Traffic information analysis method, device therefor, and traffic monitoring system

Abstract

This traffic information analysis method comprises: a step for referring to an active plane (112_2) of a rule table (112) that has a standby plane (112_1) and the active plane (112_2) and extracting a packet to be monitored from received packets; a step for counting the statistical information of the extracted packets to a write plane, switching between a write-plane counter and a read-plane counter on a prescribed cycle; and a step for reading, from the read plane on a prescribed cycle, and recording the counted statistical information. When a new rule read from a rule file is nonexistent on the active plane when updating rules, a new rule number is assigned to the new rule and the new rule is written to the standby plane, with the standby plane and the active plane being switched at the same time the write-plane counter and the read-plane counter are switched after a write of the new rule to the standby plane is completed.　Thus, the present invention can provide a traffic information analysis method with which it is possible to accurately grasp the packet-receiving condition.

Description

[Technical Field]

[0001] The present invention relates to a traffic information analysis device for monitoring transmitted and received packets, a traffic monitoring system, a method for registering a rule for identifying packets to be monitored, and a traffic information analysis method. [Background technology]

[0002] In recent years, with the development of the Internet, the amount of communication traffic has increased, making traffic monitoring important.

[0003] In the case of packet transmission and reception, the traffic system counts packets for each rule after receiving the packets according to the result of matching with the monitoring target specific rule. Here, when a packet from a specified address is received according to the monitoring target specific rule (hereinafter referred to as "rule"), the number of packets is counted for each rule.

[0004] In a traffic monitoring system, multiple rules are written in a rule table. Statistical information on received packets that match each rule is counted for a certain period of time for each rule. The counting results are read out and recorded at a predetermined interval (reading interval).

[0005] To receive packets, check whether they match rules, and count them without missing any of the frequently arriving packets, hardware that takes advantage of the parallelism of circuits to perform parallel calculations is suitable because it can perform calculations at high speed.In addition, software performs processes that are not dependent on the frequency of packet arrival, such as accepting commands from outside, outputting statistical information to files, and notifying the status of the traffic monitoring system.

[0006] As shown in FIG. 6, the traffic monitoring system 30 includes a receiving unit 33 that receives packets, a rule table 312, a rule registration unit 311, a monitoring target extraction unit 313, a statistical information collection unit 314 that counts statistical information of received packets of the monitoring target for a certain period of time, and a statistical information recording unit 315 that reads and records the statistical information at each read cycle.

[0007] The rule table 312 is divided into sections for each rule, and each section is managed by an address.

[0008] The rule registration unit 311 registers rules in the rule table 312. In detail, when the traffic monitoring system 30 is started, a different address is assigned to each rule read by the user from a rule file stored in advance in the rule file storage unit in the traffic monitoring system 30, and each rule is written in the assigned section in the rule table, and the rule and the address are recorded in association with each other.

[0009] The monitoring target extraction unit 313 determines whether a received packet matches a rule listed in the rule table 312, and extracts the matching packet as a monitoring target. When a received packet matches a rule listed in the rule table 312, it outputs a monitoring target extraction notice indicating which address the rule matches, along with the packet length information of the packet, to the statistical information collection unit. The monitoring target extraction notice is, for example, a match flag for each address if there is a possibility that the packet may match multiple rules simultaneously. Alternatively, for example, if there is no possibility that the packet may match multiple rules simultaneously, it is a match flag common to all addresses and the matched address number.

[0010] The statistical information collection unit 314 has two sides of counters that are uniquely associated with addresses for each type of statistical information (for example, the number of received packets and the number of received bytes), with one side assigned to the write side and the other assigned to the read side. The reason for having two sides of counters is to allow all types of counters for all addresses to start and close simultaneously.

[0011] The statistical information of the extracted packets is counted by the counter of the write side corresponding to the address notified by the monitoring target extraction unit 313. After outputting the statistical information of the counter of the read side to the statistical information recording unit, the counter of the read side is reset, and at each read cycle, setting information indicating which of the two sides is the write side or the read side is updated, and the roles of the two sides are instantly exchanged, so that the counter that had previously treated the counter as the write side will thereafter treat it as the read side, and the counter that had previously treated the counter as the read side will thereafter treat it as the write side, thereby switching between the counter of the write side and the counter of the read side. In this way, the counters of the two sides are alternately switched between the write side and the read side to perform counting.

