Conversion device, conversion method, and conversion program

Abstract

A conversion device (10) analyzes information concerning an input packet by means of hardware, determines whether or not to perform predetermined pre-processing by means of the hardware, and determines whether a packet to be subjected to the predetermined pre-processing by means of the hardware is a packet having a plurality of header samples contained therein or a packet having a single header sample contained therein. The conversion device (10) reconstructs a packet having a plurality of header samples contained therein into a packet having a single header sample contained therein. On the basis of fixed-length in-header information in the packet having a single header sample contained therein, the conversion device (10) performs, by means of the hardware, processing for attaching, to the packet, metadata including identification information indicating a group of the packet. The conversion device (10) performs, by means of software, processing for generating an analyzing packet corresponding to the group of the packet by using the attached metadata.

Description

[Technical Field]

[0001] The present invention relates to a conversion device, a conversion method, and a conversion program. [Background technology]

[0002] For network monitoring and traffic trend analysis, there is xFlow technology, which samples packets and transfers flow statistics calculated from header information or the header portion itself (header sample) to aggregate and analyze traffic. There is also packet encapsulation technology, which transfers packets on the network by embedding them in the payload of another packet.

[0003] As a method for analyzing encapsulated packets, there is a format conversion technology that enables extraction and analysis of the packet inside the capsule from the encapsulated packet and the header sample xFlow packet. There is also a technology that registers the correspondence between the packet header inside the capsule and the packet header outside the capsule in a database for the encapsulated packet.

[0004] Furthermore, there is a technology that enables efficient aggregation and analysis of traffic inside the capsule in the network where encapsulated packets are forwarded. Furthermore, a technology has been proposed that identifies protocol groups based on the outer / inner packet header information in the network where encapsulated packets are forwarded, enabling different processing and analysis depending on the attributes of the service provider, etc.

[0005] Also, a technique has been proposed in which packets are analyzed in front-stage hardware, and then, depending on the analysis results, front-stage hardware processing, back-stage software processing, or filtering by excluding packets from processing targets is performed. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2019-097069 [Patent Document 2] Patent Publication No. 2021-090161 [Patent Document 3] International Publication No. 2021 / 149245 [Patent Document 4] Japanese Patent Publication No. 2020-174257 [Non-patent literature]

[0007] [Non-Patent Document 1] NetFlow (RFC3954), [Retrieved August 1, 2022], Internet<URL:https: / / datatracker.ietf.org / doc / html / rfc3954.html> [Non-patent document 2] IPFIX (RFC5103, 7011-7015), [Retrieved August 1, 2022], Internet<URL:https: / / www.ietf.org / rfc / rfc5103.txt> [Non-patent document 3] sFlow, [Retrieved August 1, 2022], Internet<URL:https: / / sflow.org / sflow_version_5.txt> [Non-patent document 4] IPFIX with IE315 (RFC7133) [Non-Patent Document 5] pmacct, [Retrieved August 1, 2022], Internet<URL:http: / / www.pmacct.net / > [Non-patent document 6] nProbe, [Retrieved August 1, 2022], Internet<URL:https: / / www.ntop.org / products / netflow / nprobe / > [Non-Patent Document 7] Nishioka et al., “Proposal of Fast xFlow Proxy for Visualizing Traffic in Carrier Networks Accommodating Multiple Operators,” IEICE General Conference 2021, B-6-33, Mar. 10, 2021 Summary of the Invention [Problem to be solved by the invention]

[0008] For xFlow packets containing multiple header samples, in order to enable analysis by an external analysis device, the multiple header samples must be split and reconstructed into a single header sample, and statistics must be collected and sent to the analysis device.

[0009] Conventionally, when an xFlow packet containing multiple header samples is received, the multiple header samples are divided and reconstructed by software.

[0010] However, since this process requires a large computational cost due to software processing, it has been difficult to process large volumes of traffic information contained in multiple header samples at high speed using software.

