KR20050100470A - Method and system for traffic information detection integrated of difference networks - Google Patents

Abstract

The present invention relates to a method and system for gathering integrated traffic information of heterogeneous networks. In a network management method for collecting network traffic information by performing a function between an NMS, an EMS, a gateway, and a network agent, an agent is registered and managed in an NMS GUI. Passing the command to the gateway, receiving the management command from the gateway and starting monitoring, opening the interface for each agent, determining whether the filter policy and the monitoring cycle conditions are satisfied when the monitoring result is received from the open monitoring interface; In addition, if the filter policy and the monitoring cycle conditions are satisfied, the monitoring results are collected according to the characteristics of the lower agent, and the corresponding information is sampled and stored in a database.

Description

Integrated traffic information collection method and system of heterogeneous networks {Method and System for Traffic Information Detection Integrated of Difference Networks}

The present invention relates to traffic information collection and performance analysis / reporting of heterogeneous network traffic information delivery systems. More specifically, a variety of network elements and various device vendors provide traffic of different technologies. It is delivering information.How to collect integrated traffic information of heterogeneous network that collects and collects information so that administrator can manage and manage these different traffic information as one application and manage network traffic information consistently. It is about.

Representative of conventional network traffic information transmission technology, NetFlow embedded in Cisco's network equipment and remote network monitoring / simple network management protocol (RMON / SNMP) There are three types of management protocols, and packet capture that can measure traffic in segments.

Here, the RMON is a function to extend and manage the function of SNMP designed to manage a communication network in a remote location. Standard SNMP transport structure and commands are used to define how remote monitoring devices collect and store network data in a distributed LAN environment.

Since the existing functions focused only on the connection of each communication device (router, bridge, hub, etc.), it was not possible to obtain necessary information such as traffic characteristics and usage in the LAN environment. However, RMON expands the concept of LAN protocol analyzer, installs remote monitoring function in each communication equipment, collects the information of the communication equipment, and delivers it to the management place.

1 is a system diagram illustrating a data collection and result checking function using a Cisco Netflow service.

As shown in FIG. 3, Cisco has three modules for netflow data verification.

First, the netflow data generated from the Netflow Data Exporter 12 is transferred to the NetFlow Flow Collector 14 using the User Datagram Protocol (UDP) protocol. The flow selector 14 may receive data from several data exporters 12, and distinguishes and stores the data from each data exporter 21 in a database. The NetFlow Data Analyzer 21 informs the flow selector 14 of the equipment to be monitored and controls the monitoring request. In addition, the netflow data collected through the database (NetFlow Data files) 16 is displayed on the user monitor 22.

2 is a diagram illustrating a lower interworking structure of a network node manager (NNM) that measures network traffic based on the RMON / SNMP.

First, a network polling command from the NNM 30 is transmitted to a network monitor (netmon: detecting and monitoring a node on a network) 31.

The network polling command carries out a network monitoring command to periodically perform network performance measurements.

After receiving the network poll command, the network monitor process continues to send SNMP requests periodically to the desired agent.

The response is then sent to the Open View Phase Manager Demon (ovtopmd) process, which is responsible for IP discovery and layout for the HPOVNNM topology database (33), and the ovtopmd (33) sends the received data to the database. Save to 34.

The Open View Windows (ovw) process 35 receives the contents of the database 34 and outputs them to the graphical GUI for the administrator to verify.

RMON is a traffic information detection method recommended by 'IETF' as a standard. It has the advantage of being independent of device manufacturers, but it is still applied only to expensive large-scale backbone network equipment and does not support medium or small scale network equipment at all. There was a problem supporting only a part.

In addition, Cisco's netflow has the advantage of being able to measure traffic on a router basis, but there is a fatal weakness that cannot be applied to a network including a router other than Cisco.

In addition, the packet capture technology has the advantage that it can be implemented only by software without additional hardware, but if the network is divided into a switching hub that does not support port mirroring, such as a LAN segment, a LAN segment There is a problem that is difficult to apply to the modern network that is divided into a plurality of LAN segments because there is a constraint that must be applied every time.

