TW201038009A - Real-time traffic measurement system of IP network centralized network management and distributed nodes - Google Patents

Abstract

The present invention provides a real-time traffic measurement system of IP network centralized network management and distributed nodes, which comprises two subsystems such as the Distributed Real-time Probe (DRP) and the server host machine platform. The Distributed Real-time Probe (DRP) subsystem includes the functions of: real-time end-to-end network performance Active Testing (AT), real-time network performance Passive Monitoring (PM), and so on. The server host machine platform subsystem is formed of a website server, a database server, and a report server. The purpose of the present measurement system is to detect and measure the related parameters, such as the stability and reliability, etc., of the IP network which are used as the basis for the performance detection/diagnosis/simulation of the current network and future network flow trend forecast

Description

201038009 VI. Description of the Invention: [Technical Field] The present invention relates to a centralized traffic management system for centralized network management and distributed distribution of ip networks, which mainly consists of a distributed instant detector (DRP) and a server host. The two subsystems, such as the platform, are responsible for the collection of traffic or energy measurement and other functions between nodes or nodes on the network. [Prior Art] At present, the traditional network traffic measurement technology includes modes such as ping mode and traffic control system, Netflow, Cflow, and Sfl〇w. The technical disadvantages are as follows: ^ ° ‘West (1) Use the ping or frt command to pass the ICMP packet to test whether the other part can be connected via the network and display the response time. The shortcoming is that the point-to-point single machine 1 trial mode 'poor performance' can not see the effectiveness of the overall network topology. The second disadvantage is the parameter of Hi 〇ne-waydelay. The third disadvantage is that the transmission cannot be measured effectively: the neck can be located. (2) The shortcoming of the traffic statistics mode is the use of sampling network traffic for the simulation of traffic performance. 'Because the network traffic is sampled at a certain rate, there will always be distortion, so it cannot be measured. The actual parameters of the network traffic performance (such as Packet 1 〇 ss, 〇 胃 stomach (4) and 0 jltter, °ut of order sequences, Romid-trip delay 盥 jitter, etc.). From this, it can be seen that there are still many shortcomings in the above-mentioned conventional methods, which are not a good design and are improved. In view of the shortcomings of riding in the above-mentioned system, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in research and development of this network centralized network management and distributed distribution of instant traffic measurement system. . SUMMARY OF THE INVENTION The object of the present invention is to provide a new and efficient traffic measurement technology that can view, measure, and collect data related to the stability and reliability of an IP network as a current network performance check. The basis for initial breaks, simulations, and predictions of future traffic growth. 201038009 Type Detection Service 'Detectable IP Internal Network IP Internal Network and External Network Network Another object of the present invention is to provide interconnection performance between various types of IP networks and external networks, to quickly clarify and define layers, Application layer network or system issues. The IP network Aesaki, the distributed layout point, the chores measurement system that achieves the above-mentioned inventions consists of two subsystems, the distributed real-time detector (DRP) and the feeder host platform, which are responsible for each of the networks. Traffic collection or energy measurement between nodes or nodes and human-machine interface. The instant end-to-end _ path performance active measurement function can measure the performance parameters of the network, such as single or two-way network transmission, transmission delay, transmission "shake

When the mobile and the packet are lost, the network can be used to capture the packet records of the endpoints or routers on the network and the f-exchange situation of the application. In addition, the network real-time information measurement and measurement of the ship's domain platform is composed of Qing Ship ^ #料杂(四) and the report feeder. [Embodiment] Please refer to the figure-shown as a schematic diagram of the instant traffic measurement system of the invention and the distributed arrangement, which mainly includes:

