KR100548923B1 - A system for monitoring multi-media service traffic and method thereof - Google Patents

Abstract

The present invention relates to a multimedia service traffic monitoring system and method. That is, according to the present invention, in a multimedia service traffic monitoring system, in traffic monitoring input through an unknown port among multimedia service traffic input from a network, a port number generated dynamically by analyzing payload of a multimedia service control session packet and By extracting the protocol of the transport layer, based on this, it is possible to monitor and analyze the multimedia service traffic that could not be analyzed by the method of determining the application of the traffic based only on the transport layer port number of the packet. It will be clearer.

Description

Multimedia service traffic monitoring system and method {A SYSTEM FOR MONITORING MULTI-MEDIA SERVICE TRAFFIC AND METHOD THEREOF}

1 is a block diagram of a multimedia service traffic monitoring system according to an embodiment of the present invention;

2 is a detailed block diagram of the flow generating unit of FIG. 1;

3 is an operation control flowchart of the flow generating unit of FIG. 1;

4 is a detailed block diagram of the dynamic session analyzer of FIG. 1;

5 is a flowchart illustrating an operation session analysis processing in the dynamic session analyzer of FIG. 1;

6 is an exemplary RTSP protocol analysis program for analyzing an RTSP control session packet in the dynamic session analyzer of FIG. 4;

7 is a diagram illustrating a regular expression required for analysis of the RTSP control session packet in FIG. 6;

8 is an exemplary MMS protocol analysis program for analyzing an MMS control session packet in the dynamic session analyzer of FIG. 4;

9 is a diagram illustrating a regular expression required for analysis of the MMS control session packet in FIG. 8;

10 is an exemplary SIP protocol analysis program for analyzing a SIP control session packet in the dynamic session analyzer of FIG. 4;

11 is a diagram illustrating an example of a regular expression required for parsing a SIP control session packet in 10;

12 is a diagram illustrating an example Q.931 protocol analysis program for analyzing a Q.931 control session packet in the dynamic session analyzer of FIG. 4;

FIG. 13 is a diagram illustrating an H.245 protocol analysis program for analyzing an H.245 control session packet in the dynamic session analyzer of FIG. 4.

The present invention relates to a multimedia service traffic monitoring system. In particular, the present invention relates to a multimedia service traffic monitoring system for finding a dynamically allocated port in a control session of multimedia service traffic such as streaming and video conferencing, and determining and analyzing an application of the traffic. It is about a method.

In general, multimedia service traffic refers to traffic based on transmission / reception of complex multimedia data such as video and audio for multimedia services such as VOD and video conferencing. The traffic monitoring system is connected to the line through which the external internet network enters to obtain the data, and the information on the internet network usage is obtained by collecting and analyzing data from the external internet network.

In the conventional traffic monitoring system, traffic congestion is identified by inspecting only a port number of a transport layer in a received packet to determine an application of traffic transmitted / received from an external Internet network. For example, the port number is 80 when accessing the Internet homepage, 20 and 21 when receiving files using FTP, and port numbers 554 and 1755 when receiving movie packet data. Packet transmission / reception is performed through the port, and the application of the packet is analyzed by identifying the port number of the transport layer.

In multimedia services, however, multimedia data packets, such as movies and video conferencing, are transmitted through dynamically assigned new ports when packets are transmitted / received on the network. When a multimedia packet is received, there is a problem in that the analysis of the multimedia service traffic is impossible and the corresponding application appears as unknown traffic.

Accordingly, an object of the present invention is to analyze a payload of a multimedia service control session packet for a traffic input through an unknown port among multimedia service traffic input from a network in a traffic monitoring system, and dynamically generate a port number and transmission. By extracting the protocol of the layer, the present invention provides a multimedia service traffic monitoring system and method for monitoring and analyzing the multimedia service traffic that could not be analyzed by the method of determining the application of the traffic only by looking at the transport layer port number of the packet. Is in.