[0011] The present invention has been made in consideration of the above, and aims to provide a conversion device, a conversion method, and a conversion program that can reduce the software processing load, increase processing speed, and increase the amount of processable traffic. [Means for solving the problem]

[0012] In order to solve the above-mentioned problems and achieve the object, a conversion device according to the present invention comprises an analysis unit that analyzes information of an input packet using hardware, determines whether or not to perform predetermined pre-stage processing using the hardware, and determines whether the packet that will undergo the predetermined pre-stage processing using the hardware is a packet carrying multiple header samples or a packet carrying a single header sample; a reconstruction unit that reconstructs the packet carrying the multiple header samples into a packet carrying a single header sample; an attachment unit that uses the hardware to perform a process of attaching metadata to the packet carrying the single header sample determined by the analysis unit or the packet carrying the single header sample reconstructed by the reconstruction unit, the metadata including identification information that indicates a group of the packet, based on information in the fixed-length header of the packet carrying the single header sample; and a generation unit that uses software to perform a process of generating a packet for analysis corresponding to the group of packets, using the metadata attached by the attachment unit. [Effects of the Invention]

[0013] According to the present invention, it is possible to reduce the software processing load, increase the processing speed, and increase the processable traffic volume. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a block diagram illustrating an example of a configuration of a communication system according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating the flow of processing in the conversion device shown in FIG. [Figure 3] FIG. 3 is a block diagram illustrating an example of the configuration of the conversion device illustrated in FIG. [Figure 4] FIG. 4 is a diagram illustrating the reconstruction process performed by the reconstruction unit shown in FIG. [Figure 5] FIG. 5 is a diagram illustrating the reconstruction process performed by the reconstruction unit shown in FIG. [Figure 6] FIG. 6 is a diagram illustrating the addition of metadata to an IPFIX packet. [Figure 7] FIG. 7 is a diagram illustrating the flow of processing in the conversion device shown in FIG. [Figure 8] FIG. 8 is a diagram illustrating the flow of processing in the conversion device shown in FIG. [Figure 9] FIG. 9 is a diagram illustrating the circuit architecture of the reconstruction unit shown in FIG. [Figure 10] FIG. 10 is a flowchart illustrating an example of a processing procedure for the conversion processing according to the embodiment. [Figure 11] FIG. 11 is a diagram illustrating a conventional conversion technique. [Figure 12] FIG. 12 is a diagram illustrating an example of a computer that implements a conversion device by executing a program. DETAILED DESCRIPTION OF THE INVENTION

[0015] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The following describes in detail embodiments of a conversion device, a conversion method, and a conversion program according to the present invention, with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described below.

[0016] [Embodiment Mode] First, an embodiment will be described. A conversion device 10 according to this embodiment offloads some processing to front-stage hardware and analyzes packets in hardware. The conversion device 10 determines whether to perform the processing in hardware or in rear-stage software.

[0017] If the conversion device 10 determines that hardware processing is to be performed, it further identifies header information by protocol analysis and determines whether the packet contains multiple header samples (multiple-header sample packet) or a single header sample (single-header sample packet).For multiple-header sample packets, the conversion device 10 divides the multiple header samples in the upstream hardware and reconstructs them into single-header sample packets.

[0018] The conversion device 10 then writes metadata, including the analysis results and grouping information performed on the packet by the upstream hardware, to the end of the packet.The conversion device 10 then identifies the metadata in the downstream software and performs protocol analysis and grouping processing, thereby linking hardware and software.

[0019] As a result, the conversion device 10 offloads some processing to hardware, reducing the software processing load and enabling flexible high-speed processing that differs depending on the attributes of the carrier, etc. Furthermore, the conversion device 10 uses hardware to process the division and reconstruction of packets containing multiple header samples, thereby reducing the software processing load, which has a high computational cost, and enabling high-speed processing of large volumes of traffic information.

[0020] [Communication system configuration] Fig. 1 is a block diagram showing an example of the configuration of a communication system according to an embodiment. As shown in Fig. 1, the communication system 1 according to the embodiment includes a plurality of network devices 2, a conversion device 10, and a plurality of analysis devices 3 (external devices). For example, the plurality of network devices 2 and the conversion device 10 communicate with each other via a network N. Note that the configuration shown in Fig. 1 is merely an example, and the specific configuration and the number of devices are not particularly limited.

[0021] The network device 2 samples packets in the traffic to be monitored. For example, the network device 2 may forward mirrored encapsulated packets to the conversion device 10, or may cut out sampled packet header samples and encapsulate the cut-out header samples into xFlow packets, which are then forwarded to the conversion device 10. In this case, the network device 2 may include statistical information about the flow, such as the number of packets, in the xFlow packets to be forwarded, or may forward this information as a separate xFlow packet to the conversion device 10.