A distributed real-time probe (DRP) is installed on each node 2 of each IP backbone network. The distributed instant detector i is industrial grade in the hardware part. The computer is a development platform with the same scalability as the general commercial PC architecture, but the stability is more reliable, enough to meet the requirements of long-term non-stop work; Linux is used as the operating system in the software part, and it has stable operation and allows many people to work. The advantages of the online and relatively less resource-intensive systems, and the installation of a package capture program (CaptureAgent); currently distributed decentralized instant detector 1 integrated two functions, respectively, end-to-end (gnd-to-end) Network performance (Performance) active measurement, real-time network performance passive monitoring and other functions, and distributed instant detection 1 placed on the network node 2 'usually an edge router (Edge Router) or customer terminal (Customer End) Measure network performance and traffic monitoring through router or switch replication (Mirr〇rP〇rt) or network tap (Tap), through router or client terminal Node 2 connects to node 2 as IP backbone network 3, and one of the designated nodes 2 can transmit information back to the server platform by means of FTP 201038009 (File Transfer Protocol) protocol; 4' is a connection node 2 formed by any router or client terminal connected to the Ip backbone network 3 (Ip-Heart Plus) through the network, and can centrally manage the traffic measurement of each of the backbone networks 3, and The server host platform 4 is installed with the management program ❺ 心 心 (4). The server host platform 4 includes a website ship 5, a database player 6 and a report ship 7, wherein the website server 5 provides a human machine interface for viewing. , measuring the stability and reliability of the Ip network and other related parameters 'and transfer the parameters to the database ship 6; the database ship 6 is responsible for storing the connection (10) station key H 5 # measured parameter data, and For the report valuer 7 to detect; and the report feeder 7 detects the stored measurement parameter data through the database feeder 6 and is responsible for outputting the final detection result generated by the network, including the performance parameter report of the network, Network throughput performance report (Throughput Performan Ce Report) ^ ^(Network Flow

Trend Forecast Report) and various "bad packages" analysis reports on the Internet such as DDoS attack, file sharing (p2P), spam (Spam), virus (Vims), pornography (Pornography) , Skype (skype), instant messaging (IM), worm (w〇m^, and the host platform 4 can also be tied to a separate towel management secret 8, the centralized management system 8 and distributed The instant detector i will receive the data by FTP (FileTransferPr〇t〇c〇1) file transfer protocol.

The website server 4 responsible for the human-machine interface of the feeding machine host platform 4 uses PHP 〇 (HyperteXtPreprocessor) or Java programming language to write dynamic web pages, and has the rights management function, that is, only the pass code and (four) _ In order to query or lose the pure form information. Referring to FIG. 2, it is a distributed instant detector of the instant network traffic measurement system of the centralized network management and distributed distribution of the JP network of the present invention! The distributed instant detector 1 includes an active end-to-end network performance active test module U (Active Testing; at), which is distributed over the network. When the transit time is over, the flow 4 is analyzed and the secrets are analyzed, and the measured network parameters or the collected network information are collected and transmitted through the standard transmission agreement 16 (factory ^). Transmitting data; Passive Monitoring (PM), which uses the packet capture program of the 201038009 scattered instant detector to capture packet records and applications flowing through various endpoints or routers on the network. In the case of data exchange, the management program is imported into the server to simulate the construction of real network traffic, which is the network performance parameter measured or the collected network traffic and the data transmission protocol. (FTP) to transmit data to the server; a probe NFS File System 15 is transmitted through the standard transmission protocol 16 (FTP) to open the directory or standard record recorded by the probe; Probe data 14 (MySQL DB), which stores the test data of the instant end-to-end network performance active test module 11 and the real-time network performance passive monitoring module 12, and provides it to the probe end database interface 13 (CDBI); The end of the library interface 13 (CBI), through the directory or standard file provided by the probe end network broadcast system 15 (NFS), and the data of the age of the probe end database 14 (MySQLDB) 'generate - The form interface 'is detected by the probe end system; the server host platform includes: a server end network broadcast system 44 (NFS), which is transmitted through the file transfer protocol 16 (Flp) to access the servo The directory or file stored on the server side; - the server side database 43 (MySQLDB), which stores the data of the server host platform 4 and provides it to the server side database interface 42; - the graphical interface 41_) The ship-side network slot system 44_), as well as the data in the feed server database interface 42 (SDBI) are graphically represented; - the report ship 7 (RS), which is the value of the network end of the value-of-service network 44 ( Nfs), and the results detected by the ship-side database interface 42 (SDBI) The report; - Ship II end database 42 (S_, is the data stored in the receiver to the outside of the storage tank, and the received data to generate a form interface to provide the feeder end of the manager, when dispersed When the instant detector i is placed in the equipment room, it is recommended to use the sideband network (〇Ut-〇f_bandNet丽 k) to make the data fine if the scattered cuts are placed in use, then the same band and network can be used. -bandNetwork) Please return the information to the place, Lin Xiu network _ points == instant messaging 201038009 Ο