[0012] The statistical information recording unit 315 reads all statistical information from the read side counter of the statistical information collecting unit 314 at predetermined intervals (read cycles), and records each address paired with the statistical information for that address so that the time can be determined. For example, as shown in Fig. 7, for each address, the time, address, rule content, and statistical information are compiled into one tab-delimited line and added to one statistical information file.

[0013] The statistical information file can be retrieved from the traffic monitoring system 30 via the external IF unit and used for analysis, or the visualization unit 34 can display it in the form of a line graph or the like showing the time-varying statistical information of received packets that match the rules for each address. [Prior art documents] [Patent documents]

[0014] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-246116 Summary of the Invention [Problem to be solved by the invention]

[0015] Since the rules for identifying packets to be monitored may change as traffic changes, it is desirable to update the rule table simultaneously with the collection of statistical information.

[0016] The rule table is updated by storing a new rule file in the traffic monitoring system and writing each rule read from the rule file into each section in the rule table when an external command to update the rule table is received.

[0017] However, as shown in Figure 8, when updating the rule table, if a rule is deleted (for example, rules A, B, and C in Figure 8), added (for example, rules E and F in Figure 8), or if the address is changed even though the rule continues to be used (for example, rule D in Figure 8), it is possible that different rules will be written to the same address before and after updating the rule table.

[0018] In conventional traffic monitoring systems, statistical information is read from the counter corresponding to each address and recorded in a statistical information file in pairs with the address. As a result, a graph showing the time variation of statistical information for received packets created based on this statistical information file will contain statistical information for packets based on different rules before and after the rule table update, as shown in Figure 9.

[0019] For example, at address 1, packets are extracted using rule A before the update, and packets are extracted using rule D after the update. As a result, packets using different rules are counted using the same counter before and after the update, and the number of packets observed (counted) changes discontinuously. Similarly, at addresses 2 and 3, the number of packets observed (counted) changes discontinuously.

[0020] On the other hand, if we look at rule D, even if packets that match rule D are received continuously before and after the update, the address changes from 4 to 1 before and after the update, so they are counted as packets of a different rule before and after the update. As a result, in Figure 9, the 10 points in the second column from the top should actually be connected by a single bend, but there is a break at the fifth point from the left in the second column from the top. This shows that even though packets of the same rule continue to arrive, they are observed (counted) as if they had stopped arriving after the update.

[0021] As described above, in conventional traffic monitoring systems, it is not possible to accurately grasp the packet reception status from statistical information (number of received packets) of counted received packets.

[0022] Furthermore, the traffic analysis device disclosed in Patent Document 1 adds and deletes entries (corresponding to rules) limited to RTP packets, and simultaneously counts received packets that hit the entries.

[0023] However, this traffic analysis device does not assume that statistical information will be visualized in a line graph or the like, and therefore does not take into account the continuity of count values ​​before and after the addition or deletion of an entry. [Means for solving the problem]

[0024] In order to solve the above-mentioned problems, a traffic information analysis method according to the present invention includes: A traffic information analysis method executed by a traffic information analysis device,The method includes the steps of: extracting packets to be monitored from received packets by referring to rules registered in the working plane of a rule table having a standby plane and a working plane; counting statistical information for each rule of the extracted packets to be monitored on the write plane by switching between a counter on the write plane and a counter on the read plane at a predetermined cycle; reading and recording the counted statistical information from the read plane at the predetermined cycle; reading a new rule from a rule file when updating the rule; assigning, when the new rule is not in the working plane, a rule number to the new rule that is different from rule numbers already assigned to other rules; assigning, when the new rule is registered in the working plane, the same rule number as the rule number assigned to the same rule registered in the working plane; writing the new rule to the standby plane; and, after writing of the new rule to the standby plane is completed, switching between the standby plane and the working plane at the same time as switching between the counter on the write plane and the counter on the read plane.