According to an aspect of the present invention, there is provided a multimedia service traffic monitoring system and method, comprising: a flow generator for generating flow information on packets passing through a network monitoring point; A dynamic session analyzer for analyzing a packet of a control session to determine service traffic of a dynamically generated session flow; And a multimedia service traffic analysis unit for comparing the flow information with packet analysis information of the control session to determine a multimedia service related flow, and generating and providing multimedia service traffic information to a system operator. (a) generating flow information for packets passing through the network monitoring point; (b) extracting dynamic session information by analyzing a control session packet for the dynamically generated session flow of the flow; (c) comparing the flow information with dynamic session information from a control session packet to determine a multimedia service related flow; and (d) generating multimedia service traffic information and displaying the traffic analysis result to the system operator when determining the flow as the multimedia service related flow.

Hereinafter, with reference to the accompanying drawings will be described in detail the operation of the preferred embodiment according to the present invention.

1 is a block diagram of a multimedia service traffic monitoring system according to an embodiment of the present invention. Referring to FIG. 1, the multimedia service traffic monitoring system 100 of the present invention collects information extracted from a packet header and generates a flow to generate a flow, and information necessary for determining a dynamically generated session flow. Dynamic session analysis unit 102 for analyzing the packet of the control session to provide a, and based on the two types of information generated from the flow generating unit 101 and the dynamic session analysis unit 102 determines the flow related to the multimedia service And analyzing and providing a multimedia service traffic analysis result to an operator.

The flow generator 101 includes a packet collector 104, a flow generator 106, and a flow information storage table 108. The packet collector 104 captures a packet passing through the network monitoring point S1 through the collection filter 200 as shown in FIG. 2, and then uses the header information extractor 202 to capture the header of the captured packet. The packet header information 204 necessary for analyzing the traffic is extracted and applied to the flow generator 106.

The flow generator 106 then uses the packet header information 204 to collect and aggregate information between packets belonging to the same flow for a predetermined time. That is, the flow generator 106 examines five items that determine flows such as a source IP address, a destination IP address, a source port, a destination port, a transport protocol, and the like in the processing flow of FIG. It is checked whether the input multimedia packet is a packet of the same flow. In this case, if the input multimedia packet is a packet of a flow that already exists, the flow generator 106 proceeds from step S302 to step S304 and the number of packets added to the corresponding flow in the flow information table 108. Update the flow length.

Otherwise, if there is no existing flow to which the packet belongs, the flow generator 106 proceeds from step S302 to step S306 to generate a new flow from the collected packets and store the flow in the flow information table 108. do. That is, the flow generator 106 collects the flow information collected every time elapses, as shown in FIG. 2, the source IP address, the destination IP address, the source port number, the destination port number, the transport protocol, the total number of packets, Subdivided into flow lengths and stored in a database or file form, the process of creating new flow information is repeated.

The dynamic session analyzer 102 includes a control packet collector 110, a dynamic session analyzer 112, and a dynamic session information table 114. As shown in FIG. 4, the control packet collector 110 collects the packet passing through the network monitoring point S1 through the control packet filter 400 up to the payload including the header portion, and then extracts the header information extractor 402. Extract packet header information necessary for traffic analysis from the header and apply the packet header information 404 including the packet payload to the dynamic session analyzer 112. The dynamic session analyzer 112 then detects the packet of the control session by examining the header information of the packet, selects a control protocol from the header information of the control session packet (406), and then pays the payload according to the specification of the selected control protocol. The load is analyzed to extract dynamic session information 410 (408).

5 illustrates a protocol analysis processing flow through header and payload analysis of a control session packet in the dynamic session analyzer 112. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 4 and 5.

First, the dynamic session analyzer 112 checks the port number of the control packet through header information of the control packet applied from the control packet collector 110 in step S500. At this time, if it is determined that the port number of the control packet is, for example, "554" which means that the packet uses the RTSP transmission protocol, the dynamic session analyzer 112 proceeds from step S502 to step S504 and the RTSP. According to the protocol specification, payload information of the control session packet is analyzed to extract dynamic session information.

