Traffic monitoring device and traffic monitoring program

Abstract

A traffic monitoring device (10) is provided with an information processing unit (20) which is configured to acquire traffic statistical information of a flow in a network to be monitored, and to determine whether the acquired traffic statistical information satisfies predetermined criteria for failure detection, and a packet capture unit (30) configured to capture a packet of the flow determined as satisfying the predetermined criteria as a packet at the time of failure occurrence of the flow. The information processing unit is configured to dynamically update the predetermined criteria during operation of the information processing unit. According to such a configuration, it is possible to accurately capture the packet at the time of failure occurrence.

Description

[Technical Field]

[0001] The present invention relates to a technique for monitoring traffic in a network. [Background technology]

[0002] Traffic monitoring devices are known that can monitor traffic statistics (traffic volume, etc.) of flows (a collection of packets with the same rules identified by source or destination addresses such as MAC addresses or IP addresses) in real time and, when a fault occurs, capture packets of the relevant flow to analyze the cause. Such devices are used, for example, in services that use virtual machines (VMs) in line with advances in virtualization technology in NFV (Network Functions Virtualization) / SDN (Software Defined Networking).

[0003] When the traffic volume of a specific flow suddenly increases, it is desirable to be able to capture packets of the target flow immediately after the sudden increase in traffic volume in order to identify the cause, and a method has been proposed in which a flow is specified and capture is started (Non-Patent Document 1). In this method, the traffic volume is compared with a threshold value and a fault occurrence is reported. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] "Virtual Network Monitoring System with Packet Capture Function Using Hardware Accelerator (HWA)" Business Communication 2021 vol.58 No.5 Summary of the Invention [Problem to be solved by the invention]

[0005] Even under normal circumstances, traffic volume fluctuates depending on the time of day. For example, traffic volume may increase in the evening. However, the technology in Non-Patent Document 1 uses a fixed threshold value, which makes it unable to respond to normal fluctuations in traffic volume, resulting in false detection of faults or failures not being detected.

[0006] An object of the present invention is to accurately capture packets when a failure occurs. [Means for solving the problem]

[0007] In order to solve the above problems, the traffic monitoring device of the present invention is a traffic monitoring device that monitors traffic in a monitored network, and is equipped with an information processing unit configured to acquire traffic statistical information of flows in the monitored network and determine whether the acquired traffic statistical information satisfies predetermined criteria for fault detection, and a packet capture unit configured to capture packets of the flows that are determined to satisfy the predetermined criteria as packets when a fault occurs in the flow, and the information processing unit is configured to dynamically update the predetermined criteria while the information processing unit is operating.

[0008] In order to solve the above problem, the traffic monitoring program of the present invention causes a computer that monitors traffic in a monitored network to execute an information processing step of acquiring traffic statistical information of flows in the monitored network and determining whether the acquired traffic statistical information satisfies predetermined criteria for fault detection, and a packet capture step of capturing packets of the flows that are determined to satisfy the predetermined criteria as packets when a fault occurs in the flow, and the information processing step includes a step of dynamically updating the predetermined criteria while the information processing unit is operating. [Effects of the Invention]

[0009] According to the present invention, packets can be captured with high accuracy when a failure occurs. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing the configuration of a traffic monitoring device according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a graph for explaining changes in traffic volume, the upper threshold, and the lower threshold. [Figure 3] FIG. 3 is a block diagram showing the configuration of a traffic monitoring device according to the second embodiment of the present invention. [Figure 4] FIG. 4 is a flowchart of the threshold determination process. [Figure 5] FIG. 5 is a diagram for explaining a method for calculating the upper and lower thresholds. [Figure 6] FIG. 6 is a diagram for explaining a method for calculating the upper and lower thresholds. [Figure 7] FIG. 7 is a diagram for explaining a method for calculating the upper and lower thresholds. [Figure 8] FIG. 8 is a block diagram showing the configuration of a traffic monitoring device according to the third embodiment of the present invention. [Figure 9] FIG. 9 is a hardware configuration diagram of a traffic monitoring device according to the first to third embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings, but the present invention is not limited to the following embodiments.

[0012] First Embodiment 1, a traffic monitoring device 10 according to a first embodiment of the present invention receives mirrored packets as input packets, which are copies of packets transmitted and received in a monitored network 80. The traffic monitoring device 10 monitors the traffic for each flow in the monitored network 80 based on the input packets. A flow here refers to a set of packets that have the same value in at least one of the fields indicating the source or destination.