[0025] A traffic information analysis device according to the present invention includes a rule registration unit that reads rules from a rule file, a rule table in which the rules and information linked to the rules are written, a monitoring target extraction unit that extracts monitoring target packets from received packets by referring to the rules registered in the rule table, a statistical information collection unit that counts statistical information for each rule of the monitoring target packets on the write side by switching between a counter on a write side and a counter on a read side at a predetermined cycle, and a statistical information recording unit that reads out and records the statistical information from the read side at a predetermined cycle, wherein the rule table has a standby side and a working side, and the rules and information linked to the rules are written on the standby side. ,beforeWhen updating the rule, the rule registration unit reads a new rule from a rule file, and if the new rule is not in the active plane, assigns a rule number to the new rule that is different from the rule number assigned to the registered rule, writes the rule to the standby plane, and the new rule is updated in the active plane. On the surface When the rule is registered, the new rule is assigned the same rule number as the rule number assigned to the same rule registered in the current plane, and is written to the standby plane. After the writing of the new rule to the standby side is completed, the standby side and the active side are switched at the same time when the counter of the write side and the counter of the read side are switched. It is characterized by: [Effects of the Invention]

[0026] According to the present invention, it is possible to provide a traffic information analysis method, an apparatus for the same, and a traffic monitoring system that can accurately grasp the packet reception status from the counted received packet statistical information even if the monitoring target identification rule is changed during traffic monitoring. [Brief explanation of the drawings]

[0027] [Figure 1] FIG. 1 is a block diagram showing the configuration of a traffic monitoring system according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a diagram for explaining the operation of the traffic information analysis device according to the first embodiment of the present invention. [Figure 3A] FIG. 3A is a flowchart illustrating a traffic information analysis method and a rule update method according to the first embodiment of the present invention. [Figure 3B] FIG. 3B is a flowchart illustrating the traffic information analysis method and the rule update method according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a diagram for explaining the operation of the traffic information analysis device according to the first embodiment of the present invention. [Figure 5] FIG. 5 is a diagram for explaining the operation of the traffic information analysis device according to the first embodiment of the present invention. [Figure 6] FIG. 6 is a block diagram showing the configuration of a conventional traffic monitoring system. [Figure 7] FIG. 7 is a diagram for explaining the operation of a conventional traffic information analysis device. [Figure 8] FIG. 8 is a diagram for explaining the operation of a conventional traffic information analysis device. [Figure 9] FIG. 9 is a diagram for explaining the operation of a conventional traffic information analysis device. DETAILED DESCRIPTION OF THE INVENTION

[0028] First Embodiment A traffic information analysis device, a method thereof, and a traffic monitoring system according to a first embodiment of the present invention will be described with reference to FIGS.

[0029] <Configuration of traffic information analyzer and traffic monitoring system> In the traffic monitoring system 10, as shown in FIG. 1, the traffic information analysis device 11 includes a rule registration unit 111, a rule table 112, a monitoring target extraction unit 113, a statistical information collection unit 114, a statistical information recording unit 115, and a control unit 16.

[0030] In addition, the traffic monitoring system 10 includes a rule file storage unit 12, a receiving unit 13, a visualization unit 14, and a user interface (IF) unit 15.

[0031] In the traffic monitoring system 10, the rule registration unit 111 reads a rule file from an externally stored rule file in the rule file storage unit 12, and registers the rule in the rule table 112 (standby plane rule table 112_1).

[0032] The receiving unit 13 receives the packet via the network tap 1 .

[0033] The monitoring target extraction unit 113 refers to a rule table (current plane rule table) to determine whether the received packet matches the rule, and extracts the matching packet as a monitoring target. For example, here, the monitoring target extraction unit 113 acquires a packet from the receiving unit from which the PHY header has been removed. As with the conventional monitoring target extraction unit 313, it outputs a monitoring target extraction notification, etc. to the statistical information collection unit 114.

[0034] The statistical information collection unit 114 counts statistical information (such as the number of received packets for each rule) of the extracted received packets to be monitored. As with the conventional statistical information collection unit 314, counting is performed using a counter on the writing surface.

[0035] The statistical information recording unit 115 reads and records the counted statistical information (such as the number of received packets) at a predetermined cycle. At this time, it records the information linking the rule, address, and rule number obtained from the rule registration unit. Except for recording the rule number, it is the same as the conventional statistical information recording unit 315.

[0036] Finally, the visualization unit 14 displays the recorded statistical information in the form of a graph, a table, or the like.

[0037] Additionally, a user interface (IF) unit 15 receives various commands from the outside, and a control unit 16 controls the registration and updating of the rule table.

[0038] <Operation of the traffic information analyzer> The operation of the traffic information analysis device 11 will be explained for each of its main components with reference to FIGS.

[0039] The rule table consists of two tables: a current rule table and a standby rule table.

[0040] If there is only one page of the rule table, there may be a temporary mixture of rules before and after the update or duplicate entries of the same rule between the start and end of writing, which can be problematic.