That is, the control session packet determined as the port number 554 is applied to the RTSP protocol analysis program of FIG. 6 according to an embodiment of the present invention, and after checking whether the source port number is "554" in step 600, the pay page It is checked whether there is a successful response message in the load. If there is a successful RTSP response message as shown in FIG. 7 in the payload, dynamic session information is extracted from the transmission message as shown in FIG. 7 in the payload through step 602 of the analysis program. do.

Accordingly, the dynamic session analyzer 112 analyzes the payload of the RTSP protocol control session packet in step S508, and if a new transport protocol and port number used by the dynamic session are found, step S524 in step S524. Proceed to add the information of the dynamic session to the dynamic session information table 114. On the contrary, if the payload of the control session packet is analyzed, the dynamic session analyzer 112 checks whether the FIN flag is found in the packet of the existing session, and if the FIN flag is found. In operation S526, the dynamic session information table 114 may be updated by deleting the information of the corresponding session from the dynamic session information table 114.

Next, when it is determined in step S500 that the port number of the control session packet is "1755", which means that the packet uses the MMS transmission protocol, for example, the dynamic session analyzer 112 performs the step S508 in step S508. In step), payload information of the control session packet is analyzed according to the specification of the MMS protocol.

That is, the control session packet determined that the port number is "1755" is applied to the MMS protocol analysis program of FIG. 8 according to an embodiment of the present invention, and is checked whether the source port number is "1755" in step 610. Thereafter, the first 8 bytes of data in the payload are read and checked to have the values of the MMS start message 614 and the MMS setup message 616 of FIG. 9 to check whether the packet contains dynamic session information. In this case, when the control session packet is inspected as a packet including dynamic session information, a pattern matching the regular expression of the URL message 618 of FIG. 9 in the payload is detected through step 612 of the MMS analysis program. Dynamic session information of new transport protocol and port number information for multimedia data is extracted.

Accordingly, the dynamic session analyzer 112 analyzes the payload of the MMS protocol control packet in step S508 and finds a new transport protocol and a port number used by the dynamic session in step S524 in step S524. The process proceeds to add the dynamic session information to the dynamic session information table 114. On the contrary, if the payload of the control packet is analyzed and the packet of the existing session is determined, the dynamic session analyzer 112 checks whether the FIN flag is found in the packet of the existing session, and if the FIN flag is found (S526). In step S528, the dynamic session information table is updated by deleting the information of the corresponding session from the dynamic session information table 114.

Next, when it is determined in step S500 that the port number of the monitoring collected control packet is "5060", which means that the packet uses the SIP protocol, for example, the dynamic session analyzer 112 performs the step (S510). In step S512, the payload information of the control session packet is analyzed according to the specification of the SIP protocol.

That is, the control session packet having the port number determined to be “5060” is applied to the SIP protocol analysis program of FIG. 10 according to the embodiment of the present invention, and it is checked whether the source port number is “5060” at step 620. Thereafter, it is checked whether the payload of the control session packet includes a regular expression such as an invitation message 624 or a response message 626 as shown in FIG. In this case, when the invitation message or the response message as shown in FIG. 11 exists in the payload, the information on the dynamic session in the payload is included through step 622 of the SIP analysis program. As described above, the connection message 627 or the media message 630 is detected to extract dynamic session information of a transport protocol and port number information of a session to transmit data.

Accordingly, the dynamic session analyzer 112 analyzes the payload of the SIP protocol control session packet in step S508, and if a new transport protocol and port number used by the dynamic session are found, step S524 in step S524. The process proceeds to add the dynamic session information to the dynamic session information table 114. On the contrary, if the payload of the control packet is analyzed and the packet of the existing session is determined, the dynamic session analyzer 112 checks whether the FIN flag is found in the packet of the existing session (S526). In operation S528, the dynamic session information table 114 is updated by deleting the information of the corresponding session from the dynamic session information table 114.