[0013] 1, the traffic monitoring device 10 includes an information processing unit 20, a packet capture unit 30, and a time source 40. An input packet is input to both the information processing unit 20 and the packet capture unit 30. The traffic monitoring device 10 is made up of a computer or the like, and operates as the information processing unit 20 and the packet capture unit 30 by a processor such as a CPU of the computer executing a program. The time source 40 is made up of a real-time clock or the like.

[0014] The information processing unit 20 includes a packet analysis unit 21, a flow identification unit 22, a statistics unit 23, a statistical information file generation unit 24, a storage unit 25, an automatic fault detection unit 26, a threshold update unit 27, and a rule table 29.

[0015] The packet analysis unit 21 analyzes input packets input from the monitored network 80. Through this analysis, the packet analysis unit 21 extracts header information contained in the input packet that is necessary for identifying the flow of the input packet. The extracted header information is information that can be compared for matches or mismatches with rules defined in a rule table 29, which will be described later. Examples of this header information and rules include source / destination MAC addresses and source / destination IP addresses, source / destination port numbers, or protocol types.

[0016] The flow identification unit 22 identifies the flow of the input packet based on the header extracted by the packet analysis unit 21. The flow identification unit 22 refers to a rule table 29 that records rules corresponding to the flow. The rule table 29 stores, for each flow, a registration number n of the flow, the above-mentioned rule for identifying the flow, a capture flag indicating whether or not packets of the flow should be captured, and an upper threshold UTHn and a lower threshold LTHn for determining whether or not a failure has occurred in the flow, all of which are associated with each other. Here, n is an integer from 1 to N, and N is the number of flows registered in the rule table 29 (the same applies hereinafter for n). The packet capture flag indicates capture when it is "1" and indicates no capture when it is "0". The flow identification unit 22 refers to the rule table 29 and obtains the registration number n and the value of the capture flag corresponding to the rule that matches the information in the header. The flow of the input packet is identified by obtaining the registration number n.

[0017] The flow identification unit 22 outputs the acquired value of the capture flag to the packet capture unit 30. As will be described in detail later, if the capture flag is "1", the packet capture unit 30 captures the corresponding input packet. Furthermore, the flow identification unit 22 outputs the acquired registration number n together with the input packet to the statistics unit 23. If the flow identification unit 22 is unable to acquire the registration number n by referring to the rule table 29, it outputs the number of packets or the amount of data (number of bytes, etc.) to the statistics unit 23 as an unregistered flow.

[0018] The statistics unit 23 counts the number of packets or the amount of data (number of bytes, etc.) of input packets for each registration number n, that is, for each flow, based on the registration number n and input packets from the flow identification unit 22. The statistics unit 23 performs counting each time a registration number n and input packet is input from the flow identification unit 22. From this counting, the statistics unit 23 obtains the traffic volume, which is traffic statistical information that represents the traffic state of that flow. Here, the traffic volume is the number of packets or the amount of data per unit time. The statistics unit 23 also counts the number of packets or the amount of data (number of bytes, etc.) input as an unregistered flow in the same manner as above.

[0019] The statistical information file generation unit 24 periodically obtains the traffic volume (traffic statistical information) that is the result of the aggregation by the statistics unit 23 from the statistics unit 23 and records it in the storage unit 25. The statistical information file generation unit 24 obtains the time of this recording from the time source 40 and stores the traffic volume stamped with the obtained time in the storage unit 25. The time-stamped traffic volume is stored for each registration number n. The time-stamped traffic volume constitutes a statistical information file. This statistical information file identifies the change over time in the traffic volume for each flow.

[0020] The automatic fault detection unit 26 acquires the traffic volume and the registration number n corresponding to the traffic volume from the statistics unit 13. The automatic fault detection unit 16 refers to the rule table 29 and acquires the upper threshold UTHn and lower threshold LTHn corresponding to the registration number n. The automatic fault detection unit 26 compares the acquired upper threshold UTHn and lower threshold LTHn with the traffic volume. If the traffic volume exceeds the upper threshold UTHn or falls below the lower threshold LTHn, the automatic fault detection unit 16 updates the capture flag corresponding to the acquired registration number n in the rule table 29 to "1." If the capture flag is already "1," the capture of input packets, described below, has already started, and the "1" is maintained. If the traffic volume does not exceed the upper threshold UTHn or fall below the lower threshold LTHn, the automatic fault detection unit 26 updates the capture flag corresponding to the registration number n in the rule table 29 to "0." If the capture flag is already "0," the capture flag is maintained.