The present invention is to solve the above-mentioned problems of the prior art, the purpose of which is to deliver the traffic information of different technologies from various network devices and various device manufacturers, the administrator integrates the different traffic information into one application The present invention provides a method and system for gathering integrated traffic information of heterogeneous networks that collects and collects information to manage and consistently manage network traffic information.

The integrated traffic information detection process of heterogeneous networks to achieve the object of the present invention is a network that collects network traffic information by performing functions between NMS (Element Management System), EMS (Element Management System), Gateway (Gateway) and network agents A management method, comprising: a first process of registering an agent and transmitting a management command to a gateway in the NMS graphical user interface (GUI); and a second interface for opening an agent-specific interface when the management command is received from the gateway and monitoring starts; A third step of determining whether a filter policy and a monitoring cycle condition are satisfied when the monitoring result is received from the open monitoring interface; and if the filter policy and the monitoring cycle condition are satisfied, the monitoring result is determined according to the characteristics of the lower agent. Collects data and collects that information Sampling and it is characterized in that made in a fourth process of storing in the database.

The integrated traffic information collection system of heterogeneous networks to achieve the object of the present invention is EMS (Element) to collect the statistical information of the subnet (Subnet) and the monitoring information for the host in the subnet unit (Segment) or LAN (LAN) unit A system for collecting and analyzing traffic information of a network, including a management system) and a network management system (NMS) for checking and analyzing traffic by receiving the information collected from the EMS, the traffic information for different types of networks. Collecting information from each agent and each of the different agents and collects the information delivered to the EMS to enable a single point of view independent of the underlying network technology in the NMS of the upper end and the management policy from the EMS Characterized in that comprises a gateway for receiving a command regarding.

The present invention made as described above will be described in detail with reference to the accompanying drawings.

3 is a configuration diagram of an integrated traffic information collection system of a heterogeneous network according to an embodiment of the present invention, an agent (RMON, CISCO IOS, RTMan, SNMP) (collecting traffic information on network status from each heterogeneous network) ( 101-104), collecting information from each agent 101-104, acting as a manager function for each agent by function, receiving commands on management policy from the upper EMS, opening an interface for agents meeting the corresponding conditions, and periodically updating In order to operate the internal module and store the network traffic information sampled according to the corresponding period in the knowledge base 111, the gateway 110 to the statistics information and subnet of the subnet in units of segments and LANs. EMS 120 to collect the monitoring information for, and the collected information of a plurality of segment units through the EMS Month received consists of NMS (130) for receiving the check and analysis, fault and alarm information in an integrated manner so as to respond to the network changes.

Here, the gateway 110 samples and stores each interface unit 111 to 114 collecting data from each agent, and network traffic information received through each interface unit 111 to 114 according to a period. A knowledge base 115 is included, and each of the interface units 111 to 114 receives an instruction regarding a management policy from the EMS and opens an interface unit 111 to 114 for an agent meeting the corresponding condition. It is configured to operate an internal module for periodic updater.

The interface units 111 to 114 interface the RMON interface unit 111 to interface the RMON Agent, the netflow interface unit 112 to interface the CISCO IOS, and the RTMan Agent. The packet capture interface 113 and the SNMP interface 114 to interface the 'SNMP Agent'.

When described in more detail with reference to Figures 3 and 4 attached to the operation according to the embodiment of the present invention configured as follows.

First, the present invention integrates existing heterogeneous traffic measurement technologies into one, and develops a next-generation integrated traffic measurement technology suitable for modern multi-technology and multi-vender-based networks. A gateway for developing protocol- and user-specific load analysis system S / W that encompasses enterprise-wide networks, and integrating network load information obtained from heterogeneous equipment and technology It was developed to improve the readability of information on heterogeneous equipment and to integrate the netflow, RMON, SNMP, and packet capture functions so that administrators can receive consistent traffic analysis reports.

3 is a block diagram of an integrated traffic information collection system of a heterogeneous network according to an embodiment of the present invention, the heterogeneous traffic extracting technology collects netflow, RMON, packet capture, and SNMP through a single gateway .