[0022] The converter 10 converts xFlow packets input from various network devices 2 into xFlow packets in a format that corresponds to the processing content of the external analyzer 3. Specifically, the converter 10 identifies header information through protocol analysis, divides multi-header sample packets and reconstructs them into single-header sample packets, and then performs grouping based on conditions. The converter 10 then performs processing defined for each group and sends the generated packets to the analyzer 3. For example, as processing defined for each group, the converter 10 tallyes statistics on the inner headers of xFlow packets input from various network devices 2, generates xFlow packets that include at least statistical information indicating the obtained statistics on the inner headers, and sends the xFlow packets to the external analyzer 3.

[0023] Each analysis device 3 analyzes the traffic to be monitored and counts packets in the traffic to be monitored. For example, the analysis device 3 performs analysis and counting using statistical information included in the xFlow packets converted by the conversion device 10.

[0024] The conversion device 10 performs flexible format conversion processing based on packet header information. The flow of format conversion processing in the conversion device will be described below with reference to FIG. 2. FIG. 2 is a diagram illustrating the flow of processing in the conversion device shown in FIG. 1. Note that in this explanation, the explanation of the processing by the conversion device 10 to offload some processing to hardware will be omitted, and the overall flow of format conversion processing will be described without specifying whether the processing is hardware or software. The processing to offload some processing to hardware will be described later.

[0025] As illustrated in FIG. 2, when the conversion device 10 receives an input of an encapsulated packet mirrored by the network device 2 or an xFlow packet including a header sample, the conversion device 10 identifies the header information by protocol analysis (see (1) in FIG. 2).

[0026] Then, the conversion device 10 reconstructs the multi-header sample packets among the input packets into single-header sample packets (see (2) in FIG. 2), and then performs grouping based on conditions (see (3) in FIG. 2). The example in FIG. 2 illustrates a case where the conversion device 10 classifies packets into one of multiple groups "groups #1 to #3" based on conditions related to both the outer header and the inner header.

[0027] Next, the conversion device 10 performs information shaping processing defined for each group (see (4) in Figure 2). For example, in the example in Figure 2, the conversion device 10 calculates statistics for the inner headers of packets classified into group "#1" and generates an xFlow packet that includes at least statistical information indicating the statistics for the inner headers. The conversion device 10 then sends the generated xFlow packet to the xFlow analysis device 3A (also referred to as "analysis A" in Figure 2) as the destination.

[0028] For example, the conversion device 10 calculates statistics for the outer headers of packets classified into group "#2" and generates an xFlow packet that includes at least statistical information indicating the statistics for the outer headers.The conversion device 10 then transmits the generated xFlow packet to the xFlow analysis device 3B (also referred to as "analysis B" in FIG. 2) as the destination.

[0029] Furthermore, for example, the conversion device 10 performs a process of removing the capsule header from packets classified into group "#3" and generating (shaping) packets whose destination is rewritten to the external analysis device 3C. The conversion device 10 then transmits the generated packets to the packet capture device 3C (also shown as destination "capture C" in FIG. 2) as the destination. Note that the conversion device 10 may generate and transmit packets at any timing for each of the above processes.

[0030] For example, when performing statistical processing such as processing corresponding to groups "#1" and "#2," the conversion device 10 performs statistical processing when the number of grouped packets reaches a predetermined number, and generates and transmits a packet. Also, for example, when performing processing corresponding to group "#3," in which the capsule header is removed and the destination is rewritten to the external analysis device 3, the conversion device 10 generates and transmits a packet every time packets are grouped into group "#3."

[0031] In other words, the conversion device 10 groups the input packets and performs different processing for each group, such as deleting the outer capsule packet header, statistical processing, and changing the destination IP address, thereby enabling flexible individual processing and analysis to be performed for each attribute of the network user, etc.

[0032] Furthermore, in the conversion device 10, by offloading some processing to hardware, the amount of processing on the software side is reduced, and it is possible to perform flexible processing at high speed that differs depending on the attributes of the carrier, etc. Furthermore, in the conversion device 10, by using hardware to process the division and reconstruction of multiple header samples for packets containing multiple header samples, it is possible to reduce the software processing load, which has a high calculation cost, and to process large volumes of traffic information at high speed.

