KR100591540B1 - TAP device with remote control - Google Patents

Abstract

The present invention relates to a TAP device capable of remote control.

The present invention includes a switching unit for setting a communication path by switching the traffic path; Ethernet port; An Ethernet communication unit for communicating with an apparatus connected through an Ethernet port; And a controller configured to set a communication path by controlling the switching unit according to a control command received through the Ethernet communication unit. In particular, the controller periodically requests schedule information (health-check information) to check whether the monitoring equipment operates normally, and automatically establishes a communication path according to the response status or checks the link status with the equipment connected through the Ethernet port. It is more preferable if the communication path is configured to automatically set the communication path according to the inspection result.

Using the present invention, it is possible to effectively control the TAP device from various equipment connected via Ethernet. In addition, the TAP device can monitor the operation status of various monitoring equipments or the connection status with other remote management devices and operate in a mode suitable for the situation. Accordingly, it is possible to more actively cope with various network environments as well as traffic conditions, so that it can be used more effectively for various security and measurement equipment.

Network, traffic, surveillance, TAP, Ethernet

Description

TAP device capable of remote control {Apparatus of Test Access Port having the funcfion of remote control}             

1 is an overview of a structure of use of a TAP device;

2 is a configuration of a conventional TAP device;

3 is an embodiment of an installation state of a TAP device according to the present invention;

4 is a communication path for each operation mode;

5 is a configuration diagram of a TAP device according to the present invention;

6 is an example of an operation process relating to a health-check function;

7 shows an example of an operation process related to the link check function.

* Explanation of symbols for main parts of the drawings

11,12: network 11-1: router

12-1: Hub 20,40: TAP Device

21 ~ 24,41 ~ 44: port 30: monitoring equipment

40-1: Mode switch 45,46: Ethernet port

47: switching unit 48: Ethernet communication unit

49: control unit 50: management device

The present invention relates to a TAP device that can be remotely controlled, and in particular, to monitor and control the operation state through Ethernet, and to the appropriate operation mode according to the operation state of the monitoring equipment or the link state with the prescribed equipment. The present invention relates to a TAP (Test Access Port) device capable of automatically setting and actively operating in response to various situations occurring in a network.

With the development of internet and network technology, it brings much convenience to real life. However, there are various side effects, such as hacking a specific device or an excessive traffic generation attack by an unspecified number. Accordingly, network security has emerged as a very important problem, and a firewall or an intrusion detection system (IDS) is used for network security.

Referring to FIG. 1, the monitoring device 30 performs port mirroring of traffic on a communication path through a TAP device 20 located on a communication path between a first network 11 and a second network 12 to monitor traffic conditions. Watch. Here, the first network 11 and the second network 12 means any network (for example, an internet network and an intranet network) connected to each other. Port mirroring is a traffic forwarding technology mainly used in a switch, and is a method of exporting a specific port on a switch to a monitoring port.

Referring to FIG. 2, a first network 11, a second network 12, and a monitoring device 30 are respectively connected to a conventional TAP device 20 used to send traffic on a communication path to a monitoring device. Ports 21 to 24 are provided. The monitoring device 30 is a device for monitoring the traffic flowing between the first network 11 and the second network 12, and includes an intrusion detection system (IDS), an intrusion prevention system (IPS), a network analyzer, an RMON, and a DDoS. Means various security and measurement equipment such as solution, QoS, Contents Filter, etc.

Traffic received from the first network 11 through port 1 21 is transferred to the second network 12 through port 2 22 and to the monitoring device 30 through port 3 23 at the same time. . In addition, traffic received from the second network 12 through the port 2 22 is transmitted to the first network 11 through the port 1 21 and simultaneously to the monitoring device 30 through the port 4 24. Delivered.

This conventional TAP device 20 can only perform a passive function to monitor the traffic flowing on the communication path. However, in order to use the TAP device 20 more effectively, it is necessary to be able to actively cope with the traffic state or the network state, and to manage the TAP device more conveniently from the administrator's point of view.

Accordingly, the present invention has been proposed to meet the above necessity, to improve the efficiency of management by monitoring and controlling the operation state through Ethernet, and to link the operation state of the monitoring equipment with other management devices. It is an object of the present invention to provide a TAP device capable of actively responding to various situations by automatically determining a state and automatically operating in an appropriate mode.

