Packet processing device and packet processing method

Abstract

A search-key creation unit (141) selects a format pattern of a user-selected packet from a storage unit that stores format patterns of packets that may be input to a packet processing device (10). The search-key creation unit (141) then calculates the bit position of the field of key information used for grouping the packet, on the basis of the number of bits and the sequence of the fields of information on the packet described in the selected format pattern. Thereafter, the search-key creation unit (141) creates search key information indicating the calculated bit position of the field of the key information.

Description

Packet processing device and packet processing method

[0001] The present invention relates to a packet processing device and a packet processing method.

[0002] In a network, for example, a technology has been proposed that analyzes the header information inside or outside the capsule of an encapsulated packet for RAW packets or header-sampled xFlow packets, groups the xFlow packets, and enables different processing or analysis for each group.

[0003] JP 2019-097069 A JP 2021-090161 A International Publication No. 2021 / 149245

[0004] Here, because the position (bit position) of the field used for analysis differs for each input packet format, conventional techniques require the user to specify the field position. Therefore, the user has to perform some manual steps to set the field position used for packet analysis. As a result, there is a problem in that packet grouping cannot be set efficiently. Therefore, an object of the present invention is to solve the above problem and set packet grouping efficiently.

[0005] In order to solve the above-mentioned problems, the present invention is characterized by comprising a selection unit that selects a format pattern of a selected packet from a memory unit that stores format patterns of packets that may be input to a packet processing device, and an information creation unit that calculates the bit positions of the fields of key information used for grouping the packets based on the arrangement and bit number of the fields of each information of the packet described in the selected format pattern, and creates and outputs search key information indicating the bit positions of the calculated fields of the key information.

[0006] According to the present invention, packet grouping can be efficiently set.

[0007] FIG. 1 is a diagram illustrating an overview of a packet processing device. FIG. 2 is a diagram illustrating an overview of a packet processing device. FIG. 3 is a diagram illustrating an overview of a search key creation unit of the packet processing device. FIG. 4 is a diagram illustrating an overview of a grouping unit of the packet processing device. FIG. 5 is a diagram illustrating an example of the configuration of a packet processing device. FIG. 6 is a flowchart illustrating an example of a processing procedure executed by the packet processing device. FIG. 7 is a flowchart illustrating an example of a processing procedure executed by the packet processing device. FIG. 8 is a diagram illustrating a computer that executes a packet processing program.

[0008] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a description will be given of an embodiment of the present invention with reference to the drawings, but the present invention is not limited to the embodiment.

[0009] [Overview] First, an overview of a packet processing device 10 according to this embodiment will be described with reference to Fig. 1. The packet processing device 10 performs analysis of input packets (e.g., mirrored flow packets, flow packet header samples, etc.), and then transmits the analysis results (flow statistics information) to a flow collector (e.g., an xFlow analyzer, etc.).

[0010] As shown in FIG. 1, the packet processing device 10 performs packet filtering, packet header analysis, grouping, information shaping, metadata assignment, metadata identification, packet analysis, and the like.

[0011] Among these processes, packet filtering, packet header analysis, grouping, information shaping, metadata assignment, etc., need to be performed relatively quickly. Therefore, these processes are performed, for example, by hardware (e.g., FPGA (Field Programmable Gate Array)). Other processes (e.g., metadata identification, packet analysis, etc.) are performed by software.

[0012] Here, in order for the packet processing device 10 to group input packets, the user needs to set which field information of the input packets will be used as a key for grouping. Therefore, the packet processing device 10 performs the following process to make the above grouping setting more efficient.

[0013] 2, the packet processing device 10 includes a search key creation unit 141 and a grouping unit 145. The packet processing device 10 prepares in advance, for each format of a packet that may be input to the packet processing device 10, a protocol stack pattern for the packet.

[0014] The search key creation unit 141 then receives a selection of a protocol stack for a packet that may be input from the user, for example, via a GUI (Graphical User Interface), and creates search key information indicating in which field of the packet the grouping key information is written, based on the selected protocol stack.

[0015] Thereafter, the grouping unit 145 reads the value of the key information from the input packets based on the search key information, and then groups the input packets using the value of the read key information.

[0016] For example, the search key creation unit 141 of the packet processing device displays candidate protocol stacks for packets that may be input using a GUI indicated by reference numeral 300 in FIG. 3, and accepts the selection of a protocol stack for the packet from the user.

