Packet capture method and device

Abstract

This packet capture method comprises: steps (S1, S2) for attaching a flag to each piece of data in a packet that was received and divided up; a step (S3) for writing the data pieces to a ring buffer; steps (S4 to S8) for issuing a failure detection trigger when a cumulative value of the number of packet bytes within a failure detection period exceeds a failure detection threshold value; steps (S9 to S11) for stopping the writing to the ring buffer if the writing to the ring buffer reaches or exceeds a stop-writing address determined on the basis of the failure detection trigger; a step (S12) for reading the data pieces in order from the stop-writing address; and steps (S13 and S14) for outputting a packet capture in accordance with a result determined on the basis of the flags of the read data pieces.　Due to the foregoing, this invention is able to provide a packet capture method which can efficiently execute packet captures before and after the occurrence of a packet failure.

Description

[Technical field]

[0001] The present invention relates to a packet capture method and device for use in a network system. [Background technology]

[0002] In recent years, network failures have occurred in data centers due to sudden traffic concentrations in an extremely short period of time. In network systems that transmit and receive packets, it is necessary to transmit and receive packets accurately and efficiently even during network failures.

[0003] In particular, microbursts, which are one type of network failure, can cause network delays and packet loss. Therefore, there is a need for a packet capture device that can analyze network failures, including microbursts, and receive packets.

[0004] A typical method for analyzing a network failure involves capturing packets from a network in which a failure has occurred and analyzing which traffic is causing the failure. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2020 / 230265 [Patent Document 2] JP 2020-182027 A [Non-patent literature]

[0006] [Non-Patent Document 1] Akiko Ohki et al., "A study on memory address management methods for packet buffers," Proceedings of the 2016 Institute of Electronics, Information and Communication Engineers (IEICE) General Conference, Fundamentals and Boundaries Lecture Series, p. 26, 2016. Summary of the Invention [Problem to be solved by the invention]

[0007] However, because microbursts are instantaneous phenomena and their occurrence timing is unpredictable, a large amount of memory is required to store the captured data, and it is also difficult to identify the location of the microburst from the captured data.

[0008] In order to identify the location where a microburst occurs, a method of capturing only packets before and after the occurrence of a microburst has been disclosed (Patent Document 1). In this method, a fault detection function and a capture function are provided in the same device, packets are stored sequentially in a memory configured as a ring buffer, and the capture is stopped when a fault is detected, making it possible to capture packets not only after fault detection but also before the detection. In addition, storing one packet per word of memory that configures the ring buffer makes it possible to identify the boundaries of packets.

[0009] However, since the packets have a variable length, it is necessary to match the word length with the maximum packet length, which increases the memory capacity used for the ring buffer.

[0010] Also, a method has been disclosed in which a word length is reduced and one packet is stored across multiple words (Patent Document 2, Non-Patent Document 1).

[0011] However, this requires an additional memory for recording information (packet length, address) for identifying the boundaries of packets stored in the memory, which increases the memory capacity.

[0012] As described above, with the conventional technology, it is difficult to realize packet capture while suppressing memory capacity for variable-length packets before and after the occurrence of a network failure such as a microburst. [Means for solving the problem]

[0013] In order to solve the above-mentioned problems, a packet capture method according to the present invention includes:Packet capture device receiving a packet; The packet capture device, Dividing the packet and attaching a flag to each piece of data of the divided packets; The packet capture device, writing said data to an address in a ring buffer; , the packet capture device, accumulating the number of bytes of the packet when the packet is received within a period for detecting a failure; The packet capture device, issuing a fault detection trigger when the cumulative value of the number of bytes exceeds a preset fault detection threshold; The packet capture device, determining a write stop address based on the fault detection trigger; The packet capture device, stopping writing to the ring buffer when writing to the ring buffer reaches or exceeds the write stop address; The packet capture device, reading the data in sequence from the write stop address; The packet capture device, determining a packet capture output based on a flag of the read data; The packet capture device, and executing the packet capture output according to a result of the determination. The write stop address is calculated based on a preset address retention ratio by going back in time from the write address at the time the fault detection trigger is generated to the addresses of the ring buffer. do.