[0021] When the traffic volume exceeds the upper threshold UTHn, it means that the traffic volume is high. For example, the traffic volume is increasing rapidly. In such a case, it is possible that a problem has occurred in that flow, such as an attack that sends a large number of emails or server congestion. On the other hand, when the traffic volume exceeds the lower threshold LTHn, it means that the traffic volume is low. For example, the traffic volume is decreasing rapidly. In such a case, it is possible that a problem has occurred in that flow, such as a server going down.

[0022] When the traffic volume exceeds the upper threshold UTHn or falls below the lower threshold LTHn, the automatic fault detection unit 26 outputs information to that effect (including the fact that a fault has occurred) to an external device (such as a display device) to notify the user of this.

[0023] The threshold updating unit 27 periodically updates the upper threshold UTHn and the lower threshold LTHn based on the time from the time source 40. This will be described later.

[0024] The packet capture unit 30 includes a filter unit 31 , a capture file generation unit 32 , and a storage unit 33 .

[0025] The filter unit 31 temporarily buffers the input packet input to the packet capture unit 30 and waits until the value of the capture flag is notified from the flow identification unit 22. This capture flag value is the value acquired and output by the flow identification unit 22 for the buffered input packet. If the value of the capture flag is "1," the filter unit 31 outputs the buffered input packet to the subsequent capture file generation unit 32. If the value of the capture flag is "0," the filter unit 31 discards the buffered input packet without outputting it to the subsequent capture file generation unit 32. As a result, the input packet with the capture flag value "1" is filed. Note that, in consideration of the case where the flow identification unit 22 is unable to acquire the registration number n by referring to the rule table 29, if the flow identification unit 22 does not notify the value of the capture flag for a certain period of time, the buffered input packet may be discarded. As another example, if the flow identification unit 22 is unable to acquire the registration number n by referring to the rule table 29, the flow identification unit 22 may notify "0" as the value of the capture flag.

[0026] The capture file generation unit 32 uses the input packets from the filter unit 31 and the time of input of the input packets from the time source 40 to create a file of capture data bundling multiple packets and saves it in the storage unit 25. This means that the input packets have been captured. The capture is performed automatically according to the value of the capture flag. The capture file generation unit 32 may also create a file of the input packets for each flow based on the header, etc.

[0027] The flow identification unit 22 may output the registration number n obtained above to the filter unit 31. In this case, when the value of the capture flag is "1", the filter unit 31 may also generate the registration number n in the capture file generation unit 32. The capture file generation unit 32 may create a capture file of input packets for each registration number, that is, for each flow.

[0028] As described above, the threshold update unit 27 periodically updates the upper threshold UTHn and the lower threshold LTHn based on the time from the time source 40. The threshold update unit 27 dynamically updates the upper threshold UTHn and the lower threshold LTHn while the information processing unit 20 is operating. Here, it is considered that the traffic volume of the same flow does not vary significantly between different days and within the same time period. Therefore, the threshold update unit 27 of this embodiment changes the upper threshold UTHn and the lower threshold LTHn by dividing them into predetermined periods. FIG. 2 shows an example of setting the upper threshold UTHn and the lower threshold LTHn for the flow with registration number n. The graph in FIG. 2 shows the average traffic volume for the flow with registration number n in a day when no failure occurs. In this embodiment, a day is divided into three time periods, and an upper threshold UTHn and a lower threshold LTHn are set for each of these periods.

[0029] The threshold update unit 27 includes a table 27A in which an upper limit threshold UTHn and a lower limit threshold LTHn corresponding to a time are defined for each registration number n, that is, for each flow. When a time corresponding to the table is observed in the time source 40, the threshold update unit 27 updates the upper limit threshold UTHn and the lower limit threshold LTHn corresponding to that registration number n in the rule table 29 to the upper limit threshold UTHn and the lower limit threshold LTHn associated with that time in the table 27A.

[0030] The time at which the upper threshold UTHn and the lower threshold LTHn are updated may be the same for each flow or may be different for each flow. Also, the timing at which the upper threshold UTHn and the lower threshold LTHn are updated may be staggered for the same flow.

[0031] The termination instruction after the start of capturing input packets, that is, the trigger for updating the packet capture value in the rule table 29 to "0", may be an external termination instruction. Also, as described above, the automatic fault detection unit may issue a termination instruction when it detects that the traffic volume is below the upper threshold or is abnormally below the lower threshold. Alternatively, a timer for the number of flows may be provided in the information processing unit 20, and capturing may continue from the time a capture start instruction is issued until the timer expires, after which a termination instruction may be issued.