[0017] For example, if a user selects the protocol stack indicated by the reference numeral 301 and inputs the following information: mode "RAW_MPLS," pattern number "1," x (outer VLAN) "1," y (MPLS) "2," z (inner VLAN) "0," and IP "v4," the search key creation unit 141 creates a protocol stack file indicated by the reference numeral 302 based on this information.

[0018] Thereafter, the search key creation unit 141 calculates the bit position of the field of the key information (key information used for grouping packets) from the information written in the created protocol stack file.

[0019] For example, consider the case where the key information is "MPLS label 1 (inner MPLS label)" and "MPLS label 2 (next inner MPLS label)" indicated by reference numeral 303. In this case, the search key creation unit 141 calculates the bit positions (the start and end positions of the field) of each of the "MPLS label 1" and "MPLS label 2" fields from the protocol stack file indicated by reference numeral 302. The search key creation unit 141 then creates information (see reference numeral 303) that indicates the start and end positions of each of the "MPLS label 1" and "MPLS label 2" fields in the packet.

[0020] As described above, the search key creation unit 141 creates information (search key information) indicating the bit positions (start position and end position) of the key information field of the packet for each packet format that may be input. For example, the search key creation unit 141 creates a search key information group indicated by reference numeral 401 in FIG. 4.

[0021] Thereafter, when the grouping unit 145 receives input of a RAW_MPLS packet, it reads the value of the inner MPLS label and the value of the next inner MPLS label of the input packet based on, for example, the search key information No. 4 in Figure 4, and groups the packets based on the read values.

[0022] For example, as indicated by the reference numeral 402, the grouping unit 145 groups packets based on a combination of the value of the inner MPLS label and the value of the next inner MPLS label of the packet. Then, for example, the grouping unit 145 identifies each of the grouped packets by assigning a group ID to each of the grouped packets. For example, the grouping unit 145 groups a group of packets having an inner MPLS label 1 and a next inner MPLS label 1 and assigns the group ID "1." Furthermore, the grouping unit 145 groups a group of packets having an inner MPLS label 2 and a next inner MPLS label 2 and assigns the group ID "2."

[0023] Thereafter, the packet processing device 10 performs, for example, analysis processing on each packet with the same group ID. Then, the packet processing device 10 assigns the group ID to the analysis processing result (flow statistical information) and transmits it to the flow collector.

[0024] [Configuration Example] Next, a configuration example of the packet processing device 10 will be described with reference to Fig. 5. The packet processing device 10 includes, for example, an input / output unit 11, a communication unit 12, a storage unit 13, and a control unit 14.

[0025] The input / output unit 11 is an interface that controls the input and output of various data. For example, the input / output unit 11 receives input of setting information for the packet processing device 10 and outputs processing results (e.g., flow statistical information) by the control unit 14. The communication unit 12 is a communication interface for communicating with external devices via a network.

[0026] The storage unit 13 stores data, programs, etc. referenced when the control unit 14 executes various processes. The storage unit 13 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. For example, the storage unit 13 stores patterns of packet formats (e.g., protocol stacks) that may be input to the packet processing device 10. The storage unit 13 also stores search key information (see reference numeral 401 in FIG. 4 ) created by the control unit 14.

[0027] The control unit 14 is responsible for overall control of the packet processing device 10. The functions of the control unit 14 are realized by, for example, hardware such as an FPGA and program execution processing by a CPU (Central Processing Unit).

[0028] The control unit 14 includes, for example, a search key creation unit 141, a packet input unit 144, a grouping unit 145, and a packet processing unit 146. The search key creation unit 141 creates the above-mentioned search key information (see reference numeral 401 in FIG. 4). The search key creation unit 141 includes a selection unit 142 and an information creation unit 143.

[0029] The selection unit 142 outputs a packet format pattern selected by the user from among the packet format patterns stored in the storage unit 13 .

[0030] 3 , the selection unit 142 displays candidate protocol stacks for packets that may be input to the packet processing device 10, and accepts a protocol stack selection input from the user. Then, the selection unit 142 outputs the protocol stack selected by the user to the information creation unit 143.

[0031] The information creation unit 143 creates search key information indicating the bit positions of the fields of the key information used to group the packets, based on the arrangement and number of bits of the fields of each piece of information in the packet described in the packet format pattern (e.g., protocol stack) selected by the selection unit 142.

