Network apparatus, communication system, abnormal traffic detection method, and program
A network apparatus includes a memory and one or more processors. The memory stores instructions. The one or more processors are configured to execute the instructions to mark a traffic that exceeds a predetermined rate limit. The one or more processors are also configured to execute the instructions to measure an amount of the marked traffic by using one or more filters to detect information written in a data packet by the one or more processors. The one or more processors are further configured to execute the instructions to output the measured traffic amount in a period determined based on an expected time duration of an abnormal traffic. The abnormal traffic is a detection target of the network apparatus.
1. A switch apparatus, comprising:
a memory storing an identifier corresponding to a predetermined packet processing rate, the predetermined packet processing rate being a threshold value for identifying a monitoring target packet, and the stored identifier being used for identifying the monitoring target packet; and
a processor configured to execute instructions to:
receive a packet from a node;
determine whether an identifier in the received packet corresponds to the stored identifier;
identify, when it is determined that the identifier in the received packet corresponds to the stored identifier, the received packet as the monitoring target packet;
monitor the monitoring target packet, the monitoring including monitoring a packet processing rate of the monitoring target packet; and
process the monitoring target packet, the processing including marking the monitoring target packet when the packet processing rate of the monitoring target packet exceeds the predetermined packet processing rate.
2. The switch apparatus according to claim 1 , wherein the processor is further configured to execute the instructions to modify the identifier in the received packet.
3. The switch apparatus according to claim 1 , wherein the processor is further configured to execute the instructions to modify information of a header of the received packet, the information represents a priority to process a packet.
4. A switch apparatus, comprising:
a memory storing a matching rule and an identifier corresponding to a predetermined packet processing rate, the predetermined packet processing rate being a threshold value for identifying a monitoring target packet, and the stored identifier being used for identifying the monitoring target packet; and
a processor configured to execute instructions to:
receive packets from a node;
identify, based on the matching rule, a first packet;
determine whether an identifier in a second received packet corresponds to the stored identifier;
monitor the second packet when it is determined that the identifier in the second received packet corresponds to the stored identifier, the monitoring of the second packet including monitoring a packet processing rate of the second packet; and
process the first packet and the second packet, the processing of the second packet including marking the second packet when the packet processing rate of the second packet exceeds the predetermined packet processing rate.
5. The switch apparatus according to claim 4 , wherein the processor is further configured to execute the instructions to modify the identifier in the second packet.
6. The switch apparatus according to claim 4 , wherein the processor is further configured to execute the instructions to modify information of a header of the second packet, the information represents a priority to process a packet.
7. A communication system, comprising:
a first switch apparatus configured to add an identifier to a packet, the identifier corresponding to a predetermined packet processing rate, the predetermined packet processing rate being a threshold value for identifying a monitoring target packet, and the identifier being used for identifying the monitoring target packet; and
a second switch apparatus, comprising:
a memory storing the identifier; and
a processor configured to execute instructions to:
receive a packet from a node;
determine whether an identifier in the received packet corresponds to the stored identifier;
identify, when it is determined that the identifier in the received packet corresponds to the stored identifier, the received packet as the monitoring target packet;
monitor the monitoring target packet, the monitoring including monitoring a packet processing rate of the monitoring target packet; and
process the monitoring target packet, the processing including marking the monitoring target packet when the packet processing rate of the monitoring target packet exceeds the predetermined packet processing rate.
8. The communication system according to claim 7 , wherein the processor is further configured to execute the instructions to modify the identifier of the received packet.
9. The communication system according to claim 7 , wherein the processor is further configured to execute the instructions to modify information of a header of the received packet, the information represents a priority to process a packet.
10. A communication system, comprising:
a first switch apparatus configured to add an identifier to a packet; and
a second switch apparatus, comprising:
a storage storing a matching rule and an identifier corresponding to a predetermined packet processing rate, the predetermined packet processing rate being a threshold value for identifying a monitoring target packet, and the stored identifier being used for identifying the monitoring target packet; and
a processor configured to execute instructions to:
receive packets from a node;
identify, based on the matching rule, a first packet;
determine whether an identifier in a second received packet corresponds to the stored identifier;
monitor the second packet when it is determined that the identifier in the second received packet corresponds to the stored identifier, the monitoring of the second packet including monitoring a packet processing rate of the second packet; and
process the first packet and the second packet, the processing of the second packet including marking the second packet when the packet processing rate of the second packet exceeds the predetermined packet processing rate.
11. The communication system according to claim 10 , wherein the processor is further configured to execute the instructions to modify the identifier in the second packet.
12. The communication system according to claim 10 , wherein the processor is further configured to execute the instructions to modify information of a header of the second packet, the information represents a priority to process a packet.
13. A communication method, comprising:
receiving a packet from a node;
determining whether an identifier in the received packet corresponds to a stored identifier corresponding to a predetermined packet processing rate, the predetermined packet processing rate being a threshold value for identifying a monitoring target packet, and the stored identifier being used for identifying the monitoring target packet;
identifying, when it is determined that the identifier in the received packet corresponds to the stored identifier, the received packet as the monitoring target packet;
monitoring the monitoring target packet, the monitoring including monitoring a packet processing rate of the monitoring target packet; and
processing the monitoring target packet, the processing including marking the monitoring target packet when the packet processing rate of the monitoring target packet exceeds the predetermined packet processing rate.
14. The communication method according to claim 13 , further comprising modifying the identifier in the received packet.
15. The communication method according to claim 13 , further comprising modifying information of a header of the received packet, the information represents a priority to process a packet.
16. The switch apparatus according to claim 1 , wherein the monitoring target packet is a micro-burst packet and the predetermined packet processing rate is for detecting the micro-burst packet.
17. The switch apparatus according to claim 4 , wherein the monitoring target packet is a micro-burst packet and the predetermined packet processing rate is for detecting the micro-burst packet.
18. The communication system according to claim 7 , wherein the monitoring target packet is a micro-burst packet and the predetermined packet processing rate is for detecting the micro-burst packet.
19. The communication system according to claim 10 , wherein the monitoring target packet is a micro-burst packet and the predetermined packet processing rate is for detecting the micro-burst packet.
20. The communication method according to claim 13 , wherein the monitoring target packet is a micro-burst packet and the predetermined packet processing rate is for detecting the micro-burst packet.