for each class by the selection of the information distribution method 412, 422, 432. In order to avoid a situation in which information of other classes is not distributed due to an increase in traffic volume, a distribution volume limit amount is determined for each class, and distribution limit amount checks 413, 423, and 433 are performed. Is checked. This limit amount is in units of pps (packets per second) in the packet extraction method, and in units of fps (flow records per second) in the flow aggregation method.

  When the traffic information distribution data creation / distribution means 404 distributes the traffic information to the traffic information collection device 303, the identifier of each class and the corresponding filter condition identifier are added to the traffic information for distribution. As a protocol for distribution, traffic information distribution protocols such as IPFIX, sFlow, and NetFlow are applied. The traffic information extracted by the packet extraction method is stored as packet information, and the information selected as the flow aggregation method is stored as flow record information in the packet of the traffic information distribution protocol. A class identifier indicating each class and a filter condition identifier are added to each traffic information.

  FIG. 5 shows the configuration of the traffic information distribution protocol packet 450 created in this way. Reference numeral 501 denotes a header of a traffic information distribution protocol packet, and reference numerals 502-1 to 502-N denote traffic information # 1 to #N. Traffic information # 1 (502-1) is traffic information in the case of the flow aggregation method. 510 is a header of traffic information # 1, 511 is flow key information, 512 is total attribute information, 513 is a class identifier, and 514 is a filter condition identifier. The header 510 describes the sampling rate and sampling algorithm. Flow key information 511 and aggregate attribute information 512 are flow record information. On the other hand, traffic information # N-1 (502-N-1) is traffic information in the case of the packet extraction method. 520 is a header of traffic information # N-1, 521 is packet copy information, 522 is related attribute information, 523 is a class identifier, and 524 is a filter condition identifier. Packet copy information 521 is packet information.

  In the traffic information collection device 303, the class identifier 513, 523 and the filter condition identifier 514, 524 indicating each class added to each traffic information can identify the received traffic information class and the filter condition, and the traffic analysis is performed. In this case, information can be distributed to the traffic analysis device group 304.

  As a result, for important packets, it is possible to distribute information including application payloads to the traffic information collection device 303 by the packet extraction method after increasing the sampling rate. It becomes possible to analyze the traffic including the application part. In addition, for a class whose purpose is to measure overall traffic trends, the sampling rate is reduced and distributed to the traffic information collection device 303 by a coarse-grained flow aggregation method such as aggregation in OriginAS units. It is possible to maintain scalability.

  Here, a method of applying the hierarchical flow statistical method based on a certain provider's network as shown in FIG. 6 will be described. FIG. 6 is a conceptual diagram of a certain provider. In FIG. 6, 601 is an NW (Network) of this provider, 602 is a mass user access network connected to the NW 601, and 603 is an access network of important customers connected to the NW 601. Reference numeral 604 denotes an external NW # 1, which is connected to the NW 601 via the router # 1 (606). Reference numeral 605 denotes an external NW # 2, which is connected to the NW 601 via the router # 2 (607).

It is assumed that this provider has the following address setting policy NW601.
The mass user access network 602 has an address block 192.0.2.0/26 as a customer address.
The important customer access network 603 has an address block 192.0.2.64/26 as an address for this customer.
The address block 192.0.2.128/26 is provided as a link address in the NW601 network. The DNS server 608 and the SIP server 610 are respectively 192.0.2.200 and 192.0 as the core servers of the provider. 2.2 Having an address of 210.

  Here, an example in which the hierarchical flow statistical method is applied to the IF of the router # 1 (606) connecting the external NW # 1 (604) and the router # 1 (606) is shown.

  Router # 1 (606) has a filter condition setting table for classifying packets and a traffic measurement information table for each class. FIG. 7 shows a filter condition setting table and FIG. 8 shows a traffic measurement information table.

  In the filter condition setting table 700 of FIG. 7, 701 is a filter condition identifier, 702 is a destination IP address band, 703 is a source IP address band, 704 is a protocol, 705 is a destination port number, and 706 is a source. A column for setting a port number, 707 for TCP Flags, and 708 for a class identifier.