Next, when it is determined in step S500 that the port number of the monitoring control packet collected is "1720", which means that the packet uses the Q.931 transmission protocol, the dynamic session analyzer 112 performs operation S514. In step S516, the payload information of the control session packet is analyzed according to the specification of the Q.931 protocol.

That is, the control session packet whose port number is determined to be “1720” is applied to the Q.931 protocol analysis program of FIG. 12 according to an embodiment of the present invention, and the protocol identifier of the payload of the control packet is determined in step 632. After Q.931 is checked, if the existence of the connection message type including the dynamic session information is confirmed, the analysis is started to find the dynamic session information from the payload. Then, in step 634, Q.931 reads the length of each element information and detects element information such as inter-user information, and extracts dynamic session information of a port number to receive media data.

Next, the dynamic session analyzer 112 recognizes the H.245 protocol through the extracted port number, and proceeds from step S518 to step S520 to determine the H.245 protocol according to the specification of the H.245 protocol. Payload information is analyzed in a control packet collected from a port number set as a packet transmission port.

That is, the control session packet collected from the port number set as the transport port of the H.245 protocol is applied to the H.245 protocol analysis program of FIG. 13 according to an embodiment of the present invention, and the H.245 control session is performed in step 636. After the payload of the packet is read, it is determined whether it is a logical channel initiation exchange message and whether to analyze the payload. In this case, when analyzing the payload of the control session packet, in step 638, the payload analysis result detects the forward channel, the reverse channel parameter, or the network access parameter, and thus, the dynamic session information of the port number information used in the dynamic session is determined. Will be extracted.

Subsequently, the dynamic session analyzer 112 analyzes the payload of the Q.931 or H.245 transport protocol control session packet in step S508, and if a new transport protocol and port number used by the dynamic session are found (S522). The process proceeds to step S524 to add the information of the corresponding dynamic session to the dynamic session information table 114. On the contrary, when the payload of the control session packet is analyzed and the packet of the existing session is determined, the dynamic session analyzer 112 checks whether the FIN flag is found in the packet of the existing session and finds the FIN flag (S526). In step S528, the dynamic session information table 114 is updated by deleting the information of the corresponding session from the dynamic session information table 114.

The multimedia service traffic analyzer 104 includes a multimedia service traffic analyzer 700, a presenter 704, and a multimedia service traffic information table 702. As illustrated in FIG. 14, the multimedia service traffic analyzer 700 compares flow information input from the flow generator 100 with dynamic session information input from the dynamic session analyzer 102. The multimedia service traffic analyzer 700 includes information pairs such as a data client address, a data client port, a transport protocol of the dynamic session information, a destination IP address, a destination port number, a protocol number, and the like of the stored flow information. It checks whether it is same as pair of IP address, source port number, protocol number, etc.

At this time, the multimedia service traffic analyzer 700 determines that the flow is the multimedia service traffic when the flow information from the unknown port inputted from the flow generating unit 101 matches with the result of the comparison with the dynamic session information. The server information of the control session is added to the flow information to generate multimedia service traffic information and stored in the multimedia service traffic information table 702, and other general traffic is passed through. The information stored as described above is displayed through the web by the presenter 704 so that the system operator can easily check the multimedia service traffic situation.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

As described above, the present invention analyzes the payload of the multimedia service control session packet in the service traffic monitoring of the packet flow input through an unknown port among the multimedia service traffic input from the network in the multimedia service traffic monitoring system. By extracting the port number and the transport layer protocol generated dynamically, the monitoring and analysis of the multimedia service traffic, which could not be analyzed by the method of judging the application of the traffic based on the transport layer port number of the conventional packet, is based on this. By doing this, there is an advantage that the network traffic state can be more clearly understood.