[0014] Also, a packet capture device according to the present invention includes a packet receiving unit, a flag assigning unit that divides a packet received by the packet receiving unit and assigns a flag to each piece of data of the divided packets, a packet holding unit having a ring buffer into which the data is written, a failure detection unit that issues a failure detection trigger when a failure is detected in the reception of the packet, a capture control unit that stops writing of the data based on the failure detection trigger, and a capture file generation unit that reads the data written to the ring buffer and outputs it to a capture file based on the flag assigned to the data. The capture control unit calculates a write stop address by tracing back in time on the ring buffer from the write address at the time when the fault detection trigger was generated based on a preset address retention ratio, and stops writing to the ring buffer when the writing to the ring buffer reaches or exceeds the write stop address. do. Effect of the Invention

[0015] According to the present invention, it is possible to provide a packet capture method and device that can efficiently capture packets before and after the occurrence of a packet failure. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing a configuration of a packet capture device according to a first embodiment of the present invention. [Figure 2A] FIG. 2A is a flowchart illustrating a packet capture method according to the first embodiment of the present invention. [Figure 2B] FIG. 2B is a flowchart illustrating the packet capture method according to the first embodiment of the present invention. [Figure 3A] FIG. 3A is a diagram for explaining the packet capture method according to the first embodiment of the present invention. [Figure 3B] FIG. 3B is a diagram for explaining the packet capture method according to the first embodiment of the present invention. [Figure 3C] FIG. 3C is a diagram for explaining the packet capture method according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a diagram for explaining the effects of the packet capture method and device according to the first embodiment of the present invention. [Diagram 5] FIG. 5 is a diagram for explaining the effects of the packet capture method and device according to the first embodiment of the present invention. [Figure 6] FIG. 6 is a block diagram showing a configuration of a packet capture device according to the second embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] <First embodiment> A packet capture method and device according to a first embodiment of the present invention will be described with reference to FIGS. 1 to 5. FIG.

[0018] <Configuration of packet capture device> A packet capture device 10 according to this embodiment includes a packet receiving unit 11, a flagging unit 12, a fault detection unit 13, a packet holding unit 14, a capture control unit 15, a parameter setting unit 16, and a capture file generation unit 17. Each component of the packet capture device 10 will be described below.

[0019] [Packet receiver] A packet receiving unit 11 receives a packet 1 from an external network.

[0020] [Flag assignment section] The flag assignment unit 12 divides the packet 1 input from the receiving packet unit into logical word units of the memory (hereinafter referred to as the "ring buffer") that constitutes the ring buffer of the packet holding unit 14, and assigns a packet head flag to each divided unit.

[0021] The packet head flag is set to 1 when the divided data (hereinafter referred to as "divided packet data") includes the packet head, and is set to 0 otherwise.

[0022] [Fault detection section] The fault detection unit 13 is a functional unit that detects faults from fluctuations in the amount of packets 1 input from the packet receiving unit 11. Here, an example is shown of detecting a traffic burst called a microburst that occurs on the order of sub-milliseconds.

[0023] The number of bytes of packet 1 is accumulated at a constant period, and a judgment is made as to whether it exceeds a preset threshold value. If it does, it is assumed that a microburst has been detected. Furthermore, if a fault is detected, a fault detection trigger is sent to the capture control unit 15.

[0024] [Packet storage unit] In the packet holding unit 14, packets 1 received by the packet receiving unit 11 having a ring buffer configuration are stored sequentially in the ring buffer, and when the memory capacity is exceeded, the oldest packet data is overwritten.

[0025] At this time, the packet data is stored in units of a predetermined length, and if it does not fit into one word, it is stored across to the next word.