[0033] [Configuration of conversion device] Next, a description will be given of the configuration of the conversion device 10. Fig. 3 is a block diagram showing an example of the configuration of the conversion device 10 shown in Fig. 1.

[0034] As shown in FIG. 3, the conversion device 10 includes a packet analysis unit 11, a reconstruction unit 12, a metadata assignment unit 13, a generation unit 14, and a rule information DB 15. The conversion device 10 is realized, for example, by loading a predetermined program into a computer including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The conversion device 10 also includes a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. For example, the conversion device 10 includes a network interface card (NIC) and communicates with other devices via telecommunication lines such as a local area network (LAN) or the Internet.

[0035] The rule information DB 15 stores preset rules for determining whether to offload a portion of processing to pre-stage hardware. For example, the rule information DB 15 stores a determination rule for determining whether a packet is a target packet for hardware offloading or a non-target packet for software offloading, based on information on one or both of the outer and inner headers of an input packet. The rule information DB 15 stores a determination rule for determining whether a packet to be processed by hardware is a multi-header sample packet or a single-header sample packet.

[0036] The rule information DB 15 also stores rules for identifying hardware processing portions and software processing portions in a packet. For example, the rule information DB 15 stores rules for identifying hardware processing portions and software processing portions for each type of packet.

[0037] The rule information DB 15 also stores grouping conditions, which are conditions for grouping input packets, as grouping conditions. For example, the rule information DB 15 also stores conditions related to information included in either or both of an outer header and an inner header as grouping conditions.

[0038] Furthermore, the rule information DB 15 stores the processing defined for each group. That is, the rule information DB 15 stores the processing to be performed for each group of packets. For example, the rule information DB 15 stores the processing content and the destination of the generated analysis packet in association with the group ID. Note that the information stored in the rule information DB 15 is preset by the operator and can be changed, added, or deleted as appropriate.

[0039] The packet analysis unit 11 analyzes the information of the input packet using hardware and determines whether or not to perform predetermined pre-processing using the hardware. For example, when the packet analysis unit 11 receives an input of an encapsulated packet (RAW packet) or an xFlow packet that includes a header sample, which is the header portion itself, it performs protocol analysis on the encapsulated packet or xFlow packet using hardware.

[0040] For example, the packet analysis unit 11 determines whether to perform predetermined pre-processing by hardware, and determines whether the packet to be processed by hardware is a multiple-header sample packet or a single-header sample packet. That is, the packet analysis unit 11 refers to the determination rules stored in the rule information DB 15 and determines whether the input packet is a hardware offload target packet and a multiple-header sample packet, a hardware offload target packet and a single-header sample packet, or a non-hardware offload packet.

[0041] As a result, for example, if the packet analysis unit 11 determines that the packet is a non-hardware offload packet, it causes the generation unit 14 (software) to perform the following process.

[0042] Also, for example, if the packet analysis unit 11 determines that the packet is a hardware offload target packet and a multiple-header sample packet, it refers to the information stored in the rule information DB 15 and causes the reconstruction unit 12 (hardware) to perform the following processing.

[0043] Also, for example, when the packet analysis unit 11 determines that the packet is a single-header sample packet that is subject to hardware offload, it refers to the information stored in the rule information DB 15, identifies the hardware processing portion and the software processing portion of the packet, and causes the metadata assignment unit 13 (hardware) to perform the following processing.

[0044] For example, when the packet analysis unit 11 receives an input of an L2TP packet, which is an encapsulated packet, it identifies the "first Ether header," "first IPv4 / IPv6 header," and "UDP (User Datagram Protocol) header" as hardware processing parts, and identifies the "second IPv4 / IPv6 header" as software processing parts. For example, information in the fixed-length header outside the capsule is easy to determine even if processed in hardware, so it is classified as a hardware processing part. Also, for example, information in the variable-length header and the inner header of the capsule must be read and determined bit by bit, so it is classified as a hardware processing part.

[0045] Furthermore, for example, when the packet analysis unit 11 receives input of an IPFIX packet, which is an xFlow packet including a header sample, it identifies the "IPFIX Ether header" and "IPFIX IPv4 / IPv6 header", and the "first Ether header", "first IPv4 / IPv6 header", and "UDP header" in the L2TP header sampling within the IPFIX set as hardware processing parts, and identifies the "second IPv4 / IPv6 header" in the L2TP header sampling as software processing parts.