Claims (33)

A multimedia service traffic monitoring system, A flow generator for generating flow information on packets passing through the network monitoring point; A dynamic session analyzer for analyzing a packet of a control session to determine service traffic of a dynamically generated session flow; The multimedia service traffic analysis unit which compares the flow information and the packet analysis information of the control session to determine the flow related to the multimedia service and generates the multimedia service traffic information and provides it to the system operator Multimedia service traffic monitoring system comprising a. The method of claim 1, The flow generating unit includes: a packet collector configured to extract header information by collecting headers of packets received through a network monitoring point; A flow generator for generating flow information by collecting and integrating packet-specific information belonging to the same flow for a predetermined time using the packet header information provided from the packet collector; And a flow information table for storing flow information generated from the flow generator. The method of claim 2, The packet collector may include a collection filter collecting only a header of a packet passing through the network monitoring point; Header information extractor for analyzing the packet header and extracting packet header information necessary for traffic analysis Multimedia service traffic monitoring system comprising a. The method of claim 2, The flow generator detects whether there is the same flow for each packet with respect to the packet input from the packet collector, and if the packet is a packet of an existing flow, the flow generator determines the number of packets of the flow in the flow information table. And updates the flow length information, and if there is no existing flow to which the packet belongs, creates a new flow from the collected packets and newly registers and stores the flow information in the flow information table. The method of claim 4, wherein The flow information table is a multimedia service traffic monitoring, characterized in that the flow registers the source IP address, destination IP address, source port number, destination port number, transport protocol information for each flow generated by the flow generator system. The method of claim 1, The dynamic session analyzer may include a control packet collector configured to collect a payload portion including a header of a packet passing through a monitoring point, extract header information required for analysis, and output the extracted header information and payload data together; A dynamic session analyzer which selects a packet of a control session through packet header information applied from the control packet collector and extracts dynamic session information by analyzing a payload according to a specification of a corresponding transport protocol; Dynamic session information table for storing dynamic session information of the control session packet extracted from the dynamic session analyzer Multimedia service traffic monitoring system comprising a. The method of claim 6, The control packet collector includes a control collection filter for collecting a packet passing through a monitoring point, including a header, to a payload; Header information extractor for analyzing the packet header and extracting packet header information necessary for traffic analysis Multimedia service traffic monitoring system comprising a. The method of claim 6, The dynamic session analyzer determines a transport port number through header information of the control session packet, and extracts dynamic session information by analyzing a payload of the control session packet through a transport protocol analysis program set for each port. Multimedia service traffic monitoring system. The method of claim 8, When the determined port number is the port number of the RTSP protocol, the dynamic session analyzer inputs payload data of the control session packet to the RTSP protocol analysis program and checks whether an RTSP response message in the payload exists. And detecting a representation of a transport message and extracting dynamic session information of a new transport protocol and a port number to which multimedia data is transmitted from the transport message. The method of claim 8, If the determined port number is a port number of the MMS protocol, the dynamic session analyzer inputs payload data of the control session packet to an MMS protocol analysis program, reads the first 8 bytes of the payload, and starts an MMS start message. And MMS configuration message, after detecting the regular expression pattern of the URL message, the multimedia service traffic monitoring system comprising extracting dynamic session information of a new transport protocol and port number to which multimedia data is transmitted from the URL message. . The method of claim 8, If the determined port number is a port number of a SIP protocol, the dynamic session analyzer inputs payload data of the control session packet to a SIP protocol analysis program, whereby a regular expression of an invitation message or a response message is generated in the payload. And checking dynamic session information of a new transport protocol and a port number of a session for transmitting multimedia data from a connection message or a media message including information on the dynamic session. The method of claim 8, If the determined port number is a port number of a Q.931 protocol, the dynamic session analyzer inputs payload data of the control session packet to a Q.931 protocol analysis program, and the protocol identifier of the payload is Q.931. 