  The filter condition setting table in FIG. 7 shows an example in which the destination IP address band, the source IP address band, the protocol, the destination port number, the source port number, and TCP Flags can be set. Information (destination address, source address, protocol, destination port number, source port number, TCP flag, TOS, destination MAC address, source MAC address, label, IP version, packet Length) and NW device Characteristic information (reception IF information, transmission destination IF information, Next-Hop address, BGP Next-Hop address, Peering AS number, Origin AS number, BGP Community) for routing the packet may be settable. That is, the filter condition setting table may be one in which a filter condition identifier and a class identifier are set corresponding to one or more of these.

  In the traffic measurement information table of FIG. 8, 801 is a class identifier, 802 is a sampling algorithm, 803 is a sampling rate, 804 is a traffic distribution method, 805 is packet copy start location information, 806 is offset information, 807 Is a column for setting the maximum extraction length, 808 for related attribute information, 809 for flow key information, 810 for aggregate attribute information, 811 for timeout information, and 812 for limiting the amount of distribution. When the packet extraction method is set in the traffic distribution method 804, packet copy start location information 805, offset information 806, extraction maximum length 807, and related attribute information 808 are set. On the other hand, if the flow distribution method is set in the traffic distribution method 804, flow key information 809, total attribute information 810, and timeout information 811 are set.

  In the filter condition setting table 700 of FIG. 7, it is assumed that the filter condition identifiers 1 to 4 are packets that should not be originally flown from the external NW, such as using a private address. 1 is assumed. Thereafter, monitoring of important servers is set as classes 2 and 3 for each server, and traffic that finally flows to the external NW # 2 is set as class 7. When a packet is received, it is assumed that the filter condition identifier is sequentially searched from a young number (small number), and the class of the packet is determined at a location that matches the condition.

  That is, the classifying unit 402 sets the filter condition identifiers 1 to 4 and the class identifier 1 for the packets that should not originally be based on the filter condition setting table 700 of FIG. 7, and the destination is the DNS server 608 (192.0.2). .200) is set to filter condition identifier 5 and class identifier 2, and the packet whose destination is SIP server 610 (192.0.2.210) is set to filter condition identifier 6 and class identifier 3, and the destination is important. For the packet that is the customer access network 603 (192.0.2.64/26), the filter condition identifier 7 and the class identifier 4 are used, and the destination is the mass user access network 602 (192.0.2.0/26). A certain packet has a filter condition identifier 8 and a class identifier 5, and the destination is the NW network 601 ( 92.0.2.128/26) filter condition identifier 9 for the packet is, the class identifier 6, the filter condition identifier 10 for other packets, the class identifier 7.

  Packets whose classes are determined are aggregated as traffic information along the traffic measurement information table 800 set for each class.

  For example, for the traffic (class identifier 3) destined for the SIP server 610, the length of the copy packet part extracted so as to be analyzed up to the SDP part is increased (extraction maximum length: 750 bytes). On the other hand, since the traffic (class identifier 7) flowing out to the external NW # 2 (605) does not require so detailed analysis, the traffic is set to be aggregated for each AS number to be peered (flow). Key information: PeeringAS).

  As described above, the packets received from the external NW # 1 (604) to the router # 1 (606) are classified into classes based on the filter condition setting table 700, and as traffic information according to the setting contents of the traffic measurement information table 800. It is shaped and stored in the packet 450 of the traffic information distribution protocol.

  The traffic information collection device 303 performs distribution to a specific analysis device based on the class identifier and the filter condition identifier. For example, SIP packets (filter condition identifier 6, class identifier 3) are distributed and distributed to an analysis device for SIP protocol.