[0032] The upper threshold UTHn and the lower threshold LTHn can be determined by any method. For example, the standard deviation σ can be calculated from the average traffic volume of the flows subject to these thresholds over several days, and the upper threshold UTHn = 2σ and the lower threshold LTHn = -2σ. Depending on the application, the lower threshold can be loosened to -3σ, for example. Furthermore, the average value of the traffic volume at each timing over several days can be used as a reference, and the upper threshold UTHn and the lower threshold LTHn can be set to that average value ± a certain value.

[0033] As shown in FIG. 2, traffic volume fluctuates depending on the time of day, even under normal circumstances. If the upper and lower thresholds are fixed, it will not be possible to respond to fluctuations in traffic volume throughout the day, resulting in false detection of faults or failures not being detected. By changing the upper and lower thresholds depending on the time of day, as in this embodiment, abnormal traffic can be detected using thresholds appropriate to daily traffic fluctuations, preventing unnecessary input packets from being captured while capturing only truly necessary input packets as packets in the event of a fault. This allows packets to be captured accurately when a fault occurs. Furthermore, in this embodiment, a lower threshold is also set, making it possible to detect faults in which traffic volume drops abnormally.

[0034] <Second embodiment> In the first embodiment, the upper limit threshold UTHn and the lower limit threshold LTHn are changed in conjunction with time. In the second embodiment, the upper limit threshold UTHn and the lower limit threshold LTHn are changed in detail in accordance with the current traffic volume.

[0035] 3, compared to the traffic monitoring device 10 according to the first embodiment, the traffic monitoring device 110 according to the second embodiment includes an information processing unit 120 instead of the information processing unit 20. The information processing unit 120 further includes a threshold determination unit 128 in addition to the configuration of the information processing unit 20. The threshold determination unit 128 determines an upper threshold UTHn and a lower threshold LTHn in real time for each flow with registration number n, that is, based on the traffic volume for each registration number n.

[0036] The threshold determination unit 128 calculates the upper threshold UTHn and the lower threshold LTHn at each predetermined threshold update period and notifies the threshold update unit 27 of the calculation results. The threshold update unit 27 receives the notification and updates the upper threshold UTHn and the lower threshold LTHn for each rule in the rule table 29. The threshold determination unit 128 acquires the traffic volume and the registration number n corresponding to that traffic volume from the statistics unit 13, and based on these, calculates the upper threshold UTHn and the lower threshold LTHn for each flow, that is, for each registration number n.

[0037] The threshold update cycle is short, at least 10 seconds but no more than 10 minutes. Therefore, the upper limit threshold UTHn and the lower limit threshold LTHn are changed in short intervals. This makes it possible to set the upper limit threshold UTHn and the lower limit threshold LTHn according to the traffic volume, which is updated in real time, and increases the accuracy of packet capture triggered by abnormal traffic.

[0038] Here, an example of determining the upper threshold UTHn and the lower threshold LTHn will be described with reference to Figs. 4 to 6. The threshold determination unit 128 executes the threshold determination process of Fig. 4. The following calculation, i.e., the determination of the upper threshold UTHn and the lower threshold LTHn, is performed for each registration number n, i.e., for each flow. Values ​​required for the following calculation are calculated by the threshold determination unit 128 based on the traffic volume and other information in the statistical information file recorded in the storage unit 25. The threshold determination unit 128 may also store values ​​and other information required for determining the upper threshold UTHn and the lower threshold LTHn.

[0039] The threshold value determination unit 128 first calculates the upper limit threshold value UTHn and the lower limit threshold value LTHn for the next cycle as provisional values ​​using one of the following calculation methods (1) to (3) (step S11). The user can set which of the following calculation methods to use.

[0040] (1) The upper threshold UTHn(Δt3) and lower threshold LTHn(Δt3) for the next cycle (Δt3) are calculated based on the average traffic volume Tave n(Δt1) for the previous cycle (Δt1), the average traffic volume Tave n(Δt2) for the current cycle (Δt2), and the upper threshold UTHn(Δt2) and lower threshold LTHn(Δt2) for the current cycle (Δt2) (see Figure 5 for each value). The calculation formula is, for example, the following formula. (Formula 1) UTHn(Δt3)=(Tave n(Δt2) / Tave n(Δt1))×UTHn(Δt2) (Formula 2) LTHn(Δt3)=(Tave n(Δt2) / Tave n(Δt1))×LTHn(Δt2)

