JP4657529B2 - Packet information collection apparatus and method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a packet information collection apparatus and method suitable for use in a network monitor apparatus or the like that monitors traffic in a communication network that transmits packets.
[0002]
[Prior art]
In a communication network for transmitting packets, a network administrator uses a network monitor device to grasp a traffic situation in order to smoothly maintain and operate the network. This network monitoring device collects packet information (all packet information or header information included in the packet) related to a packet transmitted in a communication network, and indicates traffic status based on the collected packet information Is generated.
[0003]
Such a network monitor device has been conventionally realized using a personal computer. For example, there is known one that collects packet information using a function specific to an operating system (OS) executed on a personal computer. This uses a packet information collection function called BPF (Berkley Packet Filter) that the OS has.
[0004]
In BPF, a packet selection filter and a buffer are prepared for each application (for example, a network monitor application). When a packet is received via a communication board (communication interface device) connected to the communication network, the packet information of the packet selected by the packet selection filter is copied and stored in a buffer. Next, a plurality of pieces of packet information stored in the buffer are provided to the application unit.
[0005]
As described above, in the personal computer (host device) serving as the network monitor device, the host CPU that executes the OS and the application copies the packet information to the buffer in the host memory, thereby realizing the conventional packet information collection device. ing.
[0006]
[Problems to be solved by the invention]
However, in the conventional packet information collection device described above, in the host device equipped with the device, the host CPU that executes the OS and application copies the packet information to the buffer in the host memory, so the load on the host CPU is large, As a result, there is a possibility that the collection of packet information cannot be handled.
[0007]
There is also a desire to process packet information with a device different from the host device that collects packet information. However, in the conventional packet information collection device, since the OS of the host device directly provides the packet information to the application unit, there is a problem that other devices cannot process the packet information.
[0008]
The present invention has been made in view of such circumstances, and its object is to receive packet information from a communication network and collect packet information, which can reduce the load on the host CPU. It is to provide a collecting apparatus and a method thereof. Another object of the present invention is to provide a packet information collection program for realizing the packet information collection apparatus using a computer.
[0009]
Another object of the present invention is to provide a packet information collection apparatus and method that can transfer the collected packet information to an apparatus different from the host apparatus that collects the packet information. Another object of the present invention is to provide a packet information collection program for realizing the packet information collection apparatus using a computer.
[0010]
[Means for Solving the Problems]
In order to solve the above problem, the packet information collection device according to claim 1 includes a communication interface device connected to a communication network, and the packet received by the communication interface device. Header at the beginning of A packet information collection device for collecting information, a buffer provided on a memory accessible from the communication interface device, and a buffer information descriptor provided on the memory and indicating a specific storage area in the buffer Descriptor storage means for storing the data, and control means for designating the storage destination of the packet by the buffer information descriptor, The control means generates a plurality of the buffer information descriptors for one of the buffers, and the buffer information descriptor has a head address when writing the packet in the buffer, and the plurality of buffer information descriptors The start address of each information descriptor is sequentially shifted by the size of the header information or the size of the header information plus additional information, and the control means includes the plurality of buffers in the order of the start address. Storing an information descriptor in the descriptor storage means; Communication interface device Each time a packet is received, the buffer information descriptor is sequentially read from the descriptor storage means, By DMA transfer, Overwrite the received packet from the head address of the read buffer information descriptor, It is characterized by that.
[0013]
Claim 2 The packet information collection device according to claim 1, wherein the buffer stored in the buffer is header A transfer packet generating means for generating a transfer packet including information is provided.
[0014]
According to a fifth aspect of the present invention, there is provided the packet information collection device, wherein the transfer packet generation means holds in advance a header template for the transfer packet.
[0015]
Claim 4 The packet information collection device according to claim 1, wherein the transfer packet is transmitted to a plurality of preset transfer destinations. header It is characterized by transferring information.
