Statistical information collecting system and apparatus thereof

[0001] The present application claims priority from Japanese application JP 2006-138661 filed on May 18, 2006, the content of which is hereby incorporated by reference into this application.

[0002] The present invention relates to a communication statistic collecting apparatus for collecting statistical information such as byte counts and the number of packets being transferred, and relates in particular to a statistical information collecting apparatus for sending statistical information to a collector device.

[0003] The Internet is now an essential segment of our societal infrastructure. Besides the best effort type data conventionally used, data is now starting to be sent that requires guaranteeing the communication quality. Data whose communication quality must be guaranteed includes for example, transaction data for backbone jobs (essential business task) as well as audio and motion picture data. Moreover ADSL (Asymmetric Digital Subscriber Line) and FTTH (Fiber To The Home) technology is causing access lines to shift to broadband so that the volume of data being sent is vastly increasing.

[0004] Because of this type of environment, communication business operators and ISP (Internet Service Providers) require functions to monitor networks by collecting statistics on the volume of data being sent and received over network and to analyze those collected statistics, in order to determine the status of communications on the network.

[0005] Particularly needed among network monitoring functions, are functions for collecting statistical information on data groups (hereafter, called flows) sorted according to the data transmit source, data destination, application, and quality level, as well as functions for analyzing the statistical information of each flow.

[0006] When providing quality-guaranteed communication services, communication business operators and ISP can confirm whether or not communication quality is guaranteed or not by utilizing the statistical information in each flow. Traffic engineering (TE) is also utilized for making efficient use of network resources via the statistical information in each flow, in an environment where the volume of data being sent and received is increasing even though network resources are limited.

[0007] Moreover, utilizing statistical information on flows allows predicting customer demand and preparing network resources in advance, so that provisioning can be implemented to speedily provide network resources to meet user requests. Using statistical information to analyze flows also allows detecting and analyzing external computer attacks on the network. Further, billing and similar functions can also be contrived by using this statistical information on flows.

[0008] Functions to collect statistical information are contained in node devices such as switches, and routers that transfer packets over the network.

[0009] The statistical information collecting system includes a collector device for analyzing the overall network traffic based on statistical information sent from multiple statistical information collecting apparatuses dispersed throughout the network, and from statistical information sent from these statistical information collecting apparatuses.

[0010] One method for collecting statistical information on flows is a sampling flow statistical technique is disclosed (See IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”). In the statistical information collecting system disclosed in IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”, a router serving as the statistical information collecting apparatus copies the received packet and selectively sends the copied packets to the collector device. The collector device then identifies the flow from the packets that were sent, and collects and analyzes the statistical information.

[0011] Routers contained in the statistical information collecting system sample the received packets according to a sampling rate set in advance by the network administrator, places the sampled packet copies in a specified capsule format and sends this to the collector device.

[0012] The collector device extracts the copied packet from the packet sent from the router, identifies the flow based on the copied packet header information and, information for identifying added flows if necessary, and rewrites the statistical information for each flow.

[0013] An expanded sampling type statistical information collecting system is disclosed (See JP-A No. 5402/2006) as a technology for sampling in flow units. In contrast to the flow statistic technology of IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”, where packets are sampled at a fixed (specified) rate from among packets received by a router, in the flow statistic technology of disclosed in JP-A No. 5402/2006, the flow is identified from header information in the packet received by the router, and the packets are sampled at a rate set for each flow.

[0014] The flow statistic technology disclosed in IETF RFC3176 “InMon Corporation's Flow: A Method for Monitoring Traffic in Switched and Routed Networks”, capsules the header information the router received from the packet and a portion of the data, and sends the information to the collector device. Therefore, in order for the router to monitor the flow statistical information in detail, a large sampling rate must be set, the packets must be frequently sampled, and sent to the collector device.

[0015] However, increasing the sampling rate also increases the processing load on the router. A larger sampling rate also increases the communication volume (quantity) between the router and collector device, and increases the processing load on the collector device.

[0016] Therefore collecting flow information with satisfactory accuracy was impossible in core routers handling a large communication volume. Also, determining the flow on a small bandwidth was impossible, even on routers handling a comparatively small communication volume (little traffic flow).

[0017] The flow statistic technology in JP-A No. 5402/2006, carried out sampling in flow unit, only sampled the flows to be monitored, and then sent these to the collector device. By limiting the sampling flow in this way, this technology reduced the router processing load, the communication volume (hereafter communication load or flow) between router and collector device, and the processing load on the collector device.

[0018] Sometimes however, abnormal traffic cannot be detected in the flow selected for sampling, or the statistical information traffic flow cannot be reduced. Therefore correctly selecting flows to monitor was impossible in the technology disclosed in JP-A No. 5402/2006.

[0019] A typical aspect of this invention includes: a statistical information collecting apparatus including a first processor for computational processing, a first memory area connected to the first processor and, a first interface connected to the first processor and; a collector device including a second processor for computational processing, a second memory area connected to the second processor and, a second interface connected to the statistical information collecting apparatus connected to the second processor; and the statistical information collecting apparatus with a first processor for receiving the packets, collecting statistical information from the received packet, and sending the collected statistical information to the collector device is characterized in that the first memory area contains flow information including flow identification conditions for identifying flows belonging to the received packet, and the first processor sorts the statistical information on the collected packets for each flow identified by the flow identification conditions, refers to the statistical information sorted according to each flow, and send the statistical information to the collector device.

[0020] The embodiment of this invention automatically controls the statistical information received by the collector device according to the flow band and type, to reduce the communication flow between the collector device and statistical information collecting apparatus, and also reduce the processing load on the statistical information collecting apparatus and collector apparatus, and improve the analysis accuracy of the statistical information.