[0026] In addition, the SOP flag indicating the beginning of a packet is set to 1 in the word in which the first data of each packet is stored, and the SOP flag is set to 0 in other words.

[0027] The packet holding unit 14 is provided with a memory having a ring buffer configuration, and sequentially writes the packet data with the packet head flag input from the flag adding unit 12 into the ring buffer.

[0028] When the packet data has been written to the end of the ring buffer, the write address is returned to the beginning of the ring buffer. By repeating the same write operation thereafter, a certain amount of recently received packets can be stored in the ring buffer.

[0029] [Capture control section] The capture control unit 15 performs control so as to hold packets from the period before and after the detection of a fault.

[0030] The capture control unit 15 controls writing of packet data to the ring buffer in the packet holding unit 14. As described above, the packet holding unit 14 normally writes the packet data input from the flagging unit 12 sequentially.

[0031] When a fault detection trigger is received from the fault detection unit 13, the operation of writing packet data to the ring buffer is controlled so that the received packet data is held in a preset ratio between the pre-fault-detection holding area and the post-fault-detection holding area (hereinafter referred to as the "address holding ratio"). Here, the "pre-fault-detection holding area" refers to an address area that holds packet data going back in time from the time the fault detection trigger was received, and the "post-fault-detection holding area" refers to an address area that holds packet data after the time the fault detection trigger was received.

[0032] Specifically, an address is calculated that goes back in time from the write address at the time the fault detection trigger was received toward the area where older packets are stored before the fault was detected, and this address is designated as the "write stop address."

[0033] The capture control unit 15 writes new packet data input from the flag assignment unit 12 until the write destination address of the packet data in the packet holding unit 14 reaches the write stop address, and stops writing when the write stop address is reached.

[0034] In this case, the packet data is written in packets. As a result, the end of the address at the end of the packet may not match the end of the write stop address, and the write stop address may be exceeded. In this case, writing is stopped when the address is exceeded.

[0035] Also, when writing is stopped, it may stop in a state where some of the old packet data has been overwritten. In this case, output of the data in the state where some of the old packet data has been overwritten (hereinafter also referred to as "corrupted data") is avoided by the file output procedure described later. Some tools for viewing capture files cannot open capture files that contain corrupted data, so it is preferable not to write corrupted data.

[0036] [Parameter setting section] In the parameter setting unit 16, a threshold value used in the fault detection unit 13 and a ratio (address holding ratio) of a pre-fault detection holding area to a post-fault detection holding area used in the capture control unit 15 are preset as parameters from the outside.

[0037] [Capture file generator] The capture file generator 17 outputs the packet data held in the packet holder 14 to a capture file in a PCAP format or the like.

[0038] In detail, the packets held in the ring buffer are recorded in chronological order in the memory of the capture file generating unit 17, and then the packet data is read out from the memory and output to the capture file.

[0039] Here, when the capture control unit 15 stops writing, the packet data is read out in order from the address next to the address to which the packet data was last written, and output to a capture file (created as a capture file).

[0040] In this capture file creation, if the head flag attached to each divided packet data is 0, the data at the next address is read without being output to a file.

[0041] If the packet head flag is 1, it is selected as data to be made into a capture file, and the selected series of data is output to the capture file as data constituting one packet. For example, after detecting a packet head flag of 1, packet data may be read out until the next packet head flag of 1 is detected, and the data may be used as data constituting one packet.

[0042] <How to capture packets> The packet capture method according to the present embodiment will be described with reference to FIGS. 2A to 3C.

[0043] First, packet 1 is received (S1).

[0044] Next, the received packet 1 is divided into logical words of the ring buffer, and a packet head flag is added to each divided packet data (S2). The packet head flag is set to 1 if the divided packet data includes the packet head, and set to 0 otherwise.

[0045] Next, the divided packet data is written to each address in the ring buffer (S3).

[0046] On the other hand, if the packet is received within the failure detection period, the number of bytes of the packet is accumulated (integrated) (S4 to S5).