[0017]
Claim 5 The packet information collection method according to claim 1, comprising a communication interface device connected to a communication network, and a packet received by the communication interface device. Header at the beginning of A packet information collecting method in a packet information collecting apparatus for collecting information, wherein a specific storage area in a buffer provided on a memory accessible from the communication interface apparatus Indicate Buffer information descriptor Generating a plurality of the buffer information descriptors for one of the buffers, the buffer information descriptor having a start address when writing the packet into the buffer, and each of the plurality of buffer information descriptors The start address is sequentially shifted by the size of the header information or the size of the header information plus additional information, and the plurality of buffer information descriptors are stored in the descriptor storage means in the order of the start address. When, The communication interface device Each time a packet is received, buffer information descriptors are sequentially read from the descriptor storage means, By DMA transfer, Overwrite the received packet from the start address of the read buffer information descriptor Process and further It is characterized by including.
[0020]
Claim 6 The packet information collection method according to claim 4, wherein the buffer stored in the buffer is header The method further includes a step of generating a transfer packet including information.
[0021]
Claim 7 The packet information collection program according to claim 1, comprising a communication interface device connected to a communication network, the packet received by the communication interface device Header at the beginning of A packet information collection program for performing packet information collection processing in a packet information collection apparatus that collects information, a specific storage area in a buffer provided on a memory accessible from the communication interface apparatus Indicate Buffer information descriptor Are generated for a single buffer, and the buffer information descriptor has a head address for writing the packet into the buffer, and the buffer information The start addresses of the descriptors are sequentially shifted by the size of the header information or the size of the header information plus additional information, and the plurality of buffer information descriptors are described in the order of the start addresses. Processing to store in the storage means; The communication interface device Each time a packet is received, buffer information descriptors are sequentially read from the descriptor storage means, By DMA transfer, Overwrite the received packet from the start address of the read buffer information descriptor Processing and further It is characterized by being executed by a computer.
[0024]
Claim 8 The packet information collection program described in the above is stored in the buffer. header A process for generating a transfer packet including information is further executed by a computer.
These packet information collection programs enable the above-described packet information collection apparatus to be realized using a computer.
[0025]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration example of a communication network monitoring system using a packet information collection device according to an embodiment of the present invention. In FIG. 1, reference numeral 1 denotes a host device having a packet information collection function. In this embodiment, the host device 1 functions as a packet information collection device. Reference numeral 2 denotes a communication network that transmits the packet 41, and the communication network 2 is connected to the host device 1.
[0026]
The communication network 2 is a communication network to be monitored. The host device 1 acquires the packet 41 flowing on the optical fiber 31 in the communication network 2 via the optical branching device 32, and collects the packet information (header information included in the packet).
[0027]
Reference numeral 3 denotes a remote host device connected to the host device 1 via the communication network 4. The host device 1 can be connected to a plurality of remote host devices 3 via the communication network 4.
[0028]
The host device 1 is realized by a computer such as a personal computer, and includes a processing device (host CPU) that executes programs such as an operating system (OS) and applications, and a storage device that stores these programs and various data. (Host memory) and peripheral hardware such as a communication interface device. However, in the host device 1 shown in FIG. 1, for the sake of convenience, a block configuration of functions that the host device 1 has is shown.
[0029]
The host device 1 shown in FIG. 1 includes a kernel unit that is a core function of the OS, an application unit that includes various application functions, and a communication interface unit that manages external communication functions. The communication interface unit is connected to the communication network 2 and exchanges packets with the communication network 2. The communication interface unit (communication board) 11 is connected to the communication network 4 and communicates with the communication network 4. And a communication board 12 for sending and receiving packets. The communication board 11 includes a DMA unit 25 having a direct memory access (DMA) function. The DMA unit 25 can transfer data between the communication board 11 and the host memory without going through the host CPU. A plurality of communication boards 11 are provided according to the configuration in the communication network 2.
[0030]
The kernel unit performs packet processing based on a device driver unit 13 for driving control of the communication board 11, a device driver unit 14 for driving control of the communication board 12, and UDP (User Datagram Protocol) and IP (Internet Protocol). A UDP / IP unit 16 to perform and a socket unit 17 having an interface function with the application unit are provided.