931, check whether there is a connection message type including dynamic session information, and read the length of each element information in Q.931 and detect the element information called user-to-user information. Multimedia service traffic monitoring system, characterized in that for extracting session information. The method of claim 12, The dynamic session analyzer reads the payload of the H.245 control session packet through a port number obtained through payload analysis of the control session packet of the Q.931 protocol to determine whether a logical channel initiation exchange message is present, and the corresponding pay Multimedia service traffic monitoring system characterized by extracting dynamic session information of port number used in dynamic session by detecting forward channel, reverse channel parameter or network access parameter. The method of claim 6, The dynamic session information table includes a data client address, a data client port number, a control server address, a control server port number, a control client address, a control client port number, from a payload of a control session packet extracted through the dynamic session analyzer, Multimedia service traffic monitoring system, characterized in that the dynamic session information is registered and stored in the application, transport layer protocol, session start time, session end time information. The method according to any one of claims 9 to 13, The dynamic session analyzer updates the dynamic session information table by registering the new transport protocol and port number used by the dynamic session as a result of analyzing the payload and registering the information as the information of the corresponding dynamic session in the dynamic session information table. Multimedia service traffic monitoring system, characterized in that. The method of claim 15, The dynamic session analyzer checks whether the FIN flag is found in the packet of the existing session in the case of the packet of the existing session as a result of analyzing the payload of the control session packet. And updating the dynamic session information table by deleting session information. The method of claim 1, The multimedia service traffic analyzer may include a multimedia service traffic analyzer that analyzes multimedia service traffic by referring to dynamic session information of a corresponding flow applied from a dynamic session analyzer when receiving flow information from a port unknown from the flow generator; ; A multimedia service traffic information table for registering and storing multimedia service traffic information generated from the multimedia service traffic analyzer; Presenter for displaying the multimedia service traffic information generated from the multimedia service traffic analyzer through the web for the system operator to check Multimedia service traffic monitoring system comprising a. The method of claim 17, The multimedia service traffic information table may include a source IP address, a destination IP address, a source port number, a destination port number, a transport protocol number, a data application, the number of packets, and the like for each multimedia service traffic determination flow generated by the multimedia service traffic analyzer. And storing the packet length, the control server address, and the control server port number as multimedia service traffic information. The method of claim 17, The multimedia service traffic analyzer may include a data client address of the dynamic session information, a data client port number, a transport protocol pair and a destination IP address of a flow information received from an unknown port authorized to the flow generator, a destination port number, Multimedia service traffic monitoring system characterized in that it determines whether the multimedia service traffic by determining whether the protocol number pair or source IP address, source port number, protocol number pair is the same. The method of claim 17, When the multimedia service traffic analyzer determines that the flow information from the unknown port is new multimedia service traffic through the statistical session information, the multimedia service traffic analyzer adds multimedia service traffic information including server information of a control session to the flow information. And generating service traffic information and storing the service traffic information in a multimedia service traffic information table. A multimedia service traffic analysis method in a multimedia service traffic analysis system including a flow generator, a dynamic session analyzer, and a multimedia service traffic analyzer, (a) generating flow information for packets passing through the network monitoring point; (b) extracting dynamic session information by analyzing a control session packet for the dynamically generated session flow of the flow; (c) comparing the flow information with dynamic session information from a control session packet to determine a multimedia service related flow; (d) generating multimedia service traffic information and displaying the traffic analysis result to a system operator when the multimedia service related flow is determined; Multimedia service traffic monitoring method comprising a. The method of claim 21, The flow information generated in the step (a), the multimedia service traffic monitoring method, characterized in that stored in the flow information table in the flow generation unit. The method of claim 21, Step (a) may include: (a1) extracting header information by collecting a header of a packet passing through the network monitoring point; (a2) generating flow information by collecting and integrating packet-specific information belonging to the same flow for a predetermined time using the extracted packet header information Multimedia service traffic monitoring method comprising a. The method of claim 23, The step (a2) may include: (a21) searching for whether there is an identical flow for each