The schematic diagram of the active test module test of the measurement system includes a centralized management system 8 and a distributed instant detector 1 (DRP) installed at each node 2 of the IP backbone network 3, and the centralized management system 8 is the server host platform 4 . The centralized management system 8 is responsible for collecting the data collected by the distributed instant detector 1 and then analyzing the data, and periodically generating reports, and providing the client to enter the system to observe the network status at any time; the distributed instant detector (DRP) can instantly simulate the generation of customized traffic' and provide it to the centralized management system 8 IETF-compliant ΠΜ/ΙΡν6 packets, and use the Internet Time Server (NTP) or Satellite Navigation System (GPS) to achieve time Synchronize. The measurement procedure is to place a part of the scattered instant detector 1 (DRP) at the selected two ends, and then specify a part of the scattered instant detector ^Dj^p) using the TCp/u〇p protocol. The packet is transmitted, and the information source of the beta is the satellite navigation system (GPS) (Gi〇bai positi〇ning System) or the network internet time server (Ντρ) (^ stomach! ^ Time pr〇t〇c 〇1) The host can measure the end-to-end network performance parameters. The IP network towel network management system and the green cake point instant messaging measurement secret function of the present invention mainly generate traffic to analyze the performance of the network by means of a real-time detector (DRP) distributed over the network. In the traditional network architecture, the packet transmission that is set at both ends is done in the "Best Eff〇rt," manner, and the transmission of each packet is made; However, when the network bandwidth is insufficient, congestion occurs, or the network device fails __ing, packet delay (packetdelay), transmitted jitter G (four), packet sequence omission (mi_de^ or packet loss) may occur. The active test (ActiveTesting; AT) module mainly provides test items including: (1) One way delay (2) Two-way delay (Round-Trip delay) (3) Delay variation (4) Packet loss (5) Packet out-of-order Please refer to Figure 4 for the network of the IP network centralized network management and distributed distribution of the instant traffic measurement system. Fill in the _ map, in the centralized management system of the towel. The main function is to control and manage all the distributed (four) detector 1 (DRP) equipment, and return all the test results = 201038009 in the management of Wei 8's database towel 'and Closed mode analysis wire ^ decentralized instant detector 1 (DRP) 11 is mainly Used in the RP backbone network 3's EdgeR〇uter or Customer End, connected to the P0P, PE or client device, built-in satellite navigation system (GPS) and Internet time The service is handsome, and the accuracy of the - terminal is below 250 ns. The main function is to simulate the generation of various application service services, and upload the received related information to the centralized management system 8. See Figure 5, which is the instant network performance passive monitoring module of the present invention. (4) Listening to M〇nitoring; PM) The architecture diagram of using the client (dient) and the feeding device (π·) The distributed instant detector l (DRP) is installed on the client, and the server seryer is the centralized management system 8. The centralized management system 8 further includes a website ship 8 and a database feeder 82. a report server 83, and a package capture agent (Disture Agent) is installed in the distributed instant probe 1 (DRp), and a capture manager (CaptureManager) is installed on the server (Server), and the data is served by a client (diems) or Server 9 hub 9 through the network 1〇 Data transmission. Instant Network Performance Passive Monitoring Module 12 (pM) can analyze and solve problems for the application to help users predict the performance of the application under different settings and different network conditions. The measurement procedure is to use the packet acquisition program of the distributed instant detector 1 (DRp) to extract the packet records of the routers flowing through the network and reduce the data exchange situation of the application' and then utilize the collected information. Information, imported into the feeder (Seryer). The server ^ (the Serv management program can (4) simulate the construction of real network inspection, and analyze and diagnose the program activity between the network layer and the application layer to find out why the network is delayed (server, network) Or the user side), can also feed the _ wire traffic growth situation, to pay for the necessary upgrades and costs on the new network equipment. Instant network performance passive monitoring module 12 (PM) can provide the following functions: 1. The ability to monitor, capture and input data, install the Capture Agent in multiple distributed instant detectors (VDRP), and install the Capture Manager in the centralized management system 8. The remote management package is used to set the remote packet capture program, perform synchronization capture, and input capture files. The Instant Network Performance Passive Monitoring Module 12 (ρΜ) can also input application tracking from other (other host) data charts 201038009 or capture tools (eg, Sniffer or Network Analysis Software (TCp Dump)). Records to support a wide range of other formats. At the same time, the Instant Network Performance Passive Monitoring Module 12 (PM) is able to integrate the various transaction profiles of the same transaction into the application model, and can be used to retrieve the data transactions in the network by multi-level association. Filter out irrelevant data from it. 2. Visualized simulation function can use TierPairs map to display the flow between nodes 2, and use the "tree" window to form the work