[0041] (2) The upper threshold UTHn(Δt3) and lower threshold LTHn(Δt3) for the next cycle (Δt3) are calculated using the average traffic volume Tave n(Δtbase) of the reference cycle (Δtbase) that serves as the reference for the threshold update cycle, the average traffic volume Tave n(Δt2) of the current cycle (Δt2), and the reference upper threshold UTHn(Δtbase) and reference lower threshold LTHn(Δtbase) for the reference cycle (Δtbase) (see Figure 6 for each value). The calculation formula may be, for example, the following formula. The average traffic volume Tave n(Δtbase), the reference upper threshold UTHn(Δtbase), and the reference lower threshold LTHn(Δtbase) are assumed to be calculated and set in advance using any method. The above calculation formula may be, for example, the following formula. The reference cycle (Δtbase) is determined arbitrarily. (Formula 3) UTHn(Δt3)=(Tave n(Δt2) / Tave n(Δtbase))×UTHn(Δtbase) (Formula 4) LTHn(Δt3)=(Tave n(Δt2) / Tave n(Δtbase))×LTHn(Δtbase)

[0042] (3) The upper threshold UTHn(Δt3) and lower threshold LTHn(Δt3) for the next cycle (Δt3) are calculated based on the traffic volume Tn(Δt1) at a certain timing (start timing, end timing, etc.) in the previous cycle (Δt1), the traffic volume Tn(Δt2) at a certain timing (start timing, end timing, etc.) in the current cycle (Δt2), and the upper threshold UTHn(Δt2) and lower threshold LTHn(Δt2) for the current cycle (Δt2) (see Figure 5 for each value). The calculation formula is, for example, the following formula. (Formula 5) UTHn(Δt3)=(Tn(Δt2) / Tn(Δt1))×UTHn(Δt2) (Formula 6) LTHn(Δt3)=(Tn(Δt2) / Tn(Δt1))×LTHn(Δt2)

[0043] In step S11, new upper and lower thresholds are calculated based on the average traffic volume during the threshold update period. Therefore, a fault may have occurred at the time of calculation. That is, the traffic volume may have temporarily increased or decreased at that time. Therefore, the threshold determination unit 128 compares the average traffic volume for the same flow during the same time period between the current day and the previous day (step S12) and determines whether the difference exceeds a predetermined threshold (step S13). If the difference does not exceed the predetermined threshold (step S13; No), the threshold determination unit 128 determines that no fault has occurred and adopts the upper and lower thresholds UTHn(Δt3) and LTHn(Δt3) calculated in step S11 as the upper and lower thresholds for the next period (step S15). If the difference is significant (step S13; Yes), the threshold determination unit 128 compares the average traffic volume during the short period consisting of the threshold update period with the average traffic volume during the long period consisting of multiple threshold update periods to determine whether a fault has occurred (step S14). If the comparison result shows that the difference in traffic volume between the two is equal to or less than a predetermined value, it is determined that "no fault has occurred" (step S14; No), and the process of step S15 is performed. If the difference in traffic volume between the two exceeds a predetermined value, it is determined that "an abnormality may have occurred" (step S14; Yes), and the upper and lower thresholds are set to the same thresholds as the upper and lower thresholds for the same time period on the previous day for the same flow (step S16). Note that if there is a large difference (step S13; Yes), the threshold determination unit 128 may execute step S16 without going through step S15.

[0044] The above example shows calculations for all flows listed in rule table 29, but this is not limited to this. The user may specify several flows and calculate and update the upper and lower thresholds for only those flows.

[0045] The configuration and method for dynamically changing the upper and lower thresholds in short cycles allows the thresholds to be set according to the actual traffic volume, thereby preventing unnecessary captures. Furthermore, as exemplified by the above formulas 1 to 6, the threshold determination unit 128 determines the threshold based on the degree of fluctuation in traffic volume based on the traffic volume in a short cycle prior to the next cycle for determining the threshold, and the threshold value prior to the next cycle (particularly the current threshold value), thereby improving the accuracy of the threshold value.

[0046] In the above, it is assumed that the average traffic volume for the same time period on the previous day is stored inside the traffic monitoring device 10. However, it is possible that such data does not exist depending on the flow. Therefore, when observing the average traffic volume over a long period, the threshold value determination unit 128 may be configured to determine the upper and lower threshold values ​​based on the fluctuations in the average traffic volume over a long period, taking into consideration that the influence of an abnormal increase or decrease in traffic volume appears small.

[0047] For example, the threshold determination unit 128 calculates the upper limit threshold UTHn(Δt3) and the lower limit threshold LTHn(Δt3) for the next cycle for each threshold update cycle shown in FIG. 7 (which may be any cycle longer than the short cycle).