packet with respect to the collected packet; (a22) if the packet is a packet of an existing flow, updating the packet number and flow length information of the corresponding flow in the flow information table; (a23) if there is no existing flow to which the packet belongs in the flow information table, generating a new flow from the collected packets, generating flow information for this, and storing the flow in the flow information table Multimedia service traffic monitoring method comprising a. The method of claim 21, Step (b) comprises: (b1) collecting the header and the payload portion of the packet passing through the monitoring point; (b2) selecting a control session packet by extracting header information necessary for analysis from the header of the packet; (b3) confirming a transport protocol by searching a port number obtained from header information of the control session packet; (b4) extracting dynamic session information by analyzing a payload according to the specification of the corresponding transport protocol; Multimedia service traffic monitoring method comprising a. The method of claim 25, After the step (b4), (b5) if a new transport protocol and port number used by the dynamic session are found as a result of analyzing the payload, registering and storing them as corresponding dynamic session information in the dynamic session information table; (b6) if the packet is a packet of an existing session, checking whether a FIN flag is found in the packet of the existing session, and deleting the information of the corresponding session from the dynamic session information table when the FIN flag is found. Multimedia service traffic monitoring method further comprising. The method of claim 25, Step (b4) may include: (b41) inputting payload data of the control session packet to the RTSP protocol analysis program when the determined port number is a port number of the RTSP protocol; (b42) checking whether the RTSP response message is present in the payload and checking whether the control session packet includes dynamic session information; (b43) detecting a representation of the RTSP transmission message from the payload data and extracting dynamic session information of a new transmission protocol and a port number to which multimedia data is to be transmitted from the transmission message; Multimedia service traffic monitoring method comprising a. The method of claim 25, Step (b4) may include: (b41 ') inputting payload data of the control session packet to an MMS protocol analysis program when the determined port number is a port number of an MMS protocol; (b42 ') reading the first 8 bytes of the payload to check whether an MMS start message and an MMS setup message exist and checking whether the control session packet includes dynamic session information; (b43 ') detecting a regular expression pattern of a URL message from the payload and extracting dynamic session information of a new transport protocol and a port number to which multimedia data is transmitted from the URL message; Multimedia service traffic monitoring method comprising a. The method of claim 25, Step (b4) may include: (b41 ") inputting payload data of the control session packet to a SIP protocol analysis program when the determined port number is a port number of a SIP protocol; (b42 ") checking whether there is a regular expression of an invitation message or a response message in the payload to check whether the control session packet includes dynamic session information; (b43 ") extracting dynamic session information of a new transport protocol and a port number of a session for transmitting multimedia data from a connection message or a media message including dynamic session information in the payload; Multimedia service traffic monitoring method comprising a. The method of claim 25, Step (b4) may include: (b41 '") inputting payload data of the control session packet to a Q.931 protocol analysis program when the determined port number is a port number of a Q.931 protocol; (b42 '") checking whether the payload protocol identifier is Q.931, and then checking whether there is a connection message type including dynamic session information; (b43 '") extracting dynamic session information of a port number to receive media data by detecting element information called information between users while reading the length of each element information in Q.931. Multimedia service traffic monitoring method comprising a. The method of claim 30, In step (b42 '"), (b44'") reading the payload of the H.245 control session packet from the port of the dynamic session information obtained during the payload analysis to determine whether a logical channel initiation exchange message; (b45 '") extracting the dynamic channel information of the port number used in the dynamic session by detecting the forward channel, reverse channel parameter or network access parameter from the payload of the H.245 control session packet; Multimedia service traffic monitoring method further comprising. The method of claim 21, The step (c) may include: a data client address of the dynamic session information, a data client port number, a transport protocol pair, a destination IP address of a flow information received from an unknown port applied to the flow generating unit, a destination port number, And determining whether the protocol number pair or the source IP address, the source port number, and the protocol number pair are the same to determine a flow related to the multimedia service. The method of claim 21, In the step (d), the multimedia service traffic information is stored in the multimedia service traffic information table in the multimedia service analyzer as information in which server information of a control session is added to flow information determined as the multimedia service traffic. Multimedia service traffic monitoring method.

Images