[0047] If it is not within the period for detecting a fault, the number of bytes of the packet is cleared once, and then the number of bytes is accumulated (integrated) (S6).

[0048] Next, a fault (microburst) is judged based on the cumulative number of bytes (S7).When the cumulative number of bytes exceeds a set threshold, a fault detection trigger is issued (S8).

[0049] Moreover, when the cumulative value of the number of bytes is equal to or less than the threshold value, a failure detection trigger is not issued and packet reception continues (S1).

[0050] Next, when a fault detection trigger is issued, the address at which writing is to be stopped (hereinafter, "write stop address") is determined (S9). Here, the write stop address is calculated based on a preset address retention ratio by going back in time in the ring buffer addresses from the write address at the time the fault detection trigger was issued.

[0051] In detail, the write stop address is calculated based on a preset address retention ratio, going back from the write address at the time the fault detection trigger was issued in the direction of the address in the ring buffer where old packet data is being held (written) by the number of addresses in the holding area before fault detection.

[0052] When the write destination address of the packet data in the ring buffer reaches or exceeds the write stop address, writing of the packet data is stopped (S10 to S11).

[0053] If no fault detection trigger is issued and if the write stop address has not been reached or exceeded, the received packets are continued to be written to the ring packet (S3). After that, the process proceeds to the address next to the end of the written packet data and continues to receive packets.

[0054] Next, in order to output the data to a capture file (create a capture file), the packet data is read out in order from the write stop address (S12).

[0055] Next, based on the head flag added to each piece of divided packet data, it is determined whether or not to output the data to a capture file (S13).

[0056] Finally, the series of data selected according to the result of this determination is output to a capture file as data constituting one packet (capture file) (S13).

[0057] For example, in this capture file creation, if the head flag attached to each divided packet data is 0, the data at the next address is read without being output to a file.

[0058] Also, if the packet head flag is 1, the packet data is read out until the next packet head flag becomes 0, and the data whose head flag is 1 is output to the capture file as data constituting one packet.

[0059] Here, an example has been given in which "0" and "1" are used as the head flags added to the respective divided packet data, but the present invention is not limited to this and any predetermined value may be used.

[0060] In addition, in determining whether to output a capture file (S13), the byte length of each packet data can also be taken into consideration in addition to the packet head flag.

[0061] For example, as shown in FIG. 2B, packet data is read from the address next to the write stop address, and skipped up to data whose packet head flag is 0 (S13_1).

[0062] When the packet head flag is 1, if the end of the read packet data is not missing based on the byte length of the packet data, the data is selected as data to be captured as a packet. If the end of the packet data is missing, the data is not selected as data to be captured as a packet (S13_2, S13_3).

[0063] The selected series of data is output to a capture file as data constituting one packet (S14). The read address is advanced to data where the next packet head flag is 1. However, if the advance results in returning to the write stop address, the capture file output process is stopped (S15). Also, if the end of the read packet data is lost (S13_3), the read address is advanced to data where the next packet head flag is 1 (S15) in the same manner.

[0064] Thereafter, packets are received and the above steps are continued.

[0065] In this way, when a fault is detected and writing to the ring buffer is stopped, even if the process stops in a state where some of the old packet data has been overwritten, the packet data can be output to the capture file without outputting the corrupted data to the capture file.

[0066] An example of creating a capture file using the packet capture method according to the present embodiment will be described with reference to FIGS. 3A to 3C.

[0067] 3A and 3B show an example of how data is written to a packet storage memory (ring buffer) configured as a ring buffer. Here, data is written from the first address of the ring buffer, "0x0000000," and when packet data has been written up to the last address of the ring buffer, "0x0000005," the write address is returned to the first address of the ring buffer, "0x0000000." Thereafter, a similar write operation is repeated. Here, the dotted arrow in the figure indicates the direction in which data is written.