[0046] The reconstruction unit 12 reconstructs the multi-header sample packets into single-header sample packets. The reconstruction unit 12 divides the multi-header sample packets into a header portion and each data portion. The reconstruction unit 12 then reconstructs the single-header sample packets according to the number of data portions. The reconstruction unit 12 outputs each reconstructed single-header sample packet to the metadata assignment unit 13.

[0047] Figures 4 and 5 are diagrams illustrating the reconstruction process by the reconstruction unit 12 shown in Figure 3. Figures 4 and 5 illustrate the reconstruction process of an IPFIX packet with two samples.

[0048] As shown in Fig. 4, the reconstruction unit 12 obtains the data length of the entire IPFIX multi-sample and the data length of each sample from FlowSet Length and string_len_short stored in the IPFIX header, and divides it into a header part and each data part. In the example of Fig. 4, it divides it into an L2 / L3 header part, an IPFIX header part, sample data S1, and sample data S2.

[0049] Then, the reconstruction unit 12 reconstructs IPFIX packets of single-header samples according to the number of samples, as shown in Fig. 5. The reconstruction unit 12 reconstructs an IPFIX packet of single-header samples including sample data S1 based on the L2 / L3 header portion, IPFIX header portion, and sample data S1. The reconstruction unit 12 then reconstructs an IPFIX packet of single-header samples including sample data S2 based on the L2 / L3 header portion, IPFIX header portion, and sample data S2.

[0050] The metadata assignment unit 13 performs a process using hardware to assign metadata to input packets, which includes identification information indicating the group of the input packets, based on the information in the fixed-length header of the single-header sample packet input by the packet analysis unit 11 or the reconstruction unit 12.

[0051] For example, the metadata assigning unit 13 refers to the rules stored in the rule information DB 15, acquires the information in the header identified by the packet analysis unit 11 as a hardware processing part, performs grouping based on the information in the header to determine a grouping ID, and assigns metadata including the grouping ID to the packet by hardware. Also, for example, the metadata assigning unit 13 performs information shaping processing to change the source IP address of the packet to the IP address of the conversion device 10 and the destination IP address to the IP address of the analysis device 3.

[0052] Then, the metadata assigning unit 13 assigns metadata in accordance with the rules based on the information in the header identified as the hardware processing part. For example, the metadata includes protocol analysis results such as the protocol type and header length of each header, and the grouping primary identification results.

[0053] Fig. 6 is a diagram illustrating the addition of metadata to an IPFIX packet. As illustrated in Fig. 6, for example, the metadata addition unit 13 creates metadata (Meta1, Meta2) corresponding to each sample and adds it to the IPFIX packet.

[0054] For example, the metadata adding unit 13 adds metadata including "number of VLANs," "number of MPLS labels," "positions of various headers," and "xFlow packet type" to the IPFIX packet. The metadata adding unit 13 inserts 0 to 3 byte padding between the reassembled IPFIX packet and the metadata, aligns it to 4 bytes, and then adds the metadata. The metadata adding unit 13 performs padding to match the length of the reassembled packet.

[0055] Furthermore, for example, the metadata assignment unit 13 assigns metadata to the L2TP packet, including the "number of VLANs," "number of MPLS labels," "IP header position," "grouping ID based on the rule table," and "source IP address and destination IP address before information reformatting."

[0056] When a predetermined pre-processing has been performed by hardware, the generation unit 14 performs processing by software to generate analysis packets corresponding to a group of packets using the metadata assigned by the metadata assignment unit 13. For example, the generation unit 14 acquires a grouping ID included in the metadata assigned by the metadata assignment unit 13, and refers to the rule information DB 15 to determine processing corresponding to the grouping ID.

[0057] Furthermore, if predetermined pre-processing by hardware has not been performed, the generation unit 14 performs protocol analysis processing and grouping processing of the packets by software, and then performs processing corresponding to the group to generate packets. Thereafter, the generation unit 14 transmits the generated packets to the analysis device 3.