In order to achieve the above object, the TAP device capable of remote control according to the present invention, by passing the traffic flowing through the communication path between the first network and the second network to a certain monitoring equipment, the communication path in the monitoring equipment To monitor traffic on the network. In particular, the switching unit for setting the communication path between the first network and the second network by switching the traffic path of the first network, the second network, monitoring equipment, respectively; One or more Ethernet ports; An Ethernet communication unit communicating with a device connected through the Ethernet port; And a controller configured to transmit the operation related information of the TAP device to a predetermined device through the Ethernet communication unit or control the switching unit according to a control command received through the Ethernet communication unit to set the communication path. .

The TAP device according to the present invention may include a function of setting an operation mode manually by a user.

In addition, the TAP device according to the present invention can be configured to operate in an appropriate mode according to the state of the monitoring equipment by judging the operating state of the monitoring equipment by themselves, and by judging the connection state with the various management apparatus connected to itself Depending on the state, it can also be configured to operate in the appropriate mode.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 3, a remote controllable TAP device (hereinafter, referred to as TAP device 40) according to the present invention monitors traffic flowing between the first network 11 and the second network 12. In order to monitor the traffic from the monitoring device (30). At this time, the communication path of the traffic flowing between the first network 11 and the second network 12 may be set according to various traffic or network conditions. The TAP device 40 may be configured for an electrical network or an optical network, and in the case of the optical network, the TAP device 40 may be configured by using various elements required for optical signal processing.

In particular, the TAP device 40 may communicate with the monitoring device 30 or the other management device 50 through the Ethernet ports 45 and 46 to report its status or receive a control command to set its own operation mode. .

To this end, the TAP device 40 has ports (NET A, NET B) connected to the network, ports (DAP A, DAP B) connected to the monitoring device, and Ethernet ports (Eth1, Eth2) connected to other devices through Ethernet. It has a communication port. As an example, port NET A 41 is connected to the first network 11 via a certain network device, and port NET B 42 is connected to the second network 12 via a certain network device. Examples of network devices include routers or switches / hubs.

The monitoring equipment connected to port DAP A 43 and port DAP B 44 can be configured as various devices such as intrusion detection system (IDS), intrusion prevention system (IPS), firewall, IPS, contents filtering, QoS, and cache server. Can be.

In addition, the TAP device 40 may be connected to other devices through the Ethernet ports 45 and 46 to exchange information with each other, but there is no limitation on a device that may be connected to the Ethernet ports 45 and 46. However, it is preferable to connect with the monitoring device 30 and the manager's management device 50 as shown in the example shown in FIG. That is, the monitoring device 30 may exchange data for management with the TAP device 40 through the Ethernet port 45 in addition to monitoring traffic between the first network 11 and the second network 12.

In this case, the TAP device 40 and the devices connected through the Ethernet ports 45 and 46 are preferably configured to communicate with each other using the Simple Network Management Protocol (SNMP). In this embodiment, the various devices 30, 50 connected through the Ethernet ports 45, 46 should be configured to serve as SNMP servers.

On the other hand, the operation mode for determining the communication path of the TAP device 40 is preferably configured to have a passive mode and an In-Line mode.

Referring to FIG. 4, in the passive mode, the traffic between the first network 11 and the second network 12 is connected as it is, but the traffic flowing between the first network 11 and the second network 12 is port DAP. A / B (43, 44) is a mode for mirroring to the monitoring device (30).

In-Line mode is a mode in which traffic between the first network 11 and the second network 12 is connected via the monitoring equipment 30. As a result, in-line mode can intercept excessive or dangerous traffic. That is, the In-Line mode is a mode that can effectively control and monitor traffic since traffic from the first network 11 is transferred to the second network 12 only through the monitoring equipment 30 such as IPS. .

A preferred embodiment of configuring a TAP device will be described in detail with reference to FIG. 5.

The switching unit 47 switches the traffic movement paths of the first network 11, the second network 12, and the monitoring equipment 30, respectively, so that the switching unit 47 between the first network 11 and the second network 12. It plays a role to set communication path.

That is, the first switching unit 47-1 selects one of a signal received from the second network 12 through the port NET B 42 and a signal received from the monitoring device 30 to select the port NET A 41. Transfer to the first network 11 through).