[0068] Moreover, the packet data read from the ring buffer is written to the memory of the capture data generating unit 30. FIG 3C shows an example of how the capture data generating unit 30 reads the packet data from the memory.

[0069] First, packets #0 and #1 are written to the ring buffer. Since packet #0 has a long byte length, it is written across two lines from addresses "0x0000000" to "0x0000001" (Figure 3A).

[0070] Here, the address "0x0000000" contains the beginning of packet #0, so the SOP flag is set to 1. Also, the address "0x0000001" on the second line sets the SOP flag to 0.

[0071] Next, packet #1 is written to address "0x0000002" (indicated by the white arrow in the figure).

[0072] Next, packets #2 and #3 are written from address "0x0000003" onwards (Figure 3B).

[0073] Here, packet #2 is written to addresses "0x0000003" to "0x0000004", the SOP flag is 1 at "0x0000003" and 0 at "0x0000004".

[0074] Furthermore, packet #3 is written to address "0x0000005", and then returns to address "0x0000000". Thus, the SOP flag becomes 1 at "0x0000005", and 0 at "0x0000000".

[0075] At this time, if an error is detected at address "0x0000003" (indicated by the black arrow in the figure), writing to the memory of the capture data generation unit is stopped.

[0076] When the address retention ratio is set to 50% / 50%, the addresses "0x0000000" to "0x0000002" before the address "0x0000003" are set as the retention area before fault detection. Also, the addresses "0x0000003" to "0x0000005" after the address "0x0000003" are set as the retention area after fault detection.

[0077] Also, the write stop address is calculated based on the address retention ratio (50% / 50%) by going back from the write address "0x0000003" at the time the fault detection trigger was generated in the direction of the ring buffer address where old packet data was retained (written) (arrow a1 in the figure), by the number of addresses in the retention area before the fault was detected. As a result, the address "0x0000000" is set as the write stop address (diagonal line arrow in the figure).

[0078] Next, in the memory of the capture data generating unit, capture file creation is not performed for addresses from the write stop address to addresses where the SOP flag is 0, but capture file creation is performed from addresses where the SOP flag is 1 (FIG. 3C).

[0079] Here, the data from addresses "0x0000000" to "0x0000001", where the SOP flag is 0, is not converted into a capture file (dashed arrow a2 in the figure), and the capture file is created starting from the data at address "0x0000002", where the SOP flag is 1 (solid arrow a3 in the figure).

[0080] Here, the data at address "0x0000004" has an SOP flag of 0, but is determined to belong to the immediately preceding packet #2 based on the byte length of packet #2, which is recorded separately, and is made into a capture file.

[0081] In addition, although the SOP flag of the data at address "0x0000005" is 1, packet #3 is determined to be incomplete (the end is missing) based on the byte length of packet #3, which is recorded separately, and is not made into a capture file.

[0082] In this way, by determining whether to create a capture file based on the SOP flag, it is possible to avoid creating a capture file of data that has been corrupted by overwriting the ring buffer (here, the data of packet #0).

[0083] As described above, according to the packet capture method and device of the present embodiment, even if the received packets are variable-length packets, it is possible to efficiently create a capture file of only the packets before and after the occurrence of a failure.

[0084] <Effects> The effects of the packet capture method and device according to the present embodiment will be described with reference to FIGS.

[0085] As an example of the configuration of a memory into which packet data is written, as shown in FIG. 4, the logical word length is X (unit: bit) and the number of logical words is Y (unit: word).

[0086] In the conventional method, the amount of data that needs to be stored (recorded) when adding packet data is D 0 is expressed by equation (1).

[0087]

number

[0088] Here, P len_minis the shortest packet length. The first term in equation (1) indicates the address bit width, and the second term indicates the number of packets.

[0089] In this embodiment, the amount of data D that needs to be stored (recorded) when adding packet data 1 is expressed by equation (2).

[0090]

number

[0091] Here, the first term in equation (2) indicates the number of bits required for the packet head flag, and the second term indicates the number of logical words.