[0048] For example, the threshold determination unit 128 calculates the upper threshold UTHn(Δt3) and the lower threshold LTHn(Δt3) based on the average traffic volume Tave n(ΔT2) in an observation period T2 (e.g., a period of one hour or more) that consists of multiple consecutive threshold update periods and includes the current period Δt2 as the latest period, the average traffic volume Tave n(ΔT1) in an observation period T1 (e.g., a period of one hour or more) that consists of multiple consecutive threshold update periods and includes the previous period Δt1 as the latest period, and the upper threshold UTHn(Δt2) and the lower threshold LTHn(Δt2) of the current period (see, for example, Equations 7 and 8 below). It is preferable that the observation periods T2 and T1 be the same length. (Formula 7) UTHn(Δt3)=(Tave n(ΔT2) / Tave n(ΔT1))×UTHn(Δt2) (Formula 8) LTHn(Δt3)=(Tave n(ΔT2) / Tave n(ΔT1))×LTHn(Δt2)

[0049] For example, as in FIG. 6, the threshold determination unit 128 calculates the upper threshold UTHn(Δt3) and the lower threshold LTHn(Δt3) based on the average traffic volume Tave n(Δtbase) of the reference threshold update period (or it may be the reference observation period), the average traffic volume Tave n(ΔT2) in the observation period T2 that consists of multiple consecutive threshold update periods and includes the current period Δt2 as the latest period, and the upper threshold UTHn(Δtbase) and the lower threshold LTHn(Δtbase) of the reference threshold update period (for example, see Equations 9 and 10 below). (Formula 9) UTHn(Δt3)=(Tave n(Δ2) / Tave n(ΔTbase))×UTHn(Δt2) (Formula 10) LTHn(Δt3)=(Tave n(ΔT2) / Tave n(ΔTbase))×LTHn(Δt2)

[0050] By calculating the threshold using long-period traffic volume, it is possible to update the new threshold while reducing the influence of the presence or absence of traffic failures. Furthermore, as exemplified by the above formulas 7 to 10, the threshold determination unit 128 determines the threshold based on the degree of fluctuation in traffic volume based on the traffic volume in the observation period before the next period for determining the threshold, and the threshold value before the next period, thereby improving the accuracy of the threshold.

[0051] <Third embodiment> 8, the traffic monitoring device 210 according to the third embodiment includes a sampling capture unit 251 and a rule registration unit 252 in addition to the configuration of the traffic monitoring device 110. The traffic monitoring device 210 is configured to register unregistered flows, which are flows not registered in the rule table 29, in the rule table 29 together with an upper threshold and a lower threshold.

[0052] If there is no rule that matches the header information extracted by the packet analysis unit 21, the flow identification unit 22 notifies the filter unit 31 of this fact. Upon receiving this notification, the filter unit 31 outputs the input packet to the sampling capture unit 251.

[0053] The sampling capture unit 251 captures packets of unregistered flows at regular or random intervals to identify the distribution of unregistered flows on a per-flow basis. The rule registration unit 252 extracts rules to be registered in the rule table using the traffic volume of unregistered rules, calculated by subtracting the traffic volume of registered rules from the total traffic volume output from the statistics unit 23, and the sampling results output from the sampling capture function unit. For example, header information of each packet included in the sampling results (information specifying the source and destination of the packet that specifies the flow) is extracted as a registered rule. The rule registration unit 252 registers the extracted rules in the rule table 29. In response to this, the threshold update unit 27 registers initial upper and lower thresholds in the rule table 29. These thresholds may be different values ​​for each rule defined in a database or the like internally held by the threshold update unit 27, or they may be common values ​​regardless of the rule. After the initial thresholds are registered, the upper and lower thresholds are dynamically changed using a method similar to the above flow.

[0054] With the above configuration, it is possible to register rules not only for registered flows but also for traffic that was an unregistered flow when the system was first started up, and to dynamically update the upper and lower thresholds during system operation.

[0055] <Hardware configuration of traffic monitoring device> The traffic monitoring devices 10, 110, and 210 are realized by various circuits such as a processor that executes a program, such as a CPU (Central Processing Unit), an FPGA (Field-Programmable Gate Array), or an ASIC (Application Specific Integrated Circuit). The information processing unit and packet capture unit are also information processing circuits and packet capture circuits.