[0031]
The device driver unit 13 includes a packet information collection unit 15 that collects header information of the packet 41 received by the communication board 11. The packet information collection unit 15 includes a control unit 21 that controls header information collection operation, a buffer unit 22 that accumulates header information, a BD queue unit 23 that stores an accumulation destination address of header information in the buffer unit 22, and the like. In order to transfer the extracted header group 42 which is the header information group stored in the buffer unit 22 to the application unit or the remote host device 3, the transfer packet generating unit that generates the extracted header transfer packet 43 including the extracted header group 42 24. The buffer unit 22 and the BD queue unit 23 are provided on a host memory accessible from the communication board 11.
[0032]
The application unit includes a network monitor application 18.
With this network monitor application 18, the host device 1 also functions as a network monitor device. The network monitor application 18 generates information indicating the traffic status of the communication network 2 based on the extracted header group 42 acquired from the packet information collection unit 15.
[0033]
In the host device 1, the communication board 11 and the packet information collection unit 15 correspond to the packet information collection device of this embodiment. The BD queue unit 23 corresponds to a descriptor storage unit.
[0034]
The remote host device 3 has the same configuration as the host device 1, but does not have a packet information collection function, and based on the extracted header group 42 transferred from the host device 1, the traffic status of the communication network 2 Generates information indicating
[0035]
Next, the operation of the host device 1 in FIG. 1 collecting packet information will be described. First, the outline of the packet information collection processing of this embodiment will be described. In the host device 1, the DMA unit 25 writes the packet 41 received by the communication board 11 connected to the communication network 2 to one buffer of the buffer unit 22 on the host memory. This writing is performed without going through the host CPU. At the time of writing, the headers of a plurality of packets 41 are overwritten by overwriting the header part of another packet 41 in the written area of the non-header part of the packet 41 on one buffer in the buffer unit 22. Only the parts are accumulated sequentially. Thereby, header information of a plurality of packets is extracted on one buffer.
[0036]
Hereinafter, the process of writing the packet 41 received from the communication network 2 to the buffer of the buffer unit 22 will be described with reference to FIGS. FIG. 2 is a block diagram showing a configuration of the BD queue unit 23 shown in FIG. As shown in FIG. 2, the BD queue unit 23 has an unused BD queue 51 and a used BD queue 52 for holding a buffer information descriptor (BD). The buffer information descriptor (BD) holds management information such as a physical address (Baddr) and length information (Blen) for a specific buffer in the buffer unit 22. Therefore, the buffer information descriptor (BD) is associated with the buffer including the memory area indicated by the physical address (Baddr) described in the buffer information descriptor (BD).
[0037]
The unused BD queue 51 holds an unused buffer information descriptor (BD). The unused buffer information descriptor (BD) indicates that the header information is not written in the buffer memory area indicated by the physical address (Baddr) of the buffer information descriptor (BD). The used BD queue 52 holds a used buffer information descriptor (BD). The used buffer information descriptor (BD) indicates that the header information has been written in the buffer memory area indicated by the physical address (Baddr) of the buffer information descriptor (BD). These queues 51 and 52 are constituted by FIFO (first in first out) type buffers.
[0038]
First, the control unit 21 of the packet information collecting unit 15 allocates a continuous memory area on the host memory as a use area of one buffer of the buffer unit 22 in advance, and prepares a plurality of buffers. Further, the control unit 21 creates a buffer information descriptor (BD) describing management information such as a physical address (Baddr) and length information (Blen) for each buffer, and writes the buffer information descriptor (BD) to the unused BD queue 51. Each of the queues 51 and 52 and the buffer are provided in a memory area on the host memory accessible from the communication board 11.