[0058] For example, the generation unit 14 performs one or more of the following processes to generate packets for analysis corresponding to a group: a process of aggregating statistics on inner headers and generating xFlow packets that include at least statistical information indicating the statistics on the inner headers; a process of aggregating statistics on outer headers and generating xFlow packets that include at least statistical information indicating the statistics on the outer headers; and a process of removing the outer headers and generating (shaping) packets whose destinations have been rewritten to point to the external analysis device 3. Note that the process of generating packets by the generation unit 14 includes a process of generating new packets for analysis and a process of shaping packets for analysis by rewriting or deleting information from input packets.

[0059] Here, the processing flow in the conversion device 10 will be described with reference to Figures 7 and 8. Figures 7 and 8 are diagrams explaining the processing flow in the conversion device 10 shown in Figure 1. Note that in the example of Figure 8, the processing for generating packets for analysis involves aggregating statistics on inner headers and generating xFlow packets that include statistical information indicating the statistics on the inner headers.

[0060] 7, when the hardware of the conversion device 10 receives an input packet, it determines whether the input packet is a non-hardware offload packet, a single-header sample packet that is a target of hardware offloading, or a multi-header sample packet that is a target of hardware offloading (e.g., xFlow). That is, the conversion device 10 analyzes the packet in the front-stage hardware, and analyzes, based on the analysis result, whether the packet is a multi-header sample packet that is a target of front-stage hardware processing (high-speed processing), a single-header sample packet that is a target of front-stage hardware processing, or a packet that is a target of back-stage software processing (low-speed processing).

[0061] For example, when the conversion device 10 performs software processing at the later stage without performing hardware processing at the earlier stage, it performs protocol analysis processing and grouping processing of packets using software as in-software processing, and then performs processing corresponding to the group by aggregating statistics of inner headers and generating xFlow packets that include at least statistical information indicating the statistics of the inner headers.

[0062] At this time, the front-stage hardware of the conversion device 10 determines whether the input packet is a packet carrying multiple header samples based on the variables in the IP header of the xFlow of the input packet ((1) in FIG. 7).

[0063] When the upstream hardware determines that a packet contains multiple header samples, it divides the multiple header samples and reconstructs the packet, working in conjunction with other existing functional units. For example, as shown in Figure 8, the upstream hardware divides and restores a packet containing three header samples, reconstructing it into three single-header sample packets. In this way, by adding a function to reconstruct single-header sample packets to the upstream hardware, no changes are required between the downstream hardware (HW) processing and software (SW) processing ((2) in Figure 8).

[0064] Then, the conversion device 10 performs in-hardware processing on the input packet, which is a single-header sample packet, or the reconstructed single-header sample packet, by grouping based on the information in the header, and performs information shaping processing (such as selecting a chaining destination) to change the source IP address and destination IP address, and then assigns metadata that complies with the rules based on the information in the header that has been identified as the hardware processing part.

[0065] Next, the conversion device 10 performs software processing to identify the metadata added in the hardware processing, determine the processing content using the grouping ID included in the metadata, analyze the inner header, collect statistics on the inner header, and generate an xFlow packet including at least statistical information indicating the statistics on the inner header.

[0066] In this way, based on the analysis results performed by the upstream hardware, the conversion device 10 divides the multiple header samples into a single-header sample packet for a multiple-header sample packet, and then writes metadata including grouping information to the end of the packet.

[0067] The conversion device 10 can achieve hardware-software integration by having the metadata identification process take the place of computationally expensive protocol analysis and grouping processes in the subsequent software stage. The conversion device 10 can omit computationally expensive software protocol analysis by implementing software protocol analysis and grouping processes through hardware metadata assignment and software metadata reading. Therefore, by offloading some processes to hardware, it is possible to reduce the amount of processing required on the software side.

[0068] In the conversion device 10, the hardware in the front stage performs processing that hardware is good at, such as uniform processing, while the software in the back stage performs flexible judgment and complex processing, such as processing based on the internal information of encapsulated packets, thereby reducing the amount of processing on the software side and enabling high-speed processing even for large volumes of traffic. Furthermore, by using hardware to process the division and reconstruction of packets containing multiple header samples, the conversion device 10 can reduce the software processing load, which has a high calculation cost, and enable high-speed processing of large volumes of traffic information.