[0037] The preferred embodiments of this invention are described next while referring to the drawings.

[0038] The first embodiment of this invention is described while referring to the drawings from FIG. 1 through FIG. 8, and FIG. 15.

[0039] FIG. 1 is a block diagram for illustrating the statistical information collecting system of the first embodiment of this invention.

[0040] The statistical information collecting system contains a router 101, a server 102, a terminal 103, and a collector device 104. These devices are all connected over a network. An ISP (Internet Service Provider) for example provides the network. The network may be an intra-company network.

[0041] More specifically, the terminal A103, terminal B103, and the terminal C103 are connected to the router A101. The server A102 is connected to the router B101, and the server C102 is connected to the router C101. The collector device A104 is connected to the router A101. Also the router A101, router B101, and the router C101 are all connected.

[0042] The router 101 is a device for transferring information communicated over the network to other destinations for that information. The router 101 contains a processor, a storage device and an interface. The router 101 collects the communicated statistical information, and send that collected statistical information to a collector device 104.

[0043] FIG. 2 is a functional block diagram of the router 101 in the first embodiment of this invention.

[0044] The router 101 includes a receive packet processor unit 201, a transmit packet processor unit 202, a search processor unit 203, a sampling rate control table 204, a statistical information table 205, a flow table 206, a routing table 207, and a control unit 208.

[0045] The control terminal 209 is connected to the control unit 208. The administrator can change each parameter type set in the receive packet processor unit 201, the transmit packet processor 202, and the search processor unit 203 via this control terminal 209. The control terminal 209 may be connected to the control unit 208 via the network.

[0046] The receive packet processor unit 201 receives the packets via the input port. The receive packet processor unit 201 accumulates the received packets in a buffer, and sends the header information in these accumulated packets to the search processor unit 203.

[0047] The search processor unit 203 sends the search process results to the receive packet processor unit 201 after receiving the header information from the receive packet processor unit 201 and executing the search process. The search process in FIG. 6 is described in detail.

[0048] When the search results are received from the search processor unit 203, the receive packet processor unit 201 sends a packet to the transmit packet processor 202 based on the output report contained in the search results.

[0049] When the search results received by the receive packet processor unit 201 include an instruction to sample packets, the receive packet processor unit 201 sends; header information containing instructions for encapsulating the applicable packet; instruction to encapsulate the sampling rate utilized in the sampling process, and the capsule header information; and packet header information containing encapsulated header information and the sampling rate utilized in the sampling process; to the applicable transmit packet processor unit 202. The search results received by the receive packet processor unit 201 contain encapsulated header information and the sampling rate utilized in the sampling process.

[0050] The operation of the transmit packet processor unit 202 is described. The transmit packet processor unit 202 sends an output packet containing the search results when the packet and the search results are received from the receive packet processor unit 201.

[0051] When the transmit packet processor unit 202 receives search results containing encapsulated instructions, the transmit packet processor unit 202 creates an IP packet from the encapsulated header information contained in the search results, sends the packet executed in the search process inserted in a data section to the collector device 104.

[0052] A typical format for a packet sent by transmit packet processor unit 202 to the collector device 104 is shown in FIG. 15. The sample information transmit format 1501 includes an sFlow header 1502, an acquisition parameter 1503, and a packet data 1504. The sample information transmit format 1501 is sent as a UDP datagram. The transmit packet processor unit 202 sets the sampling rate utilized in the sampling process received from the receive packet processor unit 201, into the sampling rate of the acquisition parameter 1503.

[0053] The sampling rate control table 204 manages the sampling rates matching the flow type and flow band, and the sampling processor unit 203 refers to this table when implementing the sampling rate control process (FIG. 7).

[0054] The statistical information table 205 manages the statistical information in each of the collected flows. The flow table 206 includes information serving as conditions for specifying the packet flow received by the router, and information showing the process executed on that flow. An output port matching the transmit source IP address and the destination IP address is registered in the routing table 207.

[0055] FIG. 3 is a drawing showing the flow table 206 of the first embodiment of this invention.

[0056] The flow table 206 includes flow identification condition 302 and statistic control information 303. The flow identification condition 302 includes a source IP address 311, a destination IP address 312, a protocol 313, a source port No. 314, a destination port No. 315, and other information 316.

[0057] An IP address for the transmit source that sent the packet received by the router 101 is registered in the source address 311. A destination IP address for the packet received by the router 101 is registered in the destination IP address 312. The TCP and the UDP are for example registered in the protocol 313.

[0058] The port No. for the transmit source that sent the packet received by the router 101 is registered in the source port No. 314. A destination port No. for the packet received by the router 101 is registered in the destination port NO. 315.

[0059] A packet input/output (I/O) port No., a transmit source MAC address, a destination MAC address, a TAG protocol identifier, a VLAN (Virtual LAN) identifier, a priority level, a TOS and a portion of the TCP flag are for example registered in the other information 316.

[0060] The statistic control information 303 contains a register process 321, a register process rate 322, a statistic collection 323, a sample process 324, a transmit control 325, a flow type 326, a sampling rate 327, and other information 328.

[0061] Information on whether or not there is a new entry in the flow table 206 is registered in the register process 321. The search process unit 203 registers the new entry when a “1” is registered in the register process 321. However, when a “0” is registered in the register process 321, then the search process unit 203 registers no entry.

[0062] When a new entry is registered in the flow table 206, then the register rate of that entry is registered in the register process rate 322. When a “1/1” is registered in the register process rate 322, the search process unit 203 always adds a new entry. When a “0” is registered in the register process 321, then no new entry was registered so a “-” is registered in the register process rate 322.

[0063] A “1/1” is registered in the register process rate 322 of the flow ID “F12”. If any of the flow conditions is a mismatch, and if the protocol 313 is TCP, then the flow ID “F12” automatically adds a new entry to the flow table 206.