[0041] For example, if you update from state 21 to state 23 in Figure 2 on only one side, the rules are written sequentially during the update, so when you write rule D at address 1, rule D will temporarily remain at address 4, resulting in duplicate entries of the same rule.

[0042] Therefore, two rule tables are provided, and the setting information indicating which of the two sides is the active side and which is the standby side is updated, so that the rule table that previously treated the active side as the standby side will now treat it as the standby side, and the rule table that previously treated the standby side as the active side will now treat it as the active side, and the roles of the two sides are instantly swapped. The rule tables for each side have the same structure, and are divided into sections each containing one rule, and each section is managed by address. As a result, it is possible to avoid mixing rules before and after the update, or duplicate entries of the same rule.

[0043] When the traffic monitoring system is started, the rule registration unit first reads rules from a rule file that has been placed in the traffic monitoring system by the user in advance (S11, not shown). For example, let us say that the rule file has rule A on the first line, rule B on the second line, rule C on the third line, and rule D on the fourth line, all written in text format.

[0044] Next, a different address and a different rule number are assigned to each rule, and each rule is written into a section of the current rule table with the assigned address, and the rule, address, and rule number are linked and recorded as linked information (for example, format 22 in FIG. 2) (S12, not shown). Here, one section refers to, for example, one line consisting of one rule in format 21.

[0045] Next, if there is an external command to update the rule table, rules are read from the rule file (S13-S14). At this time, rules are read from a rule file that has been placed in the traffic monitoring system in advance by the user. For example, let us say that the rule file has rule D on the first line, rule E on the second line, and rule F on the third line, written in text format.

[0046] Next, a different address is assigned to each rule, and a rule number is assigned.

[0047] At this time, the same rule numbers are continuously assigned to rules that continue to exist before and after the rule table update (S15_1 to S16_2).

[0048] On the other hand, a (new) rule number that has not been assigned to any rule is assigned to a newly added rule (S15_1 to S16_1).

[0049] Next, each rule, address, and rule number are linked and stored as linking information (e.g., format 24 in Figure 2) in the rule update unit (S17_1), and the rule is written into the assigned section in the standby plane rule table (e.g., format 23 in Figure 2) (S17_2).

[0050] When all writing to the standby side rule table is completed, the active side and standby side are switched at the same time as the counter's write side and read side are switched (S18). Here, the switching between the active side and standby side is performed by updating the setting information indicating which of the two sides is the active side and which is the standby side, and instantaneously exchanging the roles of the two sides so that the rule table that has been treated as the active side will be treated as the standby side from now on, and the rule table that has been treated as the standby side will be treated as the active side from now on.

[0051] In order to prevent the statistical information of packets that match different rules from being mixed in one counter, the counter switches between the working and standby sides at the same time as it switches between the writing and reading sides.In addition, information linking rules, addresses, and rule numbers is also recorded for both the working side rule table and the standby side rule table.

[0052] As described above, rules for identifying packets to be monitored are registered in the rule table and the rules are updated. Of the above-mentioned methods S11 to S18 for updating rules for identifying packets to be monitored, steps S13 to S18 are shown in the flowcharts of Figures 3A and 3B.

[0053] Thereafter, the monitoring target extraction unit refers to the rule table (current plane rule table), and when the received packet matches a rule written in the rule table, it extracts it as a monitoring target packet (S21 to S23). Here, a monitoring target extraction notice indicating which address rule the packet matches is output to the statistical information collection unit together with the packet length information of the packet.

[0054] The monitoring target extraction notification may be, for example, a match flag for each address if the packet may match multiple rules simultaneously, or, for example, a match flag common to all addresses and the matched address number if the packet may not match multiple rules simultaneously.

[0055] The statistical information collection unit has two sides of counters that uniquely correspond to addresses for each type of statistical information (for example, the number of received packets and the number of received bytes), with one side assigned to the write side and the other assigned to the read side. The reason for having two sides of counters is to allow all types of counters for all addresses to start and close at the same time.

[0056] The counter for the write side corresponding to the address notified by the monitoring target extraction unit counts statistical information of the extracted packets (S24). When a predetermined period arrives, the setting information indicating which of the two sides is the write side or the read side is updated, and the counter that had previously treated the write side is now treated as the read side, and the counter that had previously treated the read side is now treated as the write side, and the roles of the two sides are instantly swapped, switching the counter for the write side and the counter for the read side (S25, S28). Before and after the switch, the statistical information collection unit continues counting statistical information without interruption, counting the current write side. When the write side and read side of the counter are switched, the statistical information recording unit reads the statistical information from the counter for the read side and then resets the counter for the read side (S26, S27). In this way, the counters for the two sides are alternately switched between the write side and the read side to perform counting.