[0069] [Circuit Architecture] FIG. 9 is a diagram illustrating the circuit architecture of the reconstruction unit 12 shown in FIG. 3. As shown in FIG. 9, the circuit architecture of the reconstruction unit 12 includes a write address calculation and data allocation unit, multiple block RAMs, and a data selection and shaping unit. The block RAMs include a block RAM corresponding to the MAC to IPFIX header section, a block RAM corresponding to sample data, and a block RAM corresponding to each piece of metadata. The header section, sample data, and metadata are stored in the corresponding block RAM. The front-stage hardware reconstructs an IPFIX packet of a single header sample according to the number of samples at the time of output.

[0070] The various information of the input multiple-header sample packet is written to the corresponding Block RAM by the write address calculation and data allocation unit, and the Block RAM records the memory address information ((1) in FIG. 9).

[0071] The write address calculation and data allocation unit sends various information and data addresses for the number of samples to the data selection and formatting unit ((2) in Fig. 9). The write address calculation and data allocation unit sends the address information and the number of multi-samples to the data selection and formatting unit via FIFO (First-In First Out). The data selection and formatting unit reconstructs a single-header sample packet by reading data for the number of samples from each Block RAM according to the received address information and number of multi-samples ((3) in Fig. 9). The circuit architecture in Fig. 9 enables economical data transmission between circuits by exchanging address information instead of the data itself ((4) in Fig. 9).

[0072] 9, the reconstruction unit 12 divides a multi-header sample packet and reconstructs it into a single-header sample packet. This enables the reconstruction unit 12 to process the division of a multi-header sample packet into multiple header samples and the reconstruction into a single-header sample packet using hardware, thereby enabling high-speed processing of large volumes of traffic information.

[0073] [Conversion process procedure] Next, a description will be given of the processing procedure of the packet conversion process executed by the conversion device 10. Fig. 10 is a flowchart showing an example of the processing procedure of the conversion process according to the embodiment.

[0074] As shown in FIG. 10, when the packet analysis unit 11 of the conversion device 10 receives a packet input (step S101: Yes), it analyzes the information of the input packet using hardware and determines whether to perform pre-processing using hardware (step S102).

[0075] As a result, if the packet analysis unit 11 determines that the information of the input packet is to be analyzed by hardware (step S102: Yes), it determines whether the input packet is a multi-header sample packet (step S103).

[0076] If it is a multi-header sample packet (step S103: Yes), the reconstructing unit 12 performs packet reconstruction by dividing the multiple header samples of the multi-header sample packet and reconstructing them into single-header sample packets (step S104).

[0077] If it is determined that the packet is not a multiple-header sample packet (step S103: No), or after the packet analysis unit 11 has reconstructed the packet, the metadata adding unit 13 adds metadata based on the information in the fixed-length header of the single-header sample packet (step S105). Subsequently, the generating unit 14 identifies the metadata by software (step S106), and generates an analysis packet by software according to the grouping ID included in the metadata (step S109).

[0078] Furthermore, in step S102, if the packet analysis unit 11 determines that the information of the input packet is not to be analyzed by hardware (step S102: No), the generation unit 14 performs protocol processing by software (step S107) and performs grouping processing by software (step S108). Subsequently, the generation unit 14 generates an analysis packet by software according to the grouping result (step S109).

[0079] [Effects of the embodiment] FIG. 11 is a diagram illustrating a conventional conversion technology. As shown in FIG. 11, in the conventional conversion technology, when a multi-header sample packet is received, the packet is treated as a packet not subject to hardware offloading, and format conversion is performed by performing software processing. As described above, in the conventional conversion technology, since the multi-header sample packet is not subject to hardware offloading, software processing, which requires high computational costs, is required, resulting in increased computational costs. For this reason, in the conventional conversion technology, it is difficult to process large volumes of traffic information contained in multi-header sample packets at high speed using software.

[0080] In contrast, the conversion device 10 according to the embodiment analyzes information about an input packet using hardware, determines whether to perform predetermined pre-processing using the hardware, and determines whether the packet to be processed using hardware is a multi-header sample packet or a single-header sample packet. If the conversion device 10 determines to perform pre-processing and determines that the packet is a multi-header sample packet, it divides the multiple header samples of the multi-header sample packet using hardware and reconstructs it into a single-header sample packet.

[0081] For single-header sample packets determined to undergo pre-processing or reconstructed single-header sample packets, the conversion device 10 performs a process of assigning metadata containing identification information indicating the packet group to the packets based on the information in the fixed-length header of the packets.The conversion device 10 then performs a process of generating analysis packets corresponding to the packet group using the assigned metadata using software.This allows the conversion device 10 to perform flexible processing that differs depending on the attributes of the service provider, etc., at high speed.