[0039]
When receiving the packet 41 from the communication network 2, the communication board 11 reads the buffer information descriptor (BD) from the unused BD queue 51. Next, the DMA unit 25 DMA-transfers and writes the received packet to the buffer associated with the buffer information descriptor (BD) according to the physical address (Baddr) of the read buffer information descriptor (BD). When the writing of the received packet is completed, the communication board 11 writes the used buffer information descriptor (BD) to the used BD queue 52.
[0040]
In addition, the communication board 11 appropriately generates a reception interrupt and prompts the control unit 21 to perform packet reception processing. Upon receiving this reception interrupt, the control unit 21 reads the buffer information descriptor (BD) from the used BD queue 52, and stores the header information stored in the buffer associated with the buffer information descriptor (BD). Then, it is determined whether or not to perform transfer processing for providing to the network monitor application 18 or the remote host device 3. The control unit 21 executes the transfer process when writing for one buffer has been completed.
[0041]
In the above-described embodiment, the unused BD queue 51 and the used BD queue 52 are configured by FIFO buffers. However, as shown in FIG. 6, the buffer information descriptor (BD) is linked. A data transfer interface called Chained BD Queue Structure may be used. In this method, an unused BD queue and a used BD queue are merged, and a flag (Own) for identifying whether the buffer information descriptor (BD) is unused or has been used. Are provided in the buffer information descriptor (BD).
[0042]
Next, with reference to FIGS. 3 and 4, processing for extracting only header portions of a plurality of packets 41 on one buffer in the buffer unit 22 will be described. FIG. 3 is a diagram showing the configuration of the memory area in the buffer 61 in the buffer unit 22. FIG. 4 is a diagram for explaining a process of extracting packet information (headers) of a plurality of packets 41 on the buffer 61.
[0043]
First, when the control unit 21 generates a buffer information descriptor (BD) for each buffer 61 of the buffer unit 22, a plurality of buffer information descriptors (BD_i; i is 1 ≦ i ≦ integer that satisfies m). Here, the control unit 21 sets the physical address (Baddr_i) of each buffer information descriptor (BDi) according to equations (1) and (2).
[0044]
Baddr_1 = Baddr_start + HLEN + CLEN (1)
Baddr_i = Baddr_ (i-1) + NLEN + CLEN (2)
However, in the formula (2), i is an integer of 2 or more. Baddr_start is the top physical address of the buffer 61. HLEN is the length of the transfer header added to transfer the extracted header information group (extracted header group 42) to the network monitor application 18 or the remote host device 3. CLEN is the length of control information added individually to the header extracted from the packet 41. NLEN is the length of the header extracted from the packet 41.
[0045]
Further, the control unit 21 sets a fixed length in accordance with the maximum length of the packet 41 received from the communication network 2 in the length information (Blen). For example, when Ethernet (registered trademark) is used for the communication network 2, the length information (Blen) is set to a value of 1514 bytes or more excluding the 4-byte CRC.
[0046]
The buffer 61 associated with the buffer information descriptors (BD_1 to m) generated as described above has a configuration as shown in FIG. In FIG. 3, the buffer 61 includes a transfer header storage area H located from the head address (Baddr_start), a control information storage area C, and areas 1 to m located from the physical address (Baddr_1 to m). The areas 1 to m are composed of a header storage area A and a control information storage area C of the header extracted from the packet 41.
[0047]
Next, the control unit 21 writes the generated buffer information descriptors (BD_1 to m) to the unused BD queue 51 in the order of the buffer information descriptor (BD_1) to the buffer information descriptor (BD_m). Next, every time the communication board 11 receives the packet 41, it sequentially reads out the buffer information descriptors (BD_1 to m) from the unused BD queue 51, and by DMA transfer, as shown in FIG. 4, the physical address (Baddr_1 The received packets are sequentially written into the buffer 61 while being overwritten from the position of ~ m). As a result, the headers A1 to Am of the received packet are written in the header storage areas A of the areas 1 to m in the buffer 61, respectively. As a result, only the header portion of the m packets 41 is extracted on one buffer in the buffer unit 22.