[0057] When the counter's write and read sides are switched at a predetermined cycle (read cycle), the statistical information recording unit reads all statistical information from the read side counter in the statistical information collecting unit, pairs the rule number associated with each address with the statistical information for that address, and records it so that the time can be determined.For example, as shown in Figure 4, for each address, the time, rule number, rule content, and statistical information are compiled on one tab-delimited line and added to one statistical information file.

[0058] In this way, the traffic information analysis device can determine which rule the statistical information of the received packet matched before and after the rule table update, based on the recorded rule number. The flowcharts in Figures 3A and 3B show the traffic information analysis method, including the above-mentioned registration method.

[0059] If this statistical information file is used to determine whether the statistical information is for the same rule by using the rule number and visualize it, as shown in Figure 5, before and after the rule table update, the statistical information of packets that match different rules will not be plotted differently in a series of plots (for example, lines in a line graph), and the statistical information of packets that match the same rule will not be represented in different plots (for example, lines in a line graph), but rather the statistical information of packets that match the same rule will be represented in the same series of plots.

[0060] According to the traffic information analysis device, method, and traffic monitoring system of this embodiment, the rule table can be updated without interruption while statistical information is collected, and it is possible to determine which rule the statistical information of a received packet matches before and after the rule table update.

[0061] Therefore, according to the traffic information analysis device, the method thereof, and the traffic monitoring system of the present embodiment, it is possible to accurately grasp the transition of the number of received packets and the number of received bytes for each period.

[0062] <Second embodiment> Next, a traffic information analysis device, a method thereof, and a traffic monitoring system according to a second embodiment of the present invention will be described.

[0063] <Configuration of traffic information analyzer> The traffic information analysis device according to this embodiment includes an empty rule number list in addition to the configuration of the first embodiment.

[0064] In the traffic information analysis device according to the first embodiment, when different rule numbers are assigned to each rule, they can be assigned in ascending order at first, but since the range of rule numbers is finite, once the maximum possible rule number has been assigned, the rule numbers released from deleted rules are reused.

[0065] One example is to check whether a rule number is assigned to any rule, starting with the smallest possible value, and then assign it if an unassigned rule number is found. However, this method results in concentrated assignment of rule numbers close to the smallest value, and there is a possibility that a rule number will be assigned to another rule immediately after being released, which can lead to confusion between rule numbers before and after the update.

[0066] In the traffic information analysis device according to this embodiment, the range of rule numbers that can be set is set to be much wider than the number of rules that can be recorded in the rule table. The free rule number list can record all rule numbers and is a first-in, first-out system. Rule numbers that are not assigned to any rule are recorded in this free rule number list.

[0067] In the initial state, all rule numbers are placed in the free rule number list. Newly added rules are assigned rule numbers taken from the top of the free rule number list, and rule numbers released from deleted rules are placed at the end of the free rule number list.

[0068] For example, if a rule table can contain up to 1000 rules and the rule number range is 0001 to 9999, the free rule number list will contain at least 8999 rule numbers, and the next time a rule number that has been released and stored at the end of the free rule number list is retrieved, at least 8999 new rules will have been added.

[0069] In this way, according to the traffic information analysis device, the method thereof, and the traffic monitoring system of the present embodiment, a rule number is not assigned to another rule immediately after being released.

[0070] <Third embodiment> Next, a traffic information analysis device, a method thereof, and a traffic monitoring system according to a third embodiment of the present invention will be described.

[0071] <Configuration of traffic information analyzer> The traffic information analysis device according to this embodiment converts a rule using a conversion formula to calculate a rule number.

[0072] In the second embodiment, since an empty rule number list is used, it is necessary to write all rule numbers into the empty rule number list in the initial state, which takes time to start up the traffic monitoring system.

[0073] In the traffic information analysis device according to this embodiment, a rule is converted based on a conversion formula that does not cause overlapping of output values ​​for different input values, and a rule number is calculated.

[0074] As a result, it is possible to assign a different rule number to each rule without using a free rule number list. For example, a hash function with a long hash length may be used as the transformation formula without changing the seed value.

[0075] According to the traffic information analysis device, the method thereof, and the traffic monitoring system of the present embodiment, the time required to start up the traffic monitoring system can be reduced.