That is, the heterogeneous equipment or technology of the network has a traffic status report of each agent 'RMON Agent 101, CISCO IOS 102, RTMan Agent 103, SNMP Agent 104', each agent 101 104 collects traffic information on the network status and delivers it to the manager.

Here, the 'CISCO IOS' 102 is a Cisco equipment-specific operating system equipped with netflow, 'RTMan Agent' 103 is a traffic capture agent of 'NetMan', 'SNMP Agent' 104 is a TCP / Agent that delivers management information using IP-based SNMP protocol.

As such, each agent delivers traffic collection information of the device or network to which the agent belongs.

That is, the gateway 110 is a module that collects information from different agents 101 to 104 at the bottom, and enables a single point of view confirmation independently of the underlying network technology in the NMS 130 at the top.

In addition, the gateway 110 has an interface capable of collecting data from other types of agents 101 to 104, and serves as a manager for agents for each function.

That is, the interface units 111 to 114 include an RMON interface unit 111, a netflow interface unit 112, a packet capture interface unit 113, and an SNMP interface unit 114, and the EMS 120 as an upper portion. Command from the management policy, and the interface 111 to 114 for the agent meeting the conditions are opened.

Receives data from the interface units 111 to 114 and operates an internal module for periodic update. The network traffic information sampled according to the corresponding period is stored in the knowledge base 115. The knowledge base 115 represents a database capable of storing information.

The information thus collected is reported at the request of the EMS 120. The EMS 120 collects the statistical information of the subnet and the monitoring information of the hosts in the subnet in units of segments or LANs.

Therefore, in a network composed of several segments, there is one EMS per segment.

The EMS 120 delivers the collected information back to the upper NMS 130. The NMS (Network Management System) is integrated with the EMS 120 to check the collected information through the multiple segments, and not only collect data from the EMS 120, but also receive failure or alarm information to change the network Allow for immediate response.

The NMS 130 represents a user access interface through which a network administrator can confirm the management information in the form of actual graphic or item-specific text 101 to 104.

Through the NMS 130, an administrator sets various environments such as location of the agents 101 to 104, agent network address, agent property setting and monitoring period, and monitoring filter setting, and provides the EMS 120 with the corresponding information. Pass through the gateway 110 through. And, by setting and delivering the item you want to receive reports to obtain the necessary information from the EMS (120).

4 is a flowchart illustrating a process of collecting integrated traffic information of a heterogeneous network according to an embodiment of the present invention, and more specifically, illustrates a function performing procedure between an NMS, an EMS, a gateway, and a network agent.

As shown in the figure, first, the agents 101 to 104 are newly registered in the NMS GUI or a confirmation / change / removal command is transmitted to the gateway 110. (S102)

The gateway 110 receives a management command and determines whether to start, change, or end monitoring. (S104)

That is, if the management command of the gateway 110 needs to start monitoring anew, the interface for each of the agents 101 to 104 is opened. (S106) (S110).

If the monitoring information is changed, the monitoring is restarted on the basis of the changed information from the opened interface by backing up the previous monitoring result (S112) (S114).

At the end of monitoring, the monitoring interface is closed (S116).

If the monitoring result is received from the opened monitoring interface units 111 to 114, it is checked whether the filter policy and the monitoring period are satisfied. (S120 to S128)

If the filter policy and the monitoring period are satisfied, the accumulated information is classified into agents and stored in the knowledge base 115 by database (S132 to S150).

If a packet that does not satisfy the filter policy is received, the packet is discarded. (S126) If the monitoring period input from the NMS GUI has not been exceeded, it is determined whether to accumulate in the current information and re-monitored.

In addition, the monitoring result collects data according to the characteristics of the lower agents (NetFlow, RMON, SNMP, Packet Capture), samples the information (S142 to S148), and stores the information in the knowledge base 115 (S150).

The stored data can be confirmed in the NMS GUI in a consistent format regardless of the agent type of the underlying network.

Although a preferred embodiment according to the present invention has been described above, it can be modified in various forms according to the type of agent, and those skilled in the art can make various modifications without departing from the claims of the present invention. It is understood that examples and modifications may be made.