[0048]
Next, the control unit 21 sets the control information of each header A1 to Am in each control information storage area C. When writing of m packets 41 is completed and m headers are extracted, transfer processing for providing the extracted header group 42 to the network monitor application 18 or the remote host device 3 is performed. This transfer process will be described later.
[0049]
As described above, the packet received from the communication network 2 is sequentially overwritten in the buffer by the DMA function of the communication board 11, leaving the header portion. Can be eliminated. As a result, it is possible to reduce the load on the host CPU when collecting packet information (header information).
[0050]
When preparing the buffer 61, the control unit 21 sets the length (Bsizereal) of the buffer 61 so as to satisfy the expression (3).
Bsizereal ≧ m × (N + C) + H + Blen (3)
Thus, the length of the buffer 61 is set so that the entire received packet can be written even when the header Am of the m-th packet 41 is stored in the buffer 61.
[0051]
Further, the value of m is set in advance in the control unit 21, but as the value of m is larger, more extracted header information can be provided in a lump, so the extracted header group 42 is transferred. In order to reduce overhead, it is desirable to set a large value to m. On the other hand, the extracted header information is transferred based on the IP. For this reason, the value of m may be limited to the maximum packet size (MTU size; Maximum Transfer Unit size) of the IP. In order to cope with this, it is desirable to use a frame having a large frame size such as a jumbo frame (9000-byte MTU size) as a frame used for transferring the extracted header group 42.
[0052]
Next, processing for transferring the extracted header group 42 accumulated in the buffer 61 to the network monitor application 18 or the remote host device 3 will be described with reference to FIG.
The transfer packet generation unit 24 of the packet information collection unit 15 adds transfer header information corresponding to the transfer destination to the transfer header storage area H of the buffer 61, and includes the transfer header information and the extracted header group 42. An extracted header transfer packet 43 is generated.
[0053]
Therefore, a transfer header information template as shown in FIG. 5 is created in advance and set in the transfer packet generator 24. 5 includes a lower layer header, an IP header, and a UDP header, and the lower layer header has contents for Ethernet (registered trademark) as an example. The lower layer here refers to a data link layer located lower than IP.
[0054]
Note that the UDP port numbers (Src UDP port, Dst UDP port) for both arrival and departure are set in advance to a common value for all destinations by the user. In addition, the IP address (Src IP Address, Dst IP Address) for both the arrival and departure is set in advance by the user, and a common value is set for all the destinations for the departure and arrival addresses. A value or multiple values are set. The IP packet size (Total Length) is also set in advance by the user.
[0055]
The forwarding packet generator 24 creates a forwarding header information template for each destination IP address (Dst IP Address). For each template, since almost all information is a fixed value, a predetermined value is set in advance. Hereinafter, a method for setting information that is not a fixed value will be described.
[0056]
For IP Identification (ID; Identification), a different value is set for each transfer packet. Also, the IP Checksum is updated with the ID update. As this procedure, first, the ID is incremented by 1 for each transfer packet. Next, the IP checksum is reduced by one. However, when 1 is subtracted from the hexadecimal number 0x0001, the hexadecimal number is 0xFFFF.
This eliminates the need to recalculate the IP Checksum over the entire IP header.
[0057]
The UDP Checksum is fixed to 0, and the entire transfer packet is not verified. Instead, when the local host device 1 and the remote host device 3 serving as the transfer destination are on the same segment for the data link layer, an extraction header is obtained by using an error detection function provided by the data link layer. The normality at the time of transferring the group 42 is verified. However, when the transfer destination is the own host device 1, normality verification at the time of transferring the extracted header group 42 is not necessary. This eliminates the overhead associated with generating and verifying the UDP checksum.
[0058]
However, if UDP checksum verification is required, such as when the remote host device 3 as the transfer destination is on a different segment from the host device 1, the UDP checksum generation / verification function normally provided in the communication board 11 Is used to verify the normality when the extracted header group 42 is transferred.
