Traffic monitoring device and traffic monitoring program
An embodiment is a traffic monitoring device configured to acquire traffic statistical information of a flow in the monitoring target network, determine whether the acquired traffic statistical information satisfies a predetermined reference for failure detection, capture packets of the flow determined to satisfy the predetermined reference as packets at the time of failure occurrence in the flow, and dynamically update the predetermined reference while the device is still acquiring traffic statistical information of the flow in the monitoring target network.
1 . A traffic monitoring device, comprising:
one or more processors; and
a storage device storing a program to be executed by the one or more processors, the program including instructions for:
acquiring traffic statistical information of a flow in a monitoring target network;
determining whether the acquired traffic statistical information satisfies a predetermined reference for failure detection;
capturing packets of the flow determined to satisfy the predetermined reference as packets at a time of failure occurrence in the flow;
dynamically updating the predetermined reference while acquiring traffic statistical information of the flow in the monitoring target network;
updating the predetermined reference every predetermined cycle; and
updating the predetermined reference based on the traffic statistical information before a next predetermined cycle for updating the predetermined reference and the predetermined reference before the next predetermined cycle.
2 . The traffic monitoring device according to claim 1 , wherein the program further includes instructions for:
acquiring traffic statistical information of each of a plurality of flows including the flow;
updating a capture flag value corresponding to the flow satisfying the predetermined reference to a first numerical value with reference to a rule table in which a rule capable of uniquely specifying a flow, a capture flag that takes the first numerical value when the flow is a target of capture and takes a second numerical value when the flow is not the target, and the predetermined reference for the flow are associated with each other for each flow; and
capturing packets of the flow after the capture flag value is changed to the first numerical value or before and after the capture flag value is changed to the first numerical value.
3 . The traffic monitoring device according to claim 1 , wherein the traffic statistical information is a traffic volume, the predetermined reference is an upper limit threshold value and a lower limit threshold value, and wherein the program further includes instructions for:
determining that the traffic statistical information satisfies the predetermined reference when the traffic volume exceeds the upper limit threshold value or falls below a lower limit value.
4 . The traffic monitoring device according to claim 1 , wherein the traffic statistical information before a next predetermined cycle for updating the predetermined reference is a traffic volume in a period longer than that of the predetermined cycle.
5 . The traffic monitoring device according to claim 1 , wherein the program further includes instructions for:
capturing packets of an unregistered flow at equal intervals or random intervals;
registering a rule for specifying a flow included in the captured packets in a rule table; and
newly registering a predetermined condition in the rule table in association with the rule when the rule is registered in the rule table.
6 . A method for monitoring traffic in a network, comprising:
acquiring, by an information processor, traffic statistical information of a flow in the network;
determining, by the information processor, whether the acquired traffic statistical information satisfies a predetermined reference for failure detection;
capturing, by a packet capturer, packets of the flow determined to satisfy the predetermined reference as packets at a time of occurrence of a failure of the flow;
dynamically updating, by the information processor, the predetermined reference based on time from a time source while the information processor is in operation;
acquiring traffic statistical information of each of a plurality of flows in the network; and
updating a capture flag value corresponding to the flow that satisfies the predetermined reference to a first numerical value in a rule table, wherein the rule table associates a rule that can uniquely specify a flow, a capture flag that takes the first numerical value when the flow is a target of capture and takes a second numerical value when the flow is not the target, and the predetermined reference for the flow.
7 . The method of claim 6 wherein capturing packets includes capturing packets of the flow after the capture flag value is changed to the first numerical value.
8 . The method of claim 7 , further comprising:
buffering a predetermined amount of input packets and capturing packets of the flow before and after the input packets are changed to the first numerical value.
9 . The method of claim 6 , wherein the traffic statistical information is a traffic volume, and the predetermined reference includes an upper limit threshold value and a lower limit threshold value.
10 . The method of claim 9 , wherein determining whether the traffic statistical information satisfies the predetermined reference includes determining that the traffic volume exceeds the upper limit threshold value or falls below a lower limit value.
11 . A method for monitoring traffic in a network, comprising:
acquiring, by an information processor, traffic statistical information of a flow in the network;
determining, by the information processor, whether the acquired traffic statistical information satisfies a predetermined reference for failure detection;
capturing, by a packet capturer, packets of the flow determined to satisfy the predetermined reference as packets at a time of occurrence of a failure of the flow;
updating, by the information processor, the predetermined reference every predetermined cycle while the information processor is in operation; and
updating, by the information processor, the predetermined reference based on the traffic statistical information before a next predetermined cycle for updating the predetermined reference and the predetermined reference before the next predetermined cycle.
12 . The method of claim 11 , wherein the traffic statistical information before the next predetermined cycle for updating the predetermined reference is a traffic volume in a period longer than that of the predetermined cycle.
13 . The method of claim 11 , wherein updating the predetermined reference based on the traffic statistical information before the next predetermined cycle and the predetermined reference before the next predetermined cycle comprises:
calculating a ratio between traffic statistical information of a current cycle and traffic statistical information of a previous cycle; and
multiplying the predetermined reference of the current cycle by the ratio to determine the predetermined reference for the next predetermined cycle.
14 . The method of claim 11 , wherein the traffic statistical information is a traffic volume, and the predetermined reference includes an upper limit threshold value and a lower limit threshold value.
15 . The method of claim 14 , wherein determining whether the traffic statistical information satisfies the predetermined reference includes determining that the traffic volume exceeds the upper limit threshold value or falls below the lower limit threshold value.
16 . The method of claim 11 , further comprising:
acquiring traffic statistical information of each of a plurality of flows in the network, wherein updating the predetermined reference every predetermined cycle includes updating a respective predetermined reference for each of the plurality of flows.
17 . The method of claim 11 , further comprising:
comparing traffic statistical information of a same time cycle of a same flow from a current day with traffic statistical information of a same time cycle of the same flow from a previous day;
determining whether a difference between the traffic statistical information exceeds a threshold value; and
when the difference exceeds the threshold value, setting the predetermined reference for the next predetermined cycle to a same predetermined reference as used for the same time cycle of the previous day.
18 . The method of claim 11 , wherein the predetermined cycle is between 10 seconds and 10 minutes.