  Each unit of the network device of the embodiment described above is realized by the CPU processing a program stored in the storage device. Moreover, you may comprise a part or all of the program with a hardware. Each table of the NW device is stored in the storage device.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure which shows the load condition of a router. It is a table | surface which shows an example of the packet size effective for every application. 1 is an overall schematic diagram of an embodiment of the present invention. It is a block diagram of NW apparatus (traffic information distribution apparatus) of the embodiment of the present invention. 3 is a traffic information distribution protocol packet created according to an embodiment of the present invention. It is a conceptual diagram of the provider of the Example of this invention. It is a filter condition setting table of the Example of this invention. It is a traffic measurement information table of the Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 301 ... Network, 302 ... NW device (traffic information distribution device), 303 ... Traffic information collection device, 304 ... Traffic analysis device group, 401 ... IF, 402 ... Classification means, 403 ... Class-specific processing means, 404 ... Traffic information distribution Data creation and delivery means, 441... SIP packet, 442... Icmp packet, 443... Other packet, 410, 420, 430... Processing of packets classified into class # 1, class # 2, and class # 3 411, 421, 431 ... Sampling 412, 422, 432 ... Selection of information distribution method 413, 423, 433 ... Check of distribution limit amount, 450 ... Traffic information distribution protocol packet, 501 ... Traffic information distribution protocol packet header 502-1 ~ 502-N ... Fick information # 1 to #N, 510 ... header of traffic information # 1, 511 ... flow key information, 512 ... aggregate attribute information, 513 ... class identifier, 514 ... filter condition identifier, 520 ... header of traffic information # N-1 521 ... Packet copy information, 522 ... Related attribute information, 523 ... Class identifier, 524 ... Filter condition identifier, 601 ... Provider NW, 602 ... Mass user access network, 603 ... Important customer access network, 604 ... External NW # DESCRIPTION OF SYMBOLS 1,605 ... External NW # 2, 606 ... Router # 1, 607 ... Router # 2, 608 ... DNS server, 610 ... SIP server, 700 ... Filter condition setting table, 800 ... Traffic measurement information table

Claims (7)

A traffic information distribution method in a traffic information distribution device that distributes traffic information to a traffic information collection device,
The traffic information distribution device has classification means, class-specific processing means, and traffic information distribution data creation and distribution means,
The classification means classifies the received packet into each class,
A packet extraction technique or flow in which the class-specific processing means extracts a part of the packet based on the traffic information distribution technique defined for each class for the packet classified into each class by the classification means. Select one of the flow aggregation methods to be aggregated,
The traffic information distribution data creation / distribution means creates a traffic information distribution packet composed of each traffic information by the distribution method selected by the class-specific processing means, and distributes the traffic information distribution packet to the traffic information collection device A traffic information distribution method characterized by: The traffic information distribution method according to claim 1,
If the limit processing unit exceeds the limit for the packet classified into each class by the classifying unit based on the delivery limit determined for each class, the class-specific processing unit A traffic information distribution method characterized in that distribution is stopped and distribution of the traffic information is started when the amount falls below a limit. The traffic information distribution method according to claim 1 or 2,
The traffic information distribution, wherein the class-specific processing unit performs packet sampling on the packets classified into the classes by the classifying unit based on a sampling rate and / or a sampling algorithm determined for each class. Method. The traffic information distribution method according to any one of claims 1 to 3,
The traffic information distribution device has a filter condition setting table,
The filter condition setting table includes a destination address, a source address, a protocol, a destination port number, a source port number, a TCP flag, a TOS, a destination MAC address, a source MAC address, a label, and an IP, which are information related to the packet header. Version, packet Length, and reception IF information, destination IF information, Next-Hop address, BGP Next-Hop address, Peering AS number, Origin AS number, BGP Community, which are characteristic information for routing the packet by the NW device Filter condition identifier and class identifier are set corresponding to one or more of them,
The traffic information distribution method, wherein the classifying unit classifies received packets into classes based on the filter condition setting table. The traffic information distribution method according to claim 4,
The traffic information distribution device has a traffic measurement information table,
The traffic measurement information table is set with one or more of a traffic distribution method, a sampling rate, a sampling algorithm, and a distribution amount limit corresponding to the class identifier,
The traffic information distribution method, wherein the class-specific processing means performs class-specific processing based on the traffic measurement information table. The traffic information distribution method according to claim 5,
A traffic information distribution method, wherein the traffic information distribution data creation / distribution means adds the filter condition identifier and / or the class identifier to each traffic information of the traffic information distribution packet. A traffic information collection method in a traffic information collection device that collects traffic information from the traffic information distribution device that distributes traffic information by the traffic information distribution method according to claim 6,
Based on the class identifier and / or filter condition identifier added to each piece of traffic information collected from the traffic information distribution device, the traffic information collection device selects an appropriate traffic analysis device from the traffic analysis device group. A traffic information collecting method characterized by sorting traffic information.

Images