pairing (Tier Pairs), connection And a framework to display summary information and the timeline of the individual transactions that make up the application. The Timeline displays the data flow between all levels of Tiers in the network or application layer, providing a view of all levels of conversations in the application work, allowing the user to determine which class is talking (and not Conversation), observe the general message of each parent, and focus on interesting conversations, and show the data exchange relationship between the network and the application layer. This simulation function can also display the proportion of the cause of the application (such as FTP) delay and the detection relationship to show the bottleneck of the application. The 3_predictive mode technique 'provides a fast predictive control (QuickPredictc〇ntrol) function that can be paired with a certain level 〇^1^1*), giving specific conditions to the width field 311 (^(1 is called the stem, come Simulate the response time (Response Time) and provide a description of the user's dynamic prediction and display impact under different settings and different network conditions. These statements reflect the network bandwidth, delay time, and network. Impact of any combination of Tcp window size, packet loss, and connection usage. In addition, the Instant Network Performance Passive Monitoring Module 12 (pm) must be able to provide input application data to new Or the functionality of an existing environment to pinpoint the impact of applications on the network. Instant Network Performance Passive Monitoring Module 12 (pM) must be able to capture corporate transactions (application data charts) and establish patterns around them , or enter the application (transaction) into the existing mode. The application can therefore be verified (optimized) in the context of real-world image comparison. Passive monitoring of real-time network performance In the virtual environment of the module 12 (PM), the server settings, network connection, network architecture (software and hardware settings), number of users, and 201038009 with flexible work materials are modified to enable detection. Detecting difficult problems, and being able to be verified in the change (4), and planning future possibilities including growth and decline. The ip network network management and distributed distribution of instant traffic provided by the present invention The measurement system has the following advantages: 1. The IP network instant communication measurement system of the invention has the function of real-time detection, which can view, measure and collect the stability of the IP network and the hearing data of the physical environment. As the basis for current network performance detection, diagnosis, simulation, and prediction of future traffic growth, etc. 2. The IP secret of the present invention can provide all aspects of Ip network detection services, such as enterprise network security and performance. Health check, etc. Ο 3. It can detect the interconnection performance between the IP internal network and the external network. 4. Quickly clarify and define the network layer of the IP internal network and the external network, the application layer network or the system. Problem, and go one Quickly propose a solution. 5. Obtain the packet records on the flow path and the (4) money situation simulation to construct real network traffic' and analyze and diagnose the network layer, application layer program activities. 6. Simulate the network future The traffic growth situation predicts the necessary upgrades and costs for the new network equipment. 7. The measurement equipment of the standard detector that integrates the 2-in-1 function is self-contained, which greatly reduces the cost of the construction service. 〇 8. The IP of the present invention The network real-time traffic measurement system is also applicable to the ιρ network unmanned computer room, and cooperates with the network management system to achieve the instant maintenance effect. The above detailed description is specific to one of the possible embodiments of the present invention, but the embodiment is not used. The equivalents of the present invention are intended to be limited to the scope of the invention. In summary, this case is not only innovative in terms of technical thinking, but also able to enhance the above-mentioned multiple functions compared with conventional articles. 'The statutory invention patents that should have fully met the novelty and progressiveness, and apply for it according to law' Invention patent application, in order to invent invention, to the sense of virtue. [Simple diagram of the diagram] 201038009 Figure 1 is the collection network f and the dispersion _ 'private (four) traffic volume diagram 3 is the invention IP_ set (four) f and decentralized secret (four) Quantitative active test mode FIG. 4 is a schematic diagram of a network performance system test diagram of an instant traffic measurement system for a centralized network management and distributed distribution of an IP network according to the present invention; and FIG. 5 is a real-time network performance passive monitoring module of the present invention. Group M〇nit〇r|ng; pM) Test architecture diagram. [Main component symbol description] 1 Distributed Real-time Probe (DRP) 11 Instant end-to-end network performance active test module (Active Testing; AT) 12 Instant network performance passive monitoring module (Passive Monitoring; PM) 13 Probe Side Database Interface (CDBI) 14 Probe Side Database (MySQL DB) 15 Probe Network File System (NFS) 16 File Transfer Protocol (FTP) 2 Node 3 IP Backbone Network (IPbackbone) 4 Server Host Platform 41 Graphical Interface (GUI) 42 Server Side Database Interface (SDBI) 43 Server Side Database (MySQL DB) 44 Server Network File System 5 Website Server 6 Database Server 7 Report Server (RS) 8 Central Management System 201038009 9 Hub 10 Network〇