[0059]
When generating a transfer packet, the transfer packet generation unit 24 sequentially selects a template by a round robin method, copies the selected template to the transfer header storage area H of the buffer 61, and transfers the transfer header information and the extraction header. An extracted header transfer packet 43 consisting of a group 42 is generated. Next, the generated extracted header transfer packet 43 is registered in the input queue of the UDP / IP unit 16. As a result, the UDP / IP unit 16 transfers the registered extracted header transfer packet 43 in accordance with the destination IP address (Dst IP Address).
[0060]
If the destination IP address is that of the local host device 1, a predetermined application (for example, a network monitor) provided in the application unit of the local host device 1 is determined according to the destination UDP port number (Dst UDP port). The extracted header group 42 included in the registered extracted header transfer packet 43 is provided to the application 18).
[0061]
Further, in order to transmit the extracted header transfer packet 43 to the remote host device 3, an address corresponding to the data link layer (for example, MAC address) indicating the remote host device 3 for the destination data link layer and a destination IP address are obtained. Need to be associated. For this purpose, an address resolution procedure according to ARP (Address Resolution Protocol) is generally used.
[0062]
However, when this address resolution procedure is used, packets cannot be transmitted until the procedure is completed, so the number of extracted header transfer packets 43 waiting to be transmitted increases. As a result, the extracted header transfer packet 43 remains untransmitted. In some cases, it may be lost. Therefore, in this embodiment, an address table (ARP table) in which the data link layer compatible address and the destination IP address are recorded in association with each other is set in the UDP / IP unit 16 in advance, so that the address resolution procedure can be omitted. To.
[0063]
1 is recorded on a computer-readable recording medium, and the program (packet information collecting program) recorded on the recording medium is read into a computer system. The packet information collecting process may be performed by executing. Here, the “computer system” may include an OS and hardware such as peripheral devices.
[0064]
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system.
[0065]
Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
[0066]
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.
With this packet information collection program, the above-described packet information collection apparatus can be realized using a computer such as a personal computer.
[0067]
Next, a description will be given of an embodiment of a communication network monitoring system using a packet information collection program, which realizes a packet information collection device using a personal computer. FIG. 7 shows the configuration of the communication network monitoring system. FIG. 8 shows a hardware configuration of the communication network monitoring system shown in FIG. In the communication network monitoring system shown in FIG. 7, the host device (PC1) corresponds to a packet information collection device. Specifically, the function of the packet information collection unit 15 of the device driver unit 13 of FIG. 1 is realized by executing the packet information collection program of the present embodiment on a personal computer (PC1) manufactured by SUPERMICRO.
[0068]
The host device (PC1) is connected to the file system (FS1), and this file system (FS1) corresponds to the storage device (main memory) of the host device (PC1). The buffer unit 22 and the BD queue unit 23 of FIG. 1 are provided on the file system (FS1).
[0069]
The host device (PC1) includes a communication board (NIC1) having a DMA function. This communication board (NIC1) corresponds to the communication board 11 of FIG. 1 for header extraction. The communication board (NIC1) acquires a packet flowing on the communication network to be monitored, and DMA-transfers the acquired packet to a buffer on the file system (FS1) and writes it. Note that the packet flowing on the communication network to be monitored is generated by a traffic tester.
[0070]
The host device (PC1) also includes a header transfer communication board (NIC2) for transferring the extracted header transfer packet to the remote host device (PC2). This communication board (NIC2) is connected to the communication board (NIC2) of the remote host device (PC2).
[0071]
In the communication network monitoring system shown in FIG. 7, the packet information is collected when the header is collected using the header extraction method of the present embodiment and when the header is collected using the conventional header extraction method. In order to compare and evaluate performance, the results of header collection experiments are shown in FIGS. FIG. 10 is a graph showing the header acquisition rate obtained from the experimental results as an index for performance evaluation. Similarly, FIG. 11 is a graph showing the CPU load of the PC 1 obtained from the experimental results. FIG. 9 shows the operating environment conditions for this experiment. Conditions 1 and 2 shown in FIG. 9 correspond to the header extraction method of this embodiment, and conditions 3 to 6 correspond to the conventional header extraction method.