As described above, since a gateway for processing the reporting information of heterogeneous networks according to the present invention, that is, network performance analysis status information received from the netflow, RMON, SNMP, and packet capturing functions, a gateway for integrating heterogeneous traffic information is developed. It can support the traffic information detection technology, so that the administrator can easily analyze the traffic information regardless of the network resources.

In addition, the function distribution by layer reduces the load of the traffic management function in a network in which a large amount of traffic is delivered, and clearly distinguishes the processing of various traffic information by functions, thereby allowing the end manager to easily check the network load information. It has an effect.

1 is a block diagram of a data collection and result confirmation system using a conventional netflow service,

2 is a diagram of a downlink structure of network node management for measuring network traffic based on RMON / SNMP;

3 is a system configuration diagram for collecting aggregated traffic information of heterogeneous networks according to an embodiment of the present invention;

4 is a flowchart illustrating a process of collecting integrated traffic information of a heterogeneous network according to an embodiment of the present invention.

<Description of Symbols for Major Parts of Drawings>

101: RMON Agent 102: CISCO IOS

103: RTMan Agent 104: SNMP Agent

110: gateway 111: RMON interface unit

112: netflow interface unit 113: packet capture interface unit

114: SNMP interface unit 115: Knowledge Base

120: EMS 130: NMS

Claims (10)

In the network management method for collecting network traffic information by performing functions between NMS (Element Management System), EMS (Gateway Management), Gateway (Gateway) and network agent, A first step of registering an agent and transmitting a management command to a gateway in the NMS graphical user interface (GUI); A second step of opening an agent-specific interface upon receiving a management command from the gateway and starting monitoring; A third step of determining whether a filter policy and a monitoring cycle condition are satisfied when a monitoring result is received from the opened monitoring interface; And A fourth process of collecting data according to characteristics of a lower agent and sampling and storing the corresponding information in a database when the filter policy and the monitoring cycle conditions are satisfied; and integrated traffic of heterogeneous networks, comprising: Information collection method. The method of claim 1, If the monitoring is changed in the second process, backing up the previous monitoring result, restarting the monitoring based on the changed information from the open interface, and then returning to the third process. Traffic Information Collection Method. The method of claim 1, The method of claim 2, further comprising closing the monitoring interface when the monitoring ends. The method of claim 1, And receiving a packet that does not satisfy the filter policy in the third process and then discarding the packet and re-receiving the monitoring result. The method of claim 1, The method of claim 3, further comprising determining whether or not to accumulate the current information and re-monitoring if the monitoring period has not been exceeded in the third process. The method of claim 1, In the fourth process, the lower agent includes integrated traffic information of heterogeneous networks, including NetFlow, Remote Network Monitoring (RMON), Simple Network Management Protocol (SNMP), and Packet Capture. Collection method. Element Management System (EMS) that collects statistical information of the subnet and monitoring information about hosts in the subnet in segments or LANs, and NMS (Network Management System) that checks and analyzes traffic by receiving information collected from the EMS In the system for collecting and analyzing traffic information of the network, including; Each agent collecting traffic information for different types of networks; And A gateway that collects information from each of the different agents and transmits the information to the EMS so that the NMS of the upper end can independently confirm the result of the single network independently of the lower network technology, and receives a command regarding the management policy from the EMS. Integrated traffic information collection system of heterogeneous networks, characterized in that made. The method of claim 7, wherein The agent is a RMON agent, CISCO IOS, RTMan Agent, SNMP traffic integration system of the heterogeneous network, characterized in that it comprises a configured Agent. The method of claim 7, wherein The gateway includes a respective interface for collecting data from each agent, and a knowledge base for sampling and storing the network traffic information received through each interface according to the cycle, Wherein each interface receives a command regarding a management policy from the EMS, opens an interface for an agent meeting a corresponding condition, and operates an internal module for periodic update. The method according to claim 8 or 9, Each interface includes an RMON interface unit for interfacing the 'RMON Agent'; A netflow interface unit to interface the 'CISCO IOS'; A packet capture interface unit to interface the 'RTMan Agent'; And And an SNMP interface unit for interfacing the 'SNMP Agent'.