[0064] Information on whether or not statistical information was collected is registered in the statistic collection 323. If a “1” was registered in the statistic collection 323 then statistical information was collected for the applicable entry. However, if a “0” was registered in statistic collection 323, then not statistical information was collected for the applicable entry.

[0065] Information on whether or not the sampling process was executed is registered in the sampling process 324. In the sampling process, the transmit packet process unit 202 copies the packet according to the sampling rate, and sends the copied packet to the collector device 104.

[0066] When a “1” is registered in the sampling process 324, then the sampling process is executing using the value registered in the sampling rate 327. When a “0” is registered in the sampling process 324, then the sampling process is not executed.

[0067] Information on whether or not the transmit control process was executed is registered in the transmit control 325. The transmit control process is a process for changing values registered in the sampling rate 327 and is described in detail using FIG. 7. The transmit control process is executed when a “1” is registered in the transmit control 325.

[0068] The flow type is registered in the flow type 326. For example either a “0” a “1” or a “2” is registered in the flow type 326. A “0” indicates an unknown flow. A flow newly registered in the flow table 206 is an unknown flow. A “1” indicates that analysis of the flow is complete. Flows that are determined to be safe are flows whose analysis is complete. A “2” indicates an abnormal flow. Flows determined to be abnormal are abnormal flows.

[0069] A value of “3” or higher may be registered in the flow type 326 to show the degree of abnormality of the abnormal flow.

[0070] The collector device 104 searches the statistical information on each flow, decides the flow type, and sends the now determined flow type to the router 101. When the router 101 receives the flow type 326 from the collector device 104, it registers the flow type in the flow type 326 of the flow table 206 via the control unit 208. The router 101 may also register the flow type 326 and the administrator may register it via the control terminal 209.

[0071] The rate at which the sampling process is executed is registered in the sampling rate 327. If for example a “1/1000” is registered in the sampling rate 327, then the sampling process was executed at a ratio of 1 to 1000 packets.

[0072] The sampling start conditions and the sampling end conditions are registered in the other information 328.

[0073] FIG. 4 is a drawing showing the statistical information table 205 of the first embodiment of this invention.

[0074] The statistical information table 205 includes a flow ID 301 and statistical information 401.

[0075] The flow ID 301 corresponds to the statistical information 401 and flow identification condition 302 functioning as a joint ID with flow ID 301 of the flow table 206. Instead of the method for matching the statistical information 401 with the flow identification condition 302 utilizing a joint (or common) ID, a method may be used that matches the statistical information 401 with the flow identification condition 302 utilizing a pointer; and a method for storing the flow table 206 and the statistical information table 205 in one table may be utilized.

[0076] The statistical information 401 includes a packet quantity 411, a byte quantity 412, a band (bps) 413, a band (pps) 414, a start time 415, a threshold 416, and other information 417.

[0077] A value integrating the packet quantity received from the router 101 is registered in the packet quantity 411. A 1 is added to the packet quantity 411 when the router 101 receives a packet matching the flow ID 301.

[0078] A value integrating the packet length in the packet received from the router 101 is registered in the byte quantity 412. The router 101 adds the packet length contained in the header information of the received packet to the byte quantity 412 when the router 101 receives the packet matching the flow ID 301.

[0079] A flow exclusively for the band (bps) is registered in the band (bps) 413. A flow (pps) exclusively for the flow is registered in the band (pps) 414.

[0080] The time that a 1 was registered in the packet quantity 411, is registered in the start time 415. In other words, the time that a packet matching the first flow ID was received by the router 101, is registered.

[0081] Information on thresholds as a condition for sending statistical information to the collector device 104 or not are registered in the threshold 416 in order to analyze the statistical information. Usually, the threshold for the packet quantity 411 is registered in the threshold 416. When the packet quantity 411 reaches the threshold registered in the threshold 416, the router 101 sends statistical information on the appropriate flow to the collector device 104. The flow analysis process unit 805 of the collector device 104 then analyzes the statistical information for the flow.

[0082] Thresholds relating to the byte quantity 412 and the start time 415 may be registered in the threshold 416.

[0083] The number of types that appeared in items not contained in the flow ID, and the time that the router 101 last received the packet are registered in the other information 417. Here, the number of types that appeared, indicates for example, what types of destination IP addresses appeared when the flow identification condition 302 of flow table 206 contained a transmit source IP address.

[0084] FIG. 5 is a drawing showing the sampling rate control table 204 of the first embodiment of this invention.

[0085] The sampling rate control table 204 contains a band (pps) 501 and a sampling rate 502.

[0086] The band (pps) 501 corresponds to the band (pps) 414 of statistical information table 205. The band bps 413 of statistical information table 205 may be used rather than the band (pps).

[0087] Values registered in the sampling rate 327 for each flow type 326 of flow table 206 are registered in the sampling rate 502. More specifically, the sampling rate 502 contains analyzed flows (0) 511, unknown flows (1) 512, and abnormal flows (2) 513 registered in the corresponding sampling rate 327.

[0088] The search processor unit 203 searches the sampling rate control table 204 to register a suitable sampling rate 327 in the flow table 206 from the band and flow types.

[0089] The control terminal 209 can changes the registered contents from the control terminal 209 via the control unit 208.

[0090] FIG. 6 is a flow chart showing the search process in the first embodiment of this invention.

[0091] The search processor unit 203 receives the header information from the receive packet process unit 201 (step 601).

[0092] When the header information is received, the search processor unit 203 searches the flow table 206 (step 602). The search processor unit 203 also searches the routing table 207 (step 621) when the header information is received (step 601). The process in step 602 through 611, and the process in step 621 through 622 are performed in parallel.