[0056] The traffic monitoring devices 10, 110, 210 may be configured, for example, by a computer 900 shown in FIG. 9. The processor 901 is configured by one or more CPUs, etc. The processor 901 operates as each of the above-mentioned units by executing a traffic monitoring program stored in a storage device 902. The storage device 902 may include a main memory of the processor 901, etc. The storage device 902 stores tables such as a rule table 29, and configures the storage unit 25 and the storage unit 33. Each of the above-mentioned units may include a part of the storage device 902.

[0057] When the traffic volume exceeds the upper threshold UTHn or falls below the lower threshold LTHn, the processor 901 operating as the automatic fault detection unit 26 outputs information to that effect (including the fact that a fault has occurred) to the output device 904 to notify the user. Incoming packets from the monitored network 80 are input from an I / O (Input / Output) 903.

[0058] <Configurations taking the above-described embodiment as an example> A traffic monitoring device that monitors traffic in a monitored network may include, for example, an information processing unit and a packet capture unit. The information processing unit, for example, acquires traffic statistics of flows in the monitored network and determines whether the acquired traffic statistics satisfy a predetermined criterion for fault detection. In the above embodiment, the traffic statistics is traffic volume, but other statistical information may be used. Other examples of traffic statistics include the number of bytes per unit time, jitter, latency, the number of packets, or the degree of change in the number of bytes (such as the gradient of traffic volume change). The predetermined criterion compared with the degree of change may be set as an upper threshold and a lower threshold for detecting a sudden increase or decrease in traffic volume. The packet capture unit, for example, captures packets of the flow determined to satisfy the predetermined criterion as packets occurring when a fault occurs in the flow. The information processing unit dynamically updates the predetermined criterion while the information processing unit is operating. With this configuration, the predetermined criterion is dynamically changed, allowing packets to be captured accurately when a fault occurs. The captured packets are stored in a storage unit and output in response to a user request. At this time, the contents of the packet are displayed on a display unit or the like as appropriate.

[0059] The information processing unit, for example, acquires traffic statistical information for each of a plurality of flows including the flow. The information processing unit refers to a rule table in which a rule capable of uniquely identifying a flow, a capture flag that takes a first value when the flow is a target for capture by the packet capture unit and a second value when the flow is not a target, and the predetermined criteria for the flow are associated with each flow, and updates the capture flag value corresponding to a flow that satisfies the predetermined criteria to the first value. The packet capture unit captures packets of the flow after the capture flag value is changed to the first value. The packet capture unit may buffer a predetermined amount of input packets and capture packets of the flow before and after the value is changed to the first value. The rule table facilitates management of the predetermined criteria.

[0060] The traffic statistical information may be traffic volume, and the predetermined criteria may be an upper threshold and a lower threshold. The information processing unit may determine that the traffic statistical information satisfies the predetermined criteria when the traffic volume exceeds the upper threshold or falls below the lower threshold. Setting a lower threshold also makes it possible to detect failures such as server down. Note that the traffic volume may be the number of packets or the amount of data (number of bytes) per unit time, or the rate of change in the number of packets or the amount of data.

[0061] The information processing unit updates the predetermined criterion when the time from the time source reaches a predetermined time, thereby making it possible to change the predetermined criterion with a simple configuration.

[0062] The information processing unit, for example, updates the predetermined criterion at each predetermined period, and updates the predetermined criterion based on the traffic statistical information prior to the next predetermined period in which the predetermined criterion is updated and the predetermined criterion prior to the next predetermined period (for example, the threshold determination process in FIG. 4). This allows the predetermined criterion to be updated appropriately, improving the accuracy of packet capture when a failure occurs. In particular, as exemplified in Equations 1 to 10 above, the information processing unit may determine the threshold based on the degree of fluctuation in the traffic statistical information prior to the next predetermined period in which the predetermined criterion is updated (for example, the ratio between the traffic volume in a certain predetermined period and the traffic volume in the previous predetermined period) and the threshold prior to the next predetermined period (for example, the current threshold). This allows the predetermined criterion to be updated appropriately, improving the accuracy of packet capture when a failure occurs.

[0063] The traffic statistical information before the next predetermined cycle for updating the predetermined criterion may be traffic volume for a period longer than the predetermined cycle. By utilizing this fact that, when traffic volume is observed over a long period, the influence of an increase or decrease in traffic volume due to an abnormality appears small, even if a traffic abnormality occurs when updating the predetermined criterion, the predetermined criterion can be updated while reducing the influence of the abnormality. In particular, as exemplified by Equations 7 to 10 above, the information processing unit may determine the threshold based on the degree of fluctuation in traffic volume (e.g., the ratio between the traffic volume in a certain long period and the traffic volume in a specific period immediately before the long period) based on the traffic volume over the long period before the next predetermined cycle for updating the predetermined criterion, and a threshold value (e.g., the current threshold value) before the next predetermined cycle. This allows the predetermined criterion to be updated appropriately, improving the accuracy of packet capture when a failure occurs.