[0076] However, in this embodiment, it cannot be said that there is no possibility of a hash collision occurring, and in that case, the same rule number will be assigned to different rules. Therefore, if the calculated rule number has already been assigned to another rule, that is, if a hash collision occurs and rule numbers collide, the rule registration unit can avoid assigning the same rule number to different rules by using a different conversion formula or a different seed value to recalculate the rule numbers for all rules from the beginning if the traffic monitoring system is started. Alternatively, for rules with colliding rule numbers, no rule numbers or addresses may be assigned and they may not be written in the rule table, thereby avoiding assigning the same rule number to different rules.

[0077] Furthermore, if a rule number conflict occurs when updating the rule table, the rule table update can be stopped to avoid assigning the same rule number to different rules. Alternatively, the rule with the conflicting rule number can be prevented from being assigned a rule number or address and written to the rule table, thereby avoiding the assignment of the same rule number to different rules.

[0078] In the embodiments of the present invention, examples of the structure, dimensions, materials, etc. of each component in the configuration and method of the traffic monitoring system are shown, but the present invention is not limited to these. Any configuration that exhibits the function and effect of the traffic monitoring system configuration may be used. [Industrial Applicability]

[0079] The present invention relates to a traffic information analysis method, an apparatus therefor, and a traffic monitoring system, and can be applied to a communication system that transmits and receives packets. [Explanation of symbols]

[0080] 112 Rules Table 112_1 Standby side 112_2 Current surface

Claims

1. A traffic information analysis method executed by a traffic information analysis device, comprising: extracting a packet to be monitored from the received packet by referring to a rule registered in the working plane of a rule table having a standby plane and a working plane; counting the extracted statistical information for each rule of the packets to be monitored on the writing side by switching between a counter on the writing side and a counter on the reading side at a predetermined cycle; reading out and recording the counted statistical information from the readout surface at the predetermined period; When updating the rules, reading new rules from a rule file; assigning a rule number to the new rule that is different from rule numbers already assigned to other rules when the new rule is not in the current plane; when the new rule is registered in the current plane, assigning to the new rule the same rule number as the rule number assigned to the same rule registered in the current plane; a step of writing the new rule to the standby side; and a step of switching between the standby side and the active side at the same time as switching between the counter of the write side and the counter of the read side after the writing of the new rule to the standby side is completed. A traffic information analysis method comprising:

2. selecting the new rule number from a list of free rule numbers; adding a rule number released by deleting a rule to the free rule number list; The free rule number list is first-in, first-out 2. The traffic information analysis method according to claim 1.

3. a step of calculating the new rule number using a conversion formula 2. The traffic information analysis method according to claim 1.

4. a rule registration unit that reads rules from a rule file; a rule table in which the rules and information associated with the rules are written; a monitoring target extraction unit that extracts monitoring target packets from received packets by referring to the rules registered in the rule table; a statistical information collection unit that counts statistical information for each rule of the packets to be monitored on the writing side by switching between a counter on the writing side and a counter on the reading side at a predetermined cycle; a statistical information recording unit that reads out the statistical information from the read surface at a predetermined cycle and records it; Equipped with the rule table has a standby plane and a current plane, the rule and information associated with the rule are written on the waiting surface; When updating the rule, the rule registration unit reads a new rule from a rule file, and when the new rule is not present in the current plane, assigns a rule number to the new rule that is different from the rule number assigned to the registered rule, and writes the rule to the standby plane; When the new rule is registered in the current plane, the same rule number as that assigned to the same rule registered in the current plane is assigned to the new rule, and the new rule is written in the standby plane; After the writing of the new rule to the standby side is completed, the standby side and the active side are switched at the same time when the counter of the write side and the counter of the read side are switched. A traffic information analysis device characterized by:

5. When the new rule is registered in the standby plane, writing to the standby plane is skipped.

5. The traffic information analysis device according to claim 4.

6. a free rule number list in which rule numbers not assigned to the rules are recorded; The new rule number is selected from the free rule number list, and the rule number released when a rule is deleted is added to the free rule number list, and the free rule number list is a first-in, first-out list.

5. The traffic information analysis device according to claim 4.

7. The new rule number is calculated by a conversion formula.

6. The traffic information analysis device according to claim 5.

8. The traffic information analysis device according to any one of claims 4 to 7 Equipped with a traffic monitoring system.

Images