[0093] More specifically, in the process of step 602, the search processor unit 203 searches the flow identification condition 302 of flow table 206 and identifies the flow ID 301 based on the transmit source IP address, the destination IP address, the transmit source port No., and the destination port No. contained in the received header information.

[0094] The search processor unit 203 then implements the statistic process of step 603 through step 611 based on the statistic control information 303 of the identified flow ID 301.

[0095] The search processor unit 203 searches the flow table 206, and acquires the information registered in the register process 321 (step 603).

[0096] The search processor unit 203 next decides whether or not to add the new entry (step 604). More specifically, when the information registered in the register process 321 acquired in the process in step 603 is “1”, then the search processor unit 203 decides to add the new entry and proceeds to the process of step 605. On the other hand, when the information registered in the register process 321 acquired in the process in step 603 is “0”, then the search processor unit 203 decides not to add the new entry and the proceeds to the process in step 606.

[0097] The search processor unit 203 then adds the new entry to the flow table 206 based on the register process rate 322 (step 605).

[0098] The search processor unit 203 then searches the sample process 324 and the statistic collection 323 of the flow table 206 (step 606). The processing then branches into the process of step 607 and the process of step 610.

[0099] The search processor unit 203 searches the flow table 206 and decides whether or not to execute the statistic collection process (step 607). More specifically, when the information registered in the statistic collection 323 is “1”, the search processor unit 203 decides to execute the statistic collection process and the process proceeds to step 608. However, when the information registered in the statistic collection 323 is other than “1”, then the search processor unit 203 decides not to execute the statistic collection process and the statistic processing ends.

[0100] When the decision is made to execute the statistic collection process in step 607, the search processor unit 203 rewrites the statistical information table 205 (step 608).

[0101] More specifically, the search processor unit 203 adds a 1 to the packet quantity 411 of the identified flow ID, and adds the packet length contained in the header information received in the byte quantity 412. The search processor unit 203 then registers the measured band (bps) and the band (pps) into the band (bps) 413 and the band (pps) 414.

[0102] The search processor unit 203 in parallel with the process of step 607, searches the flow table 206, and decides whether or not to execute the sampling process (step 610). More specifically, the search processor unit 203 decides not to execute the sampling process when other than the information “1” is registered in the sample process 324. On the other hand, when the information registered in the sampling process 324 is “1”, then the search processor unit 203 decides to execute the sampling process, and the process proceeds to step 611.

[0103] When the decision is made to execute the sampling process in step 610, the search processor unit 203 executes the sampling process by utilizing the value registered in the sampling rate 327 (step 611). More specifically, the search processor unit 203 adds an instruction to execute the sampling process in the search results to sent to the receive packet processor unit 201. Also, when the transmit packet processor unit 202 executes the sampling process, the search processor unit 203 adds the header information for encapsulating the packet, to the search results.

[0104] When the header information of step 601 is received, the search processor unit 203 searches the routing table 207 (step 621). The search processor unit 203 searches the routing table 207 and acquires the output port (step 622).

[0105] The search processor unit 203 then adds the information from the output port acquired in the process of step 622 to the search results, and the search process ends (step 623). When the sampling process was executed in the process of step 611, the search processor unit 203 instructs that the sampling be executed, and adds the sampling rate utilized in the sampling process and the header information for encapsulating, to the search results.

[0106] When the search process ends (step 623), the search processor unit 203 executes the sampling rate control process (step 624). The sampling rate control process is described in detail using FIG. 7. When the search process ends (step 623), the search processor unit 203 sends the search results to the receive packet processor unit 201 (step 625).

[0107] FIG. 7 is a flow chart showing the sampling rate control process in the first embodiment of this invention (step 624).

[0108] The search processor unit 203 searches the flow table 20.6 and acquires the information registered in the transmit control 325 (step 701).

[0109] The search processor unit 203 next decides whether or not to execute the transmit control process based on the information registered in the acquired transmit control 325 (step 702). More specifically, when the information registered in the acquired transmit control 325 is a “1”, then the search processor unit 203 decides to execute the transmit control process and the process proceeds to step 703. On the other hand, when the information registered in the acquired transmit control 325 is other than a “1”, then the search processor unit 203 decides not to execute the transmit control process, and the sampling rate control process ends.

[0110] After deciding to execute the transmit control process, the search processor unit 203 acquires the flow type 326 of flow table 206 and the band (pps) 414 of statistical information table 205 (step 703).

[0111] The search processor unit 203 searches the sampling rate control table 204 and calculates a sampling rate corresponding to the acquired flow type 326 and the band (pps) 414 (step 704).

[0112] If the band (pps) 414 was not measured, then a search is made for a sampling rate corresponding to the “Default” of band (pps) 501 of the sampling rate control table 204.

[0113] The sampling rate value calculated in the process in step 704 is registered in the sampling rate 327 of the flow ID 301 of the matching flow table 206 step 705.

[0114] The sampling control process ends when a new sampling rate is registered in the flow table 206.

[0115] In the present embodiment, the search processor unit 203 searched the sampling rate control table 204 and calculated the sampling rate; however, the sampling rate may also be calculated with a calculation method utilizing the band and the flow type.

[0116] The example described the search processor unit 203 of router 101 actively changing the sampling rate 327; however, the collector device 104 may actively change the sampling rate. A method where the collector device 104 actively changes the sampling rate 327 is described in detail in FIG. 8. The administrator may also change the sampling rate manually via the control terminal 209.

[0117] FIG. 8 is a function block diagram of the collector device 104 of the first embodiment of this invention.