[0032] For example, the information creation unit 143 calculates the start and end positions of the fields of key information (e.g., MPLS label 1, MPLS label 2) based on the arrangement and number of bits of the fields of each piece of information written in the protocol stack file indicated by reference numeral 302 in Fig. 3. Then, the information creation unit 143 creates search key information that indicates the start and end positions (see reference numeral 303) of the fields of the key information (e.g., MPLS label 1, MPLS label 2). Thereafter, the information creation unit 143 stores the created search key information in the storage unit 13.

[0033] It should be noted that which information contained in the packet the information creating unit 143 uses as key information is set in advance by the user or the like.

[0034] The packet input unit 144 receives input packets. The grouping unit 145 groups the packets received by the packet input unit 144.

[0035] For example, the grouping unit 145 identifies the bit positions where the key information of the input packets is written, based on the search key information in the storage unit 13, and reads the value of the key information from the identified bit positions.The grouping unit 145 then performs grouping of the input packets using the value of the read key information.The grouping unit 145 then outputs the grouping results (for example, information in which group IDs are assigned to the grouped packets).

[0036] The packet processor 146 performs various processes on the packets. For example, the packet processor 146 performs analysis on each group of packets and transmits the results to a flow collector as flow statistics information.

[0037] According to the packet processing device 10, the packet grouping can be set efficiently.

[0038] 6 and 7, an example of a processing procedure executed by the packet processing device 10 will be described. First, the selection unit 142 of the packet processing device 10 displays, via a GUI, candidate protocol stacks for packets that may be input to the packet processing device 10 (S1), and accepts a selection input of a protocol stack for the packets from the user (S2).

[0039] The information creation unit 143 then creates a file (protocol stack file) for the protocol stack selected in S2 (S3). Next, the information creation unit 143 calculates the start and end positions of the key information field in the packet based on the arrangement and number of bits of each information field in the packet described in the protocol stack file created in S3. The information creation unit 143 then creates search key information that indicates the start and end positions of the key information field in the packet (S4). The information creation unit 143 then stores the created search key information in the storage unit 13.

[0040] The packet processing device 10 executes the above process to create search key information.

[0041] 7 . Subsequently, when the packet input unit 144 of the packet processing device 10 receives an input packet (S11), the grouping unit 145 reads the value of key information from the key information field in the input packet based on the search key information stored in the storage unit 13, and groups the packets using the read value of key information (S12). Subsequently, the packet processing unit 146 performs packet analysis processing for each group (S13). The packet processing unit 146 then outputs the packet analysis results (e.g., flow statistics information) (S14).

[0042] By performing the above-described processing, the packet processing device 10 can group packets based on the search key information and perform analysis processing.

[0043] [System Configuration, etc.] The components of each unit shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0044] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0045] [Program] The packet processing device 10 can be implemented by installing a program (packet processing program) as package software or online software on a desired computer. For example, by executing the program on an information processing device, the information processing device can function as the packet processing device 10. The information processing device referred to here includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as terminals such as PDAs (Personal Digital Assistants).

[0046] 8 is a diagram showing an example of a computer that executes a packet processing program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0047] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0048] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes executed by the packet processing device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the packet processing device 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0049] Data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary and executes them.

[0050] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0051] REFERENCE SIGNS LIST 10 Packet processing device 11 Input / output unit 12 Communication unit 13 Storage unit 14 Control unit 141 Search key creation unit 142 Selection unit 143 Information creation unit 144 Packet input unit 145 Grouping unit 146 Packet processing unit

Claims

1. A packet processing device comprising: a selection unit that selects a selected packet format pattern from a storage unit that stores packet format patterns that may be input to the packet processing device; and an information creation unit that calculates the bit positions of key information fields used for grouping the packets based on the arrangement and number of bits of the fields of each information of the packet described in the selected format pattern, and creates and outputs search key information indicating the calculated bit positions of the key information fields.

2. A packet processing device according to claim 1, further comprising: a packet input unit that accepts input of a packet; and a grouping unit that identifies the bit position of the field of the key information in the packet based on the search key information, reads the value of the key information from the identified bit position of the packet, performs grouping of the packets using the read value of the key information, and outputs the results of the grouping.

3. A packet processing method executed by a packet processing device, comprising the steps of: selecting a format pattern for a selected packet from a storage unit that stores format patterns for packets that may be input to the packet processing device; and calculating the bit positions of the fields of key information used to group the packets based on the arrangement and number of bits of the fields of each piece of information in the packet described in the selected format pattern, and creating and outputting search key information indicating the bit positions of the calculated fields of the key information.

Images