[1,2,3]. (well-known port)

Transcription

1 O,, {bluewind, mount, PC,,,, 1, PC,, (Internet Service Provider, ISP), [1,2,3] (well-known port),,, [4]

2 RDT[6], RTP[11], MMST/MMSU[5], (data session) IP (VoIP) (a) SIP, (b)h323, WMT(Windows Media Technology)[5], RealMedia[6], QuickTime[7] 1 (a), (b) (b), RealMedia RTSP RDT (dynamic session) QuickTime RTSP RTP WMT MMS MMST/MMSU 1 IP SIP(Session Initiation Protocol)[8]H323[9] 2 22 (flow) NG-MON(Next SIP SIP RTP H323 Q931, Generation Monitoring)[12] RTP H245 FlowScan[16] 2 mmdump[4] (end points) (packet), [13,14,15] RTSP[10], MMS[5] IP, IP,, SIP, Q931[9],, H245[9] 5 (control session)

3 NG-MON IP WMT IP 5, (IP fragmentation) NG-MON IP Windows Media Technology Network Packet Flow Flow Traffic Presenter User Interface 30~70%IP Device Capturer Generator Store Analyzer (web server) (web browser) raw packets packet header flow 2 NG-MON information information 2,,,,, 3 FlowScan 3 capture packet Network flow Device extract header information information passing packet table generate flow information determine dynamic flow capture packet extract header information dynamic session control session table packet? multimedia service flow mmdump Y extract dynamic table session information, 3

4 , RTSP ( 5), MMS ( 8), SIP ( 10), H323 Q931 ( 13) RTSP, MMS, SIP, Q , 1755, 5060, 1720 H323H245 Q931 Q931 H245 ( 4 (dynamic 15) session analyzer) 1 Procedure DynamicSessionAnalyzer ( Msg ) 2 BEGIN ( 6, 9, 11, 14, 16) 3 3 if FIN Flag in Msg is NOT set then 4 if protocol in Msg = RTSP then 5 if SourcePort in Msg = RTSP server port number then 6 result = ParseRTSP (payload of Msg ) ; 7 else if protocol in Msg = MMS then [Tt][Rr][Aa][Nn][Ss][Pp][Oo][Rr][Tt]:[a-zA- 8 if DestinationPort in Msg RTSP Z] + ([/-][a-za-z]) * * ;client_port=[1-9][0-9] {3,4} (- = MMS server port number then [1-9][0-9] {3,4} ) {0,1} ; * 9 result = ParseMMS (payload of Msg ) ; \\\\[1-9][0-9] {1,2} \\\[1-9][0-9] {1,2} \\\[1-9][0-10 else if protocol in Msg =SIP then 9] {1,2} \\\[1-9][0-11 result = ParseSIP (payload of Msg ) ; MMS 9] {1,2} \\[([Tt][Cc][Pp]) ([Uu][Dd][Pp])]\\[1-9][0-12 else if protocol in Msg = Q931 then 9] {1,2} [0-9][0-9] * 13 if SourcePort in Msg = Q931 callee port then [Mm]= [a-za-z]+ [1-9][0-9] {3,4} [a-za-z]+([/- 14 result = ParseQ931 (payload of Msg ) ; SIP ][a-za-z]) * * 15 else if protocol in Msg = H245 then 16 result = ParseH245 (payload of Msg ) ; 3 17 if result= TRUE then RTSP 18 create new data session information; (transport) 19 insert data session into dynamic session table; Transport: ( );();( 20 else ), 21 delete session from dynamic session table; 22 END MMS URL 4 TCP UDP, SIP 4 Msg SDP(Session Description Protocol)[17], M= ( ) ( ) () ) (, (media) TCP (flag) FIN Q931 H323 ( 3),, 5, Q931 H245

5 Q931 (element information) (user-user info) IP H245 (open logical channel) (forward channel parameter) (reverse channel parameter), 6 MST-MON (network access parameter) 6 Q931 H245 5 Q931 H245, MST-MON TCP ( 4 3) ( 4 20) (, 421) FIN 41 (Flow Generation) (probe), (flow generator) 4 7, MST- MON(Multimedia Service Traffic MONistoring system) NG-MON, 5,

6 , 7 8 IP,, 7 43 (Multimedia Service Traffic Analysis) MST-MON NG-MON, IP, IP 42 (Dynamic Session Analysis) MST-MON 9, + [,, ] [ IP 8 8,,, ] [ IP,, ], IP,,, 4 9,, 9

7 1,, 10 MST-MON 800MHz CPU, 256Mbytes 10 PC Linux Redhat 72 LAN(Local Area Network) NTP(Network Time, Protocol)[18],,, 5 MST-MON MST-MON 1,,, 11,

8 ,, <detail> TCP UDP 13 WMT WMT MMS 1, MMS MST- MON, danubeposechackr mailexonkinocokr WMT, 7 [1] J Won-Ki Hong, S U Park, Y M Kang and J T Park, Enterprise Network Traffic Monitoring, Analysis and Reporting Using Web Technology, 6 Journal of Network and Systems Management, Plenum Press, March 2001, pp [2] J Won-Ki Hong, Soon-Sun Kwon and Jae-Young Kim, WebTrafMon: Web-based Internet/Intranet Network Traffic Monitoring and Analysis System, Computer Communications, Elsevier Science, Vol 22,, No 14, September 1999, pp [3] Soon-Hwa Hong, Jae-Young Kim, Bum-Rae Cho, J Won-Ki Hong, Distributed Network Traffic Monitoring and Analysis using Load Balancing, Technology, 2001 Asia-Pacific Network Operations and Management Symposium, Sydney, Australia, September 2001, pp [4] Jacobus van der Merwe, Ramon Caceres, Yang-hua Chu, and Cormac Sreenan mmdump- A Tool for Monitoring Internet Multimedia Traffic, ACM Computer Communication Review, 30(4), October 2000 [5] Micorsoft, Windows Media Technology, NG-MON MST-MON efaultasp 1Gbps [6] Real Networks, Real Media Technology, [7] Apple, QuickTime,

9 [8] M Handley, H Schulzrinne, ESchooler, J Rosenberg, SIP: Session Initiation Protocol, RFC 2543, March 1999 [9] ITU-T, Recommendation H323: Visual Telephone Systems and Equipment for Local Area Networks Which Provide a Non-guaranteed Quality of Service, 1996 [10] H Schulzrinne, A Rao, and R Lanphier, Real Time Streaming Protocol (RTSP), RFC 2336, April 1998 [11] H Schulzrinne, S Casner, R Frederick, V, and Jacobson, RTP: A Transport Protocol for Real-Time Applications, RFC1889, January 1996 [12] Se-Hee Han, Myung-Sup Kim, Hong-Taek Ju and James W Hong, The Architecture of NG-MON: A Passive Network Monitoring System, Lecture Notes in Computer Science 2506, 13th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management (DSOM 2002), Montreal, Canada, October, 2002, pp [13] Siegfried Lifler, Using Flows for Analysis and Measurement of Internet Traffic, Diploma Thesis, Institute of Communication Networks and Computer Engineering, University of Stuttgart, 1997 [14] JQuittek, T Zseby, B Claise, KC Norsth, IPFIX Requirements, Internet Draft, [15] CAIDA, "Preliminary Measurement Spec for Internet Routers," tspec/ [16] Dave Plonka, FlowScan: A Network Traffic Flow Reporting and Visualization Tool, Proc of 2000 LISA XIV, New Orleans, USA, December 2000, pp [17] M Handley, V Jacobson, SDP: Session Description Protocol, RFC 2327, April,1998 [18] NTP,