[0118] The collector device 104 contains a packet transmit/receive processor unit 801, a statistical information packet analysis processor unit 802, a database control unit 803, sampling setting processor unit 804, flow analysis processor unit 805, flow report display processor unit 806, input/output processor unit 807, and sampling rate control table 204.

[0119] An input/output device (mouse 821, keyboard 822 and display 823) is connected to the input/output processor unit 807 of the collector device 104. A terminal computer is connected to the collector device 104 over the network, and inputs and outputs may be made via input and output devices to that terminal computer.

[0120] The packet transmit/receive processor unit 801 receives statistical information packets from the router 101. The packet transmit/receive processor unit 801 transmits control information packets.

[0121] The statistical information packet analysis processor unit 802 extracts the header information from the packet executed by the sampling processor contained in the statistical information packet. The statistical information packet analysis processor unit 802 sends the extracted header information to the database control unit 803.

[0122] The database control unit 803 rewrites (updates) the statistical information database 811 based on the header information received from the statistical information packet analysis processor unit 802. The database control unit 803 measures the band of the flow belonging to the packet executed by the sampling process. The database control unit 803 sends the sampling rate, flow type, and the measured flow band to the sampling setting processor unit 804.

[0123] When the flow the that sample-processed packets belong to satisfies the conditions set in the thresholds, the database control unit 803 sends flow information matching the statistical information database 811 to the flow analysis processor unit 805. Conditions set in the threshold are when the figure is same or higher than specified for the flow packet quantity, or when the same or higher than the specified flow band (bps or pps).

[0124] The database control unit 803 searches the statistical information database 811 based on conditions for searching the statistical information database 811 sent from the flow analysis processor unit 805, and sends the search results to the flow analysis processor unit 805.

[0125] The database control unit 803 receives the analysis results from the flow analysis processor unit 805 and registers or rewrites the flow type of the statistical information database 811 based on the received analysis results.

[0126] The sampling setting processor unit 804 searches the sampling rate control table 204 and calculates the sampling rate for the appropriate flow based on the band, flow type and sampling rate received from the database control unit 803. The sampling setting processor unit 804 then instructs the packet transmit/receive processor unit 801 to send the calculated sampling rate to the router 101 as the control information packet.

[0127] The administrator can directly set the sampling rate via the mouse 821 or the keyboard 822 input device. The collector device 104 sends the set sampling rate to the router 101.

[0128] The flow analysis processor unit 805 receives the information from the statistical information database 811 that the packet executed in the sampling process from the database control unit 803. The flow analysis processor unit 805 analyzes the flow type of the appropriate flow, based on the received statistical information database 811 information. The flow analysis processor unit 805 sends the results from analyzing the flow type of the appropriate flow to the database control unit 803.

[0129] If necessary, the flow analysis processor unit 805 sends search conditions on information relating to the appropriate flow from the statistical information database 811 to the database control unit 803.

[0130] The flow report display processor unit 806 receives statistical information from the statistical information database 811. The flow report display processor unit 806 sorts the statistical information or forms the statistical information into graphs.

[0131] The sampling setting processor unit 804 calculates the sampling rate and by sending the calculated sampling rate to the router 101, the collector device 104 changes the sampling rate 327 contained in the flow table 206.

[0132] The router 101 that received the sampling rate calculated by the sampling setting processor unit 804, rewrites (or updates) the sampling rate 327 of flow table 206 via the search processor unit 203 and the control unit 208. If there is no flow ID matching the flow rewritten in the flow table 206, then the router 101 adds a new entry to the flow table 206.

[0133] If the collector device 104 has rewritten the sampling rate 327 of flow table 206, then the router 101 sets the transmit control 325 to “0”, and the sampling rate cannot then be changed by the router 101.

[0134] The second embodiment of this invention is described while referring to FIG. 9 through FIG. 13, as well as FIG. 16. Structural elements identical to the first embodiment are assigned the same reference numerals and their description is omitted.

[0135] The router 101 of this embodiment contains a function for analyzing statistical information for the flow as does the router 101 of the first embodiment of this invention.

[0136] FIG. 9 is a function block diagram of the router 101 of the second embodiment.

[0137] The router 101 contains a receive packet processor unit 201, a transmit packet processor unit 202, a search processor unit 203, a traffic statistic analyzing processor unit 901, a sampling rate control table 204, a statistical information table 205, a flow table 206, a routing table 207, an itemset table 902, a threshold control table 903, and a control unit 208.

[0138] The search processor unit 203 and the traffic statistic analyzing processor unit 901 search the statistical information table 205.

[0139] The traffic statistic analyzing processor unit 901 generates an itemset table 902 combining optional items making up the traffic information, and extracts characteristic (or unique) traffic by collecting statistical information on each entry in the itemset table 902.

[0140] The itemset table 902 shows an optional combination of each of the items making up the traffic information. The itemset table 902 is described in detail using FIG. 10. The threshold control table 903 is searched when the threshold value 1206 of the statistical information table 205 is changed according to the flow band and flow type. The threshold control table 903 is described in detail using FIG. 12.

[0141] FIG. 10 is a drawing showing the itemset table 902 of the second embodiment of this invention.

[0142] There are four types of items making up the traffic information in this embodiment. These items are the transmit source IP address, the destination IP address, the transmit. source port No., and the destination port No. Other items making the traffic information may for example be the transmit source MAC address, the destination MAC address, the VLAN-ID, the protocol No. the priority level, the TOS, and the TCP flag, etc.

[0143] The itemset table 902 includes tables made from combinations of optional items making up the traffic information.

[0144] The itemset table 902 in this embodiment includes a table A1101, a table B1102, a table C1103, and a table D1104. The table A1101 is a first item making up the traffic information. The table B1102 is a second item making up the traffic information. The table C1103 is a third item making up the traffic information. The table D1104 is a fourth item making up the traffic information.