The second switching unit 47-2 selects one of a signal received from the first network 11 through the port NET A 41 and a signal received from the monitoring device 30 to select the port NET B 42. Transfer to the second network 12 through.

The controller 48 controls the switching operations of the first switching unit 47-1 and the second switching unit 47-2, such that the first network 11, the second network 12, and the monitoring device 30 are controlled. It controls the communication path between them.

For example, the controller 49 controls the first switching unit 47-1 to pass a signal received from the second network 12 through the port NET B 42 to the port NET A 41. Further, if the second switching unit 47-2 is controlled to pass a signal received from the first network 11 through the port NET A 41 to the port NET B 42, the first network 11 ) And the second network 12 are directly connected. In addition, the signal received from the second network 12 through the port NET B 42 is transmitted to the monitoring equipment 30, and the signal received from the first network 11 through the port NET A 41 is monitored. When delivered to the equipment 30, it will operate in passive mode.

However, the control unit 49 controls the first switching unit 47-1 to pass the signal received from the monitoring equipment 30 through the port DAP A 43 to the port NET A 41. If the second switching unit 47-2 is controlled to pass a signal received from the monitoring device 30 through the port DAP B 44 to the port NET B 42, the first network 11 and the second The network 12 is in a state of being connected via the monitoring equipment 30. That is, a communication path via the monitoring equipment 30 is formed, and operates as the IN-Line mode.

On the other hand, the Ethernet communication unit 48 serves to communicate with each other according to the Ethernet communication method and the various devices (30, 50) connected through the Ethernet port (45, 46).

In this regard, the controller 49 may report its operation state by sending various operation related information of the TAP device 40 to the corresponding devices 30 and 50 connected through the Ethernet communication unit 48. In addition, the control unit 47 controls the switching unit 47 according to control commands received from the various devices 30 and 50 through the Ethernet communication unit 48 to set the communication path to a certain mode.

In FIG. 5, two Ethernet ports 45 and 46 are provided for convenience of description, and one has a structure connected to the monitoring device 30 and another management device 50. Obviously, the target device can be configured arbitrarily.

When connected as shown in the embodiment shown in FIG. 5, the monitoring device 30 can grasp the operation state of the TAP device 40 in addition to monitoring traffic between the first network 11 and the second network 12. It becomes possible. In addition, since the operation state of the monitoring device 30 can be actively monitored even from the standpoint of the TAP device 40, when the monitoring device 30 operates abnormally, the TAP device 40 changes the communication path by itself. It is possible to cope appropriately with such situation.

As one example, the TAP device 40 periodically requests the monitoring device 30 for schedule information (health-check information) for confirming that the monitoring device 30 is operating normally, and in response to the request. It can be configured to automatically set the communication path accordingly. In the following description, the TAP device 40 actively expresses the state of another device as a 'health-check' function.

With reference to FIG. 6, an embodiment of a health-cheap function in which the TAP device 40 actively copes with the state of the monitoring equipment 30 will be described.

The controller 49 determines whether a period for requesting health-care information to the monitoring device 30 has come (S61). That is, the fitness function may be performed periodically. Health- 첵 information requested to the monitoring device 30 can be configured to be set in advance in the device (30, 50) connected through the Ethernet port (45, 46).

As a result of the determination in step S61, when the period for requesting the health-cheap information to the monitoring device 30 is requested, the health-cheak information is requested to the monitoring device 30 through the Ethernet communication unit 48 and waits for a response (S62). If a response is received within the prescribed time (S63), it is checked whether the response is a normal response (S64). When the normal response is received from the monitoring device 30, the switching unit 47 is controlled to control the TAP device 40 to operate in the in-line mode (S66).

However, if the response is not received from the monitoring device 30 within the prescribed time (S63, S65), or if the received response is abnormal (S64), the TAP device 40 is passive by controlling the switching unit 47 Control to operate in the mode (S67). At this time, which operation mode to set according to each situation can be arbitrarily defined.

As an example of a method in which the TAP device 40 communicates with the monitoring device 30 to perform a health-check function, a method of polling MIB (Management Information Base) data may be used. That is, the MIB OID set for the monitoring device 30 may be requested and configured to operate according to the result. At this time, if a response is not received, it may be configured to perform a partial retry.