[0082] That is, the conversion device 10 writes the analysis results, including grouping information, performed by the upstream hardware to the end of the packet. Then, the conversion device 10 performs metadata identification processing in place of protocol analysis and grouping processing in the downstream software, enabling hardware and software to work together.

[0083] Furthermore, when the conversion device 10 receives a packet containing multiple header samples, it can reduce the software processing load, which has a high calculation cost, by dividing and reconstructing the multiple header samples using hardware.

[0084] In this way, the conversion device 10 can process large volumes of traffic information at high speed by reducing the amount of processing on the software side.

[0085] [System configuration of the embodiment] 1 are functional concepts and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of the functions of conversion device 10 is not limited to that shown, and all or part of the functions can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0086] Furthermore, all or any part of the processes performed by the conversion device 10 may be realized by a CPU and a program analyzed and executed by the CPU. Furthermore, each process performed by the conversion device 10 may be realized as hardware using wired logic.

[0087] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the process procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0088] [program] 12 is a diagram showing an example of a computer in which a program is executed to realize the conversion device 10. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0089] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0090] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the conversion device 10 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the conversion device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0091] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0092] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0093] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that are made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0094] 1. Communication Systems 2 NW device 3 Analyzer 10. Conversion Device 11 Packet analysis unit 12 Reconstruction part 13 Metadata assignment section 14 Generation part 15 Rules Information DB

Claims

1. an analysis unit that analyzes information on an input packet by hardware, determines whether or not predetermined pre-processing by the hardware is to be performed, and determines whether the packet that undergoes the predetermined pre-processing by the hardware is a packet carrying multiple header samples or a packet carrying a single header sample; a reconstructing unit that reconstructs the packet carrying the plurality of header samples into a packet carrying a single header sample; an assigning unit that performs, by the hardware, a process of assigning metadata to a packet having a single header sample determined by the analyzing unit or a packet having a single header sample reconstructed by the reconstructing unit, the metadata including identification information that indicates a group of the packet, based on information in a fixed-length header of the packet having the single header sample; a generating unit that performs a process of generating a packet for analysis corresponding to the group of packets by using the metadata added by the adding unit, using software; A conversion device comprising:

2. The conversion device according to claim 1, characterized in that the reconstruction unit divides the packet containing the plurality of header samples into a header portion and each data portion, and reconstructs the packet containing the single header sample according to the number of data.

3. the analysis unit identifies a hardware processing portion and a software processing portion in the packet; The conversion device described in claim 1, characterized in that the adding unit acquires information in the header identified by the analysis unit as a hardware processing part, performs grouping based on the information in the header to determine the identification information, and adds metadata including the identification information to the packet using the hardware.

4. A conversion method executed by a conversion device, an analysis step of analyzing information on an input packet by hardware, determining whether or not predetermined pre-processing by the hardware is to be performed, and determining whether the packet is a packet having a plurality of header samples or a packet having a single header sample; a reassembly step of reassembling the packets carrying the multiple header samples into packets carrying a single header sample; an adding step of adding, by the hardware, metadata including identification information indicating a group of a packet, to a packet having a single header sample determined in the analyzing step or a packet having a single header sample reconstructed in the reconstructing step, based on information in a fixed-length header of the packet having the single header sample; a generating step of performing a process of generating, by software, a packet for analysis corresponding to the group of packets using the metadata added by the adding step; A method for converting a material comprising:

5. an analyzing step of analyzing information of an input packet by hardware, determining whether or not predetermined pre-processing by the hardware is to be performed, and determining whether the packet is a packet having a plurality of header samples or a packet having a single header sample; a reassembly step of reassembling the packets carrying the multiple header samples into packets carrying a single header sample; an adding step of adding, by the hardware, metadata including identification information indicating a group of a packet, to a packet having a single header sample determined in the analyzing step or a packet having a single header sample reconstructed in the reconstructing step, based on information in a fixed-length header of the packet having the single header sample; a generating step of performing a process of generating, by software, a packet for analysis corresponding to the group of packets using the metadata added by the adding step; A conversion program that allows a computer to execute the above.

Images