[0145] The example in this embodiment describes the case where the number of tables in the itemset table 902 is four tables. The itemset table 902 contains at least one table, and there are four types of items making up the traffic information so that the itemset table 902 contains up to a maximum of four tables. Each table in the itemset table 902 contains an entry No. 1111 and an item 1112.

[0146] The entry No. 1111 is an entry identifier contained in the itemset table 902. The item 1112 contains the type 1121 and the value 1122. Items making up the traffic information are registered in the type 1121. A value for the item making up the traffic information recorded in the type 1121 is registered in the value 1122.

[0147] FIG. 11 is a drawing showing the statistical information table 205 of the second embodiment of this invention.

[0148] The traffic statistic analyzing processor unit 901 and the search processor unit 203 search the statistical information table 205.

[0149] The statistical information table 205 contains an entry No. 1111, a packet quantity 1201, a byte quantity 1202, a band (bps) 1203, a band (pps) 1204, a start time 1205, a threshold 1206, and other information 1207.

[0150] The entry No. 1111 is a common identifier for entry numbers in the flow table 206 and the itemset table 902, and corresponds to the itemset table 902 and statistical information table 205.

[0151] In this embodiment, the traffic statistic analyzing processor unit 901 and the search processor unit 203 search one statistical information table 205. However, the statistical information table searched by the traffic statistic analyzing processor unit 901, and the statistical information table searched by the search processor unit 203 may each be separately retained tables.

[0152] An integrated value of packet quantities received by the router 101 may be registered in the packet quantity 1201. More specifically, when the router 101 receives a packet matching the entry No. 1111, the router 101 adds a 1 to the packet quantity 1201.

[0153] An integrated value for the packet length contained in the packet received by the router 101 is registered in the byte quantity 1202. When the router 101 receives a packet matching the entry No. 1111, the router 101 adds the packet length contained in the header information of the received packet to the byte quantity 1202.

[0154] A band (bps) exclusively for the matching entry No. is registered in the band (bps) 1203. A band (pps) exclusively for the matching entry No. is registered in the band (pps) 1204.

[0155] The time where a 1 was registered in the byte quantity 1201 is registered in the start time 1205. In other words, the time that the router 101 initially received the packet matching the flow ID is registered.

[0156] The condition when the statistic table maker 1002 sends information to the flow analysis unit 1003 is registered in the threshold 1206. The threshold (value) for the packet quantity 1201 is usually registered in the threshold 1206. When the packet quantity 1201 reaches the value registered in the threshold 1206, the statistic table maker 1002 sends that information to the flow analysis unit 1003.

[0157] The threshold (values) relating to the byte quantity 1202 and the start time 1205 may be registered in the threshold 1206.

[0158] The number of types that appeared in items not contained in the item 1101 of the itemset table 902, and the time that the router 101 last received the packet are registered in the other information 1207. For example, when the transmit source IP address is included in the in the itemset table 902, then the number of types that appeared in the destination IP address item which is the item not contained in the itemset table 902.

[0159] FIG. 12 is a drawing showing the threshold control table 903 of the second embodiment of this invention.

[0160] The threshold control table 903 contains the band (pps) 1401 and the threshold 1402.

[0161] The band (pps) 1401 corresponds to the band (pps) 1204 of the statistical information table 205. The band utilizes pps; however, bps may be utilized.

[0162] The threshold ratio for each flow is registered in the threshold 1402. When the threshold 1206 of statistical information table 205 is the threshold of packet quantity 1201, then a value multiplied by the ratio registered in the threshold 1402 per the threshold established for each entry No. 1111 specified by the itemset table 902, is set in the threshold 1206 of the statistical information table 205.

[0163] The threshold control table 903 is searched for an suitable value to register in the threshold 1206 of statistical information table 205 from the band and flow types. The threshold control table 903 can be changed from the control terminal 209 via the control unit 208.

[0164] FIG. 13 is a function block diagram of the traffic statistic analysis processor unit 901 of the second embodiment of this invention.

[0165] The traffic statistic analysis processor unit 901 includes a header information accumulator 1001, the statistic table maker unit 1002, the flow analysis unit 1003, the statistical information packet generator unit 1004, and the threshold setter unit 1005.

[0166] The header information accumulator 1001 receives header information from the receive packet processor unit 201, and sends the received header information to the statistic table maker unit 1002.

[0167] The statistic table maker unit 1002 generates an optional combination of items (transmit source IP address, destination IP address, transmit source port No., and destination port No.) making up the traffic information in the header information that was received. The statistic table maker unit 1002 then searches the itemset table 902, and searches for entries matching the combination that was generated.

[0168] If there is a matching entry in the itemset table 902, then the statistic table maker unit 1002 changes (or rewrites) the packet quantity 1201, byte quantity 1202, band (bps) 1203, band (pps) 1204, start time 1205, and threshold 1206 for the applicable statistical information table 205 based on the entry No. 1111 for the matching entry.

[0169] On the other hand, if there is no matching entry in the itemset table 902, then the statistic table maker unit 1002 adds an entry for the newly generated combination in the itemset table 902 and the statistical information table 205.

[0170] If unable to add a new entry to the itemset table 902 or statistical information table 205, then the entry to be newly added is overwritten onto a previously registered entry. Methods for selecting a previously registered entry to overwrite include: a method for selecting an entry where the packet quantity 1201 of statistical information table 205 is small; a method for selecting an entry where the last updated (rewritten) entry is the oldest entry; and a method for selecting entries randomly.

[0171] When adding a new entry, the combination of items making up the generated traffic information is registered in the itemset table 902. A “1” is registered in the packet quantity 1201 of the statistical information table 205, and the packet length contained in the header information is registered in the byte quantity 1202. The bands measured by the router 101 are registered in the band (bps) 1203 and the band (pps) 1204.