Commands for the health-check function may include an 'Interval' item for specifying an inspection period, a 'Retries' item for specifying the number of retries at the inspection, and a 'Timeout' item for specifying a timeout time for a connection. These items can be set by input from the monitoring device 30 or other management device 50 connected to the Ethernet.

Since a method of communicating using SNMP can be easily implemented using a known SNMP related technology, a detailed description thereof will be omitted.

In addition, the TAP device 40 may be configured to periodically check the link state of the Ethernet ports 45 and 46 and automatically set the operation mode according to the test result. That is, the TAP device 40 can set its operation mode according to the connection state with any device connected through the Ethernet ports 45 and 46, and thus can actively cope with changes in the network environment.

Referring to FIG. 7, an embodiment of another health-feature function that the TAP device 40 may perform will be described.

The controller 49 checks whether a certain device is connected through the Ethernet ports 45 and 46 (S71). As a result of the inspection in step S71, if the link state is normal, the TAB device 40 is set to the in-line mode (S73). If the link state is not normal, the TAB device 40 is set to the passive mode (S74). Which mode to set according to the link state can be arbitrarily defined.

In this case, the inspection target device may be set in advance in a device connected through the Ethernet ports 45 and 46. Commands for the link check health check function include a device name (Eth1 or Eth2) that is the link check health check, setting status of the link check health check, and start and stop of the link check health check function.

In the above, an example in which an operation mode is automatically set according to a command or a state of the monitoring device 30 or another management device 50 connected through Ethernet is described. However, the TAP device 40 may manually set a communication path. It can also be configured to do so.

In this embodiment, the TAP device 40 further includes a mode switch 40-1, and the controller 49 sets a communication path according to the state of the mode switch 40-1. The mode switch 40-1 is configured to select one of a passive mode and an in-line mode, and of course, a contact for other functions can be configured as well.

The above-described embodiments are intended to help the understanding of the present invention, and the present invention is not limited to the above-described embodiments and can be variously modified and implemented by those skilled in the art without departing from the technical spirit of the present invention. to be.

Using the present invention, it is possible to effectively control the TAP device from various equipment connected via Ethernet. In addition, the TAP device can monitor the operation status of various monitoring equipments or the connection status with other remote management devices and operate in a mode suitable for the situation. As a result, it can cope more proactively with various network environments as well as traffic conditions, so it can be used more effectively for various security and measurement equipment such as intrusion detection system (IDS), network analyzer (Analyzer), RMON and DDoS solution.

Claims (7)

In the TAP (Test Access Port) device that delivers traffic flowing through the communication path between the first network and the second network to a certain monitoring device, the monitoring device to monitor the traffic on the communication path, A switching unit configured to establish a communication path between the first network and the second network by switching traffic paths of the first network, the second network, and monitoring equipment, respectively; One or more Ethernet ports; An Ethernet communication unit communicating with a device connected through the Ethernet port; And And a controller configured to transmit the operation related information of the TAP device to a predetermined device through the Ethernet communication unit or control the switching unit according to a control command received through the Ethernet communication unit to set the communication path. TAP device with control. The method of claim 1, The communication path is a passive mode that is monitored while traffic between the first network and the second network is intact, and In- where traffic between the first network and the second network is connected via the monitoring equipment. TAP device capable of remote control, characterized in that the line mode. The method according to claim 1 or 2, The controller is configured to periodically request schedule information (health-check information) to the monitoring equipment to check whether the monitoring equipment operates normally, and automatically set the communication path according to the response state according to the request. TAP device capable of remote control. The method of claim 3, wherein Health-SAP information requested by the control unit to the monitoring equipment is configured to be configured to be set through the device connected via the Ethernet port. The method according to claim 1 or 2, The controller is configured to periodically check the link state with the equipment connected through the Ethernet port, and the TAP device capable of remote control, characterized in that configured to automatically set the communication path according to the test result. The method of claim 5, wherein The apparatus to be inspected by the control unit is a TAP device capable of remote control, characterized in that configured to be set through the device connected through the Ethernet port. The method of claim 1, And a mode switch for manually setting the communication path, wherein the controller sets the communication path according to the state of the mode switch.

Images