12

Claims (1)

201038009 VII. The scope of application for patents·· ^The roads and concentrated decentralized gamma instant messaging money, mainly including. - Feeding machine domain platform sub-secret, mainly providing human-machine interface and other functions. Collector collection Or the measured parameters of each node on the network «point=枓, server host platform, the parameters provided by the host host (10), the stability and reliability of the ip network, etc. ,, inspection, from the fine-grained version of the network effect 2, such as the scope of patent application! _ road centralized network management and distribution 2 =, ^ the instant system can be placed in the network edge router (Edg ^ = pH End) 'transfer ^ Port _ _ _ _ _ _ port, or network Tap! (Tap) to measure network performance and traffic monitoring, and internal system (GPS) and Internet time server _), responsible for simulating the generation of various application service services. 3. 2 The application for the centralized network management and decentralized instant messaging measurement system described in the third paragraph of the patent application, wherein the main platform of the feeding device is a website feeding device, a database feeding device and a newspaper Table = the composition of the server 'where the website browser provides the human-machine interface to view, measure the positive network = 疋 = and reliability and other related parameters, and the parameters and results obtained by the database servo bribe measurement are provided to The report feeding device, and then the report feeding device stores the parameters and results stored in the database ship, and is responsible for outputting the final test result. 4. The instant traffic measurement system for network concentration and distributed distribution according to item 3 of the patent scope, wherein the detection result generated by the report server output includes a performance parameter report of the network, and a network. Throughput performance reporting (Thoughput perf〇rmance Rep〇rt), network '*«·Network Growth Trend Report (Network Flow Trend Forecast Report) and various types of bad packet analysis reports on the network. 5. As for the IP network centralized network management and decentralized instant messaging measurement system described in item 4 of the patent application scope, the malicious packet is such as DDoS attack, file 13 201038009 Sharing (P2P), spam (4), virus (Vims), pornography (p_Qing (4) Internet phone (Skype), instant messaging _, worm (w_), etc. H.卩Network Aesaki and Decentralized Instant Messaging System' The distributed instant detector is equipped with a packet capture program (Capture 7. If you apply for a full-time de-listed 1? The traffic measurement system 'where the server host platform system is equipped with a search management program (Capture Manager) to take a management of the process of mosquitoes and distant packets to obtain the functions of performing synchronous capture and inputting files. 8· ^ Apply for the patent network scope item i, the reverse network centralized network management and decentralized distribution of the instant traffic measurement system, wherein the distributed instant detector mainly includes: - instant end-to-end network performance active position Model dimension τ), stored by the network of instant detectors (DRP) 'production volume _ test network performance; - instant network performance passive monitoring group (PM), instant detection packet acquisition program 撷Take the packet records of the various endpoints or routers on the network and the data exchange situation of the application, and import the management program of the server to use the virtual network traffic. 9. If the application of the 鄕 鄕 帛 撕 撕 撕 娜 娜 娜 娜 娜 娜 娜 娜 网 网 网 网 网 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时 即时One way delay), two-way extension 〇 und_Trip aki), delay deviation (four) town vanat10n), packet loss (Packet 1〇ss), gauss ut 〇f equivalent energy measurement parameters. 10=Apply for patents. The real-time centralized network management and decentralized instant messaging® measurement system described in item 8 of the application, the instant end-to-end network performance active test module provides real-time simulation and custom system. Various traffic, IPy4/Ipv6 packets conforming to the IETF standard, and time synchronization using the Internet Time Server (NTP) or Satellite Navigation System (GPS). 11. The instant network centralized network management and decentralized instant messaging measurement system as described in claim 8 of the patent application scope, wherein the instant network performance passive monitoring module provides data monitoring, capture and input, Visual simulation and prediction modes. 201038009 12·The instant network centralized network management and decentralized instant messaging measurement system described in the 11th article of the patent application scope, wherein the data monitoring, capture and input provided by the instant network performance passive monitoring module can Import application tracking records from other data charts or capture tools to support a wide range of other formats. 13. The instant traffic measurement system of the network centralized network management and the distributed distribution according to the scope of claim 12, wherein the other data chart or the extraction tool can be a Sniffer or a network. Analysis software (TCP Dump^ Μ · The instant traffic measurement system of jp network pin network and distributed layout as described in claim 11 of the patent application scope, wherein the prediction mode provided by the instant network performance passive monitoring module, It provides users with a description of the impact of different settings and different network conditions. These statements reflect the network bandwidth, delay time, network (Tcp) window size, packet loss and even Impact on the application of any combination of lines, etc. Ο 15