[0172] The time that a 1 was registered in the packet quantity 1201 is registered in the start time 1205. A preset value is registered in the threshold 416. The preset value registered in the threshold 416 is set for each combination of itemset table 902, and can be changed by the administrator via the control unit 208.

[0173] The method used by the statistic table maker unit 1002 to change the entries in the statistical information table 205 is described. The description used the packet flow from the terminal 1 of FIG. 1 to the server 1 as an example. Here, the terminal 1 IP address is set as X1, the server 1 IP address as Y1, the transmit source port No. as A1, and the destination port NO. as B1.

[0174] When header information from the header information accumulator 1001 is received, the statistic table maker unit 1002 registers the transmit source IP address and X1 each in the type 1121 and the value 1122 of table A1101; and registers entries where the transmit source IP address is X1. The statistic table maker unit 1002 in the same way, registers entries that are the destination address Y1, entries where the transmit source port No. is A1, entries where the destination port No. is B1 in the table A1101. The statistic table maker unit 1002 in this way rewrites or newly forms the table A1101.

[0175] The statistic table maker unit 1002 registers the transmit source IP address and X1 each into the type 1121 and the value 1122 contained in item A of the table B1102; registers the destination IP address and Y1 each into the type 1121 and value 1122 contained in item B; and registers entries where the transmit source IP address is X1 and the destination IP address is Y1. The statistic table maker unit 1002 in the same way registers entries where the transmit source IP address is X1 and the transmit source port No. is A1; entries where the transmit source IP address is X1 and the destination port No. is B1, entries where the destination IP address is Y1 and the transmit source port No. is A1; entries where the destination IP address is Y1 and the destination port No. is B1; as well as entries where the transmit source port No. is A1 and the destination port No. is B1; into the table B1102. The statistic table maker unit 1002 in this way rewrites or newly forms the table B1102.

[0176] The statistic table maker unit 1002 in the same way, registers entries where the transmit source IP address is X1 and the destination IP address is Y1, and transmit source port No. is A1; entries where the transmit source IP address is X1 and the destination IP address is Y1, and the destination port No. is B1; entries where the transmit source IP address is X1 and the transmit port No. is A1, and destination port No. is B1; as well as where the destination IP address is Y1 and the transmit port No. is A1 and the destination port is B1; in the table C1103. The statistic table maker unit 1002 in this way rewrites or newly forms the table C1103.

[0177] The statistic table maker unit 1002 in the same way, registers entries where the transmit source address is X1, the destination IP address is Y1, the transmit source port source No. is A1, and destination port No. is B1; in the table D1104. The statistic table maker unit 1002 in this way rewrites or newly forms the table D1104.

[0178] In this embodiment, the statistic table maker unit 1002 registered all item combinations in the itemset table 902 but omissions can be made if needed.

[0179] The entries just for the transmit source IP address X1 and the destination port No. B1 for example can be registered in the table B1102, and other combinations not registered in table B1102. The administrator sets the combinations for registry in each table via the control unit 208.

[0180] When the itemset table 902 and the statistical information table 205 are rewritten, the statistic table maker unit 1002 searches the threshold 1206 of statistical information table 205, and decides whether or not to send the information to the flow analysis unit 1003.

[0181] The statistic table maker unit 1002 usually compares the threshold 1206 and the packet quantity 1201 contained in the statistical information table 205. More specifically, when the packet quantity 1201 is larger than the threshold 1206, the statistic table maker unit 1002 decides to send information on entries applicable to the itemset table 902 and the statistical information table 205 to the flow analysis section 1003, and that information is judged by the flow analysis section 1003.

[0182] The statistic table maker unit 1002 registers a “0” in the entry (packet quantity 1201, byte quantity 1202, start time 1205, and other information 1207) for the applicable statistical information table 205 simultaneous with sending the information to the flow analysis section 1003. Preset values are registered in the threshold 1206.

[0183] When the packet quantity 1201 is lower than the threshold 1206, the statistic table maker unit 1002 decides not to send entry information matching the statistical information table 205 and the itemset table 902 to the flow analysis section 1003.

[0184] The threshold for the byte quantity 1202, the threshold for the start time 1205, and the threshold for the other information 1207 may be registered in the threshold 1206. In this case, the statistic table maker unit 1002 searches the byte quantity 1202, the start time 1205, and the other information 1207 according to the threshold 1206, and decides whether or not to send the information to the flow analysis section 1003.

[0185] The statistic table maker unit 1002 searches the start time 415 and when deciding whether or not to send information to the flow analysis unit 1003, subtracts the start time 1205 from the current time, calculating the consecutive time. The statistic table maker unit 1002 then compares the calculated consecutive time with the threshold 1206. If the calculated continuous time is larger then the threshold 1206, then the statistic table maker unit 1002 decides to send the information to the flow analysis unit 1003. However, if the calculated continuous time is smaller then the threshold 1206, then the statistic table maker unit 1002 decides not to send the information to the flow analysis unit 1003.

[0186] The statistic table maker unit 1002 holds information on what threshold information the threshold 1206 contained in the statistical information table 205. The administrator can make changes from the control unit 208.

[0187] In this embodiment, the statistic table maker unit 1002 searches one threshold 1026; however, multiple thresholds may be searched.

[0188] The statistical information table 205 in this case contains multiple thresholds. When a preset number of thresholds among multiple thresholds are satisfied, then the statistic table maker unit 1002 sends the applicable entry information to the flow analysis unit 1003.

