ROUTING MONITOR, A METHOD FOR MONITORING ROUTER INFORMATION OF A NETWORK AND A PROGRAM PRODUCT, PARTICULARLY FOR A NETWORK MONITOR TO MONITOR COMMUNICATIONS BETWEEN ROUTERS THROUGH A TAP WITHOUT REQUESTING A BGP SESSION/CONNECTION WITH ROUTERS, NOT REQUESTING A CHANGE IN A CONSTRUCTION OF THE ROUTERS

• Main Authors: TUDOR ALEXANDER L, TATMAN LANCE A, ILNICKI SLAWOMIR K
• Format: Patent
• Language: English; Korean
• Published: 07.03.2005
• Edition: 7
• Subjects: ELECTRIC COMMUNICATION TECHNIQUE; ELECTRICITY; TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHICCOMMUNICATION

PURPOSE: A routing monitor, a method for monitoring router information of a network and a program product are provided to enhance efficiency of an overall system by not setting a BGP(Border Gateway Protocol) session between a monitored router and a monitoring system and thus omitting use of a CPU cycle in the monitored router. CONSTITUTION: A TI(TAP Interface) module(405) captures traffic by using a TAP(404) and filters non-routing information. BGP data indicating an IP address of a monitored router is transmitted to a TR(Transport Reconstruction) module(406) of a network monitor(400). The TR module(406) reconstructs a TCP data stream and processes a defective packet and packet retransmission in time. The TI module(405) reduces data traffic to data required for reconfiguring a TCP session related to exchange of routing information. The TAP(404) can collect a plurality of physical TAPs for providing each individual interface to a line card of a router. The TR module(406) can detect intrusion. The TR module(406) can authenticate only traffic with a destination of an IP address of a monitored router and can be constructed to log a different attempt to establish a connection. After a portion of a TCP data stream is reconstructed, the TR module(406) transfers data to a BMR(BGP Message Reconstruction) module(407) for assembling the BGP message and guaranteeing its completeness. The BMR module(407) transmits the BGP message to one of an RR(Routing Reconstruction) module(408) and a BSE(BGP Session Emulation) module(410). The RR module(408) provides a device-integrated solution and can be used for constructing an RIB(Routing Information Base). A snapshot of the RIB as well as time-stamped BGP update information can be stored in a local disk(412).