[0064] The system may include a sampling capture unit that captures packets of unregistered flows at regular or random intervals, and a rule registration unit that registers rules that identify flows included in the captured packets in the rule table. When the rule is registered in the rule table, the information processing unit newly registers a predetermined condition in the rule table in association with the rule. This makes it possible to newly register flows and predetermined criteria that are not registered in the rule table.

[0065] The present invention is not limited to the above-described embodiments and modifications. For example, the present invention includes various modifications to the above-described embodiments and modifications that can be understood by a person skilled in the art within the scope of the technical concept of the present invention. The configurations listed in the above-described embodiments and modifications can be combined as appropriate within a range that does not contradict each other. [Explanation of symbols]

[0066] 10...traffic monitoring device, 13...statistics unit, 15...step, 16...automatic fault detection unit, 20...information processing unit, 21...packet analysis unit, 22...flow identification unit, 23...statistics unit, 24...statistical information file generation unit, 25...memory unit, 26...automatic fault detection unit, 27...threshold update unit, 27A...table, 29...rule table, 30...packet capture unit, 31...filter unit, 32...capture file generation unit, 33...memory unit, 40...time source, 80...monitored network, 110...traffic monitoring device, 120...information processing unit, 128...threshold determination unit, 210...traffic monitoring device, 251...sampling capture unit, 252...rule registration unit, 900...computer, 901...processor, 902...memory unit, 904...output device.

Claims

1. A traffic monitoring device for monitoring traffic on a monitored network, comprising: an information processing unit configured to acquire traffic statistical information of flows in the monitored network and determine whether the acquired traffic statistical information satisfies a predetermined criterion for fault detection; a packet capture unit configured to capture packets of the flow determined to satisfy the predetermined criterion as packets at the time of a failure of the flow, The information processing unit dynamically updating the predetermined criteria during operation of the information processing unit; acquiring traffic statistics information for each of a plurality of flows including the flow; a rule table in which a rule capable of uniquely identifying a flow, a capture flag that takes a first value when the flow is a target for capture by the packet capture unit and a second value when the flow is not a target, and the predetermined criterion for the flow are associated with each flow, and the capture flag value corresponding to a flow that satisfies the predetermined criterion is updated to the first value; the packet capture unit is configured to capture packets of the flow after the capture flag value is changed to the first numerical value or before and after the capture flag value is changed to the first numerical value. Traffic monitoring equipment.

2. the traffic statistical information is a traffic volume, the predetermined criteria are an upper threshold and a lower threshold, the information processing unit determines that the traffic statistical information satisfies the predetermined standard when the traffic volume exceeds the upper threshold or falls below the lower threshold.

2. The traffic monitoring device according to claim 1.

3. the information processing unit updates the predetermined criterion when the time from the time source reaches a predetermined time.

3. A traffic monitoring device according to claim 1 or 2.

4. A traffic monitoring device for monitoring traffic on a monitored network, comprising: an information processing unit configured to acquire traffic statistical information of flows in the monitored network and determine whether the acquired traffic statistical information satisfies a predetermined criterion for fault detection; a packet capture unit configured to capture packets of the flow determined to satisfy the predetermined criterion as packets at the time of a failure of the flow, the information processing unit is configured to dynamically update the predetermined criterion at predetermined intervals during operation of the information processing unit, and to update the predetermined criterion based on the traffic statistical information prior to a next predetermined interval in which the predetermined criterion is updated and the predetermined criterion prior to the next predetermined interval. Traffic monitoring equipment.

5. the traffic statistical information before the next predetermined cycle for updating the predetermined criterion is a traffic volume for a period longer than the predetermined cycle; 5. The traffic monitoring device according to claim 4.

6. a sampling capture unit that captures packets of unregistered flows at regular or random intervals; a rule registration unit that registers a rule that identifies a flow included in the captured packet in the rule table, when the rule is registered in the rule table, the information processing unit newly registers a predetermined condition in the rule table in association with the rule; 2. The traffic monitoring device according to claim 1.

7. A traffic monitoring program that, when executed by a computer, causes the computer to function as a traffic monitoring device described in any one of claims 1 to 6.

Images