[0189] A threshold for the packet quantity 1201 is for example registered in a first threshold, and a threshold relating to the start time 1205 is registered in a second threshold. When the first threshold is satisfied, and the second threshold is also satisfied, the statistic table maker unit 1002 sends the applicable entry information to the flow analysis unit 1003. When at least one among the first threshold or the second threshold is satisfied then the statistic table maker unit 1002 may send entry information to the flow analysis unit 1003.

[0190] When the threshold 1206 is a value common to all the entries, in other words a threshold was not set in the flow, the usable memory capacity may be conserved by holding a common threshold for all entries in the table maker unit 1002, and not holding a threshold 1206 in the statistical information table 205.

[0191] The flow analysis unit 1003 decides the traffic band and the type based on applicable entry information in statistical information table 205 and itemset table 902 sent from the statistic table maker unit 1002.

[0192] If necessary, the flow analysis unit 1003 searches other entry information from the statistical information table 205 and itemset table 902, and analyzes the entry type.

[0193] Statistical information for matching entries and results analyzed in the flow analysis unit 1003 are sent to the statistical information packet generator 1004. The band of the entry and entry type, and the entry No. 1111 are also sent to the threshold setter unit 1005. The flow analysis unit 1003 also sends statistical information for those entries to the control unit 208 when analysis shows an abnormality in the entry type.

[0194] The statistical information packet generator 1004 forms the statistical information and the analysis results received from the flow analysis unit 1003 into a transmit format, and sends this to the receive packet processor unit 201 of router 101.

[0195] FIG. 16 is a drawing showing an example of the statistical information transmit format 1601 sent to the receive packet processor unit 201 by way of the statistical information packet generator 1004. The statistical information transmit format 1601 includes the header information 1602 and the statistical information 1603. The statistical information transmit format 1601 is sent as SCTP, TCP, or UDP datagrams.

[0196] The statistical information 1603 contains a sampling rate utilized for collecting the statistical information and, statistical information collected by the statistical information table 205 and, item 1102 of the itemset table 902. The address of the collector device 104 serving as the transmit destination for the statistical information is set beforehand by the administrator via the control unit 208 into the statistical information packet generator 1004.

[0197] The threshold setter unit 1005 searches the threshold control table 903, and calculates the threshold 1206 for deciding the interval for sending information to the flow analysis unit 1003 from the statistic table maker unit 1002 based on the entry type and the entry band received from the flow analysis unit 1003. More specifically, the threshold setter unit 1005 searches the threshold control table 903, and calculates the ratio corresponding to the applicable entry band (pps) and the applicable entry type. The threshold setter unit 1005 then sends this calculated ratio to the statistic table setter 1002.

[0198] The statistic table maker unit 1002 multiplies the received ratio by the value registered in the applicable entry for the threshold 1206, to calculate the new threshold 1206. The statistic table maker unit 1002 then registers that calculated value into the applicable entry for the threshold 1206.

[0199] The function added to the receive packet processor unit 201 of the first embodiment is described next.

[0200] When the receive packet processor unit 201 of this embodiment receives a packet, it also sends header information to the traffic statistic analyzing processor unit 901 simultaneously with sending header information to the search processor unit 203. The receive packet processor unit 201 sends the statistical information packet received from the traffic statistic analyzing processor unit 901 to the transmit packet processor unit 202. The other operation of the receive packet processor unit 201 is the same as that of the first embodiment.

[0201] The control unit 208 of this embodiment sends the information that the entry type received from the flow analysis unit 1003 of the traffic statistic analyzing processor unit 901 is abnormal to the search processor 203. The search processor unit 203 that received the information of the abnormality, searches for a matching entry in the flow table 206, and if there is a matching entry, sets the abnormal flow in the flow type 326.

[0202] The other operation of the transmit packet processor unit 202, and the search processor unit 203 is identical to that of the first embodiment.

[0203] The third embodiment of this invention is described while referring to FIG. 14.

[0204] In the third embodiment of this invention, the network control device 1301 contains a function of to analyze the traffic statistics of the second embodiment.

[0205] FIG. 14 is a function block diagram of the network control device 1301 of the third embodiment of this invention.

[0206] The network control device 1301 contains a CPU (Central Processing Unit) 1302, a work memory 1303, a program memory 1304, a statistical information database 1305, a communication interface (communication I/F) 1306, and an input/output device 1307. These components are respectively connected via a bus 1308.

[0207] A packet send/receive processor unit 1311, a statistical information packet analysis processor unit 1312, a traffic statistic analysis processor unit 1313 are stored in the program memory 1304. The CPU 1302 loads the respective programs stored in the program memory 1304, into the work memory, and executes the programs.

[0208] The packet send/receive processor unit 1311 sends and receives the IP packets. The statistical information packet analysis processor unit 1312 acquires the header information contained in the packet sent from the router 101. The traffic statistic analysis processor unit 1313 executes the same processing as the traffic statistic analyzing processor unit 901 of the second embodiment. The embodiments differ in the point that though the traffic statistic analyzing processor unit 901 of the second embodiment sends the packets generated by the statistical information packet generator unit 1004 to the receive packet processor unit 201; the traffic statistic analysis processor unit 1313 of the present embodiment sends the packets generated by the statistical information packet generator unit 1004 to the packet send/receive processor unit 1311.

[0209] The statistical information database 1305 contains an itemset table 902 and a statistical information table 205. The traffic statistic analysis processor unit 1313 searches the statistical information database 1305.

[0210] The router 101 possesses the same structure as the first embodiment. Header information of the packet that was sample-processed by the router 101 is sent to the network control device 1301 and the collector device 104.

[0211] When the packet quantity passing through the router 101 is small, the packet is copied, and the copied packet is sent to the network control device 1301.

[0212] The present invention is capable of network management processing. This invention is especially effective when applied to detailed management of traffic flowing on the network as well as to large-scale networks.