[0072]
In the experiment, in any operating environment of conditions 1 to 6, a commercially available IP traffic tester is used to monitor Ethernet frames from 64 bytes to 1518 bytes (including CRC) at the full rate of Gigabit Ethernet. The packet header is stored in a file by PC1 or PC2. Condition 1 is the case where the header information collected by the host device (PC1) is transferred to the remote host device (PC2) as an extracted transfer packet, and the remote host device (PC2) stores the packet header in a file. It has become. Conditions 2 to 6 are for the case where the host device (PC1) stores the packet header in a file.
[0073]
As a result of these experiments, as shown in FIG. 10, the effect of improving the header acquisition rate by a factor of two or more was recognized by the header extraction method of this embodiment. Moreover, as shown in FIG. 11, the effect that the CPUU load is reduced to 1/2 or less was recognized.
[0074]
As described above, according to the present embodiment, the packet is written to the storage area in the buffer specified by the buffer information descriptor by the DMA transfer, so that the host CPU itself stores the packet information in the buffer in the host memory. No need to copy. As a result, it is possible to reduce the load on the host CPU when collecting packets by receiving packets from the communication network.
[0075]
Furthermore, since the transfer packet including the packet information accumulated in the buffer is generated, the collected packet information can be transferred to a device different from the host device collecting the packet information. As a result, packet information collection can be performed by an independent device different from a device that realizes other functions (such as an analysis function) related to the network monitor. In addition, packet information can be provided to a plurality of devices by a transfer packet.
As a result, when realizing the network monitor function, it is possible to achieve load distribution of the processing.
[0076]
The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like within a scope not departing from the gist of the present invention.
[0077]
【The invention's effect】
As described above, according to the present invention, a buffer is provided on a memory accessible from the communication interface device, and a buffer information descriptor for designating a storage location of a packet which is a specific storage area in the buffer is created. Since the communication interface device writes the packet to the storage area in the buffer specified by the buffer information descriptor by DMA transfer, the host CPU needs to copy the packet information to the buffer in the host memory. Will disappear. As a result, it is possible to reduce the load on the host CPU when receiving packets from the communication network and collecting packet information.
[0078]
Furthermore, if the size of the storage area is set to the size of the packet information or the size of the packet information plus additional information, the buffer size can be reduced and the memory capacity can be reduced. The effect of being able to be obtained.
[0079]
In addition, if the buffer information descriptors respectively indicating the continuous storage areas in the buffer are ordered, a plurality of packet information can be stored in the continuous storage areas. It becomes possible to process a group efficiently (such as a transfer process). As a result, it is possible to further reduce the load on the host CPU.
[0080]
In addition, if the transfer packet including the packet information stored in the buffer is generated, the collected packet information can be transferred to a device different from the host device collecting the packet information. As a result, packet information collection can be performed by an independent device different from a device that realizes other functions (such as an analysis function) related to the network monitor. In addition, packet information can be provided to a plurality of devices by a transfer packet. As a result, when the network monitor function is realized, an effect that the load of the processing can be distributed is obtained.
[0081]
Further, if the header template for the transfer packet is stored in advance, it is possible to reduce the load on the host CPU for the transfer packet generation process.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration example of a communication network monitoring system using a packet information collection device according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a BD queue unit 23 shown in FIG.
3 is a diagram showing a configuration of a memory area in a buffer 61 in a buffer unit 22. FIG.
FIG. 4 is a diagram for explaining processing for extracting packet information (headers) of a plurality of packets 41 on a buffer 61;
FIG. 5 is a diagram for explaining processing for generating an extracted header transfer packet;
FIG. 6 is a block diagram showing another configuration of the BD queue unit 23 shown in FIG.
FIG. 7 is a block diagram showing an example of a communication network monitoring system using a packet information collection device according to an embodiment of the present invention.
8 is a table showing a hardware configuration of the communication network monitoring system shown in FIG.
9 is a table showing operating environment conditions for a performance evaluation experiment of the communication network monitoring system shown in FIG. 7;
FIG. 10 is a graph showing a header acquisition rate obtained from the results of a performance evaluation experiment.
11 is a graph showing the CPU load of the PC 1 of FIG. 7 obtained from the results of the performance evaluation experiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Host device, 2, 4 ... Communication network, 3 ... Remote host device, 11, 12 ... Communication board, 13, 14 ... Device driver part, 15 ... Packet information collection part, 16 ... UDP / IP part, 17 ... Socket , 18 ... Network monitor application, 21 ... Control part, 22 ... Buffer part, 23 ... BD queue part, 24 ... Transfer packet generation part, 25 ... DMA part, 41 ... Packet, 42 ... Extraction header group, 43 ... Extraction header Forwarded packet.

Claims (8)

A packet information collection device comprising a communication interface device connected to a communication network, and collecting header information at the head of a packet received by the communication interface device,
A buffer provided on a memory accessible from the communication interface device;
Descriptor storage means provided on the memory for storing a buffer information descriptor indicating a specific storage area in the buffer;
Control means for designating the storage destination of the packet by the buffer information descriptor,
The control means generates a plurality of the buffer information descriptors for one buffer,
The buffer information descriptor has a head address when writing the packet into the buffer,
The start address of each of the plurality of buffer information descriptors is sequentially shifted by the size of the header information or the size of the header information plus additional information,
The control means stores the plurality of buffer information descriptors in the descriptor storage means in the order of the head address,
The communication interface device sequentially reads the buffer information descriptor from the descriptor storage means each time a packet is received , and overwrites the received packet from the head address of the read buffer information descriptor by DMA transfer .
A packet information collecting apparatus. The packet information collection device according to claim 1, further comprising: a transfer packet generation unit that generates a transfer packet including the header information accumulated in the buffer. The transfer packet generation means includes:
The packet information collection device according to claim 2 , wherein a header template of the transfer packet is stored in advance. The packet information collection device according to claim 2 or 3 , wherein the header information is transferred to the plurality of preset transfer destinations by the transfer packet. A packet information collection method in a packet information collection device comprising a communication interface device connected to a communication network and collecting header information at the head of a packet received by the communication interface device,
Including a step of generating a plurality of buffer information descriptors indicating a specific storage area in a buffer provided on a memory accessible from the communication interface device for one of the buffers,
The buffer information descriptor has a head address when writing the packet into the buffer,
The start address of each of the plurality of buffer information descriptors is sequentially shifted by the size of the header information or the size of the header information plus additional information,
Storing the plurality of buffer information descriptors in descriptor storage means in the order of the head address;
Each time the communication interface device receives a packet, it sequentially reads out the buffer information descriptor from the descriptor storage means, and overwrites the received packet from the head address of the read buffer information descriptor by DMA transfer;
A packet information collecting method, further comprising: The packet information collecting method according to claim 5 , further comprising: generating a transfer packet including the header information accumulated in the buffer. A packet information collection program for performing packet information collection processing in a packet information collection device that includes a communication interface device connected to a communication network and collects header information at the head of a packet received by the communication interface device There,
The buffer information descriptor indicating a specific storage area in the buffer provided in the communication interface apparatus accessible from a memory, which to execute processing for generating a plurality in the computer for one of the buffer,
The buffer information descriptor has a head address when writing the packet into the buffer,
The start address of each of the plurality of buffer information descriptors is sequentially shifted by the size of the header information or the size of the header information plus additional information,
A process of storing the plurality of buffer information descriptors in a descriptor storage means in the order of the head address;
Each time the communication interface device receives a packet, the buffer information descriptor is sequentially read from the descriptor storage means , and a process of overwriting the received packet from the head address of the read buffer information descriptor by DMA transfer;
Further packet information collection program for causing a computer to execute. The packet information collection program according to claim 7 , further causing the computer to execute a process of generating a transfer packet including the header information accumulated in the buffer.

Images