[0092] FIG. 5 shows the ratio (D0 / D1) of the data amount Do to D1 calculated using the formulas (1) and (2). Here, P len_min The calculation was done assuming that the bit length is 512 bits. In the dotted area in Figure 5, D0 / D1 is 1 or more, and the amount of data that needs to be stored (recorded) when adding packet data is small.

[0093] In this way, in the region where the logical word length X and the number of logical words Y are large, the packet capture method and device according to the present embodiment are effective.

[0094] According to the packet capture method and device of the present embodiment, even if the received packets are variable-length packets, it is possible to efficiently create a capture file of only the packets before and after the occurrence of a failure.

[0095] Therefore, according to the packet capture method and device of the present embodiment, it is possible to realize packet capture before and after the occurrence of a network failure while suppressing memory capacity for variable-length packets.

[0096] <Second embodiment> A packet capture method and device according to a second embodiment of the present invention will be described with reference to FIG.

[0097] <Configuration of packet capture device> As shown in FIG. 6, a packet capture device 20 according to this embodiment includes a flow identification unit 18 in front of the failure detection unit 13 in addition to the configuration of the first embodiment.

[0098] A difference is that a flow identification unit 18 is provided before the failure detection unit 13, making it possible to detect a failure for each flow.

[0099] In the first embodiment, failure detection is performed on all received packets 1 regardless of the flow. As a result, if there is no sudden increase in overall traffic but a sudden increase in traffic occurs on a per-flow basis, a failure cannot be detected.

[0100] On the other hand, in the packet capture device 20 according to the present embodiment, by judging the threshold value of the accumulated number of bytes on a flow-by-flow basis, it is possible to detect failures on a flow-by-flow basis that cannot be detected when observing the entire traffic.

[0101] In the packet capture method and device according to the present embodiment, flows are identified before the failure detection in the first embodiment. As a result, failures can be detected on a flow-by-flow basis. The configuration and effects other than this are the same as those of the first embodiment.

[0102] In the embodiment of the present invention, an example of the structure, dimensions, materials, etc. of each component in the configuration and method of the packet capture device and the like is shown, but the present invention is not limited to this. Anything that can exert the function and effect of the packet capture device may be used. [Industrial Applicability]

[0103] The present invention relates to a packet capture method and device, and can be applied to a network system that transmits and receives packets. [Explanation of symbols]

[0104] 10 Packet capture device 11 Packet receiver 12 Flagging section 13 Fault detection unit 14 Packet storage unit 15 Capture control section 16 Parameter setting section

Claims

1. A method for detecting a packet, comprising: a step of the packet capture device dividing the packet and attaching a flag to each piece of data of the divided packets; The packet capture device writes the data to an address in a ring buffer; a step of accumulating a number of bytes of the packet when the packet is received within a period for detecting a fault by the packet capture device; the packet capture device issuing a fault detection trigger when the cumulative value of the number of bytes exceeds a preset fault detection threshold; determining a write stop address based on the fault detection trigger by the packet capture device; the packet capture device stopping writing to the ring buffer when writing to the ring buffer reaches or exceeds the write stop address; The packet capture device reads the data in sequence from the write stop address; The packet capture device determines a packet capture output based on a flag of the read data; the packet capture device executes the packet capture output according to a result of the determination; Equipped with The write stop address is calculated based on a preset address retention ratio by going back in time from the write address at the time the fault detection trigger was generated to the addresses of the ring buffer. A packet capture method comprising:

2. A step in which the packet capture device determines whether a flag of the read data is a predetermined value; the packet capture device determining whether the end of the packet to which the read data belongs is missing; The packet capture method according to claim 1, further comprising:

3. A packet receiving unit; a flagging unit that divides a packet received by the packet receiving unit and assigns a flag to each piece of data of the divided packets; a packet storage unit having a ring buffer into which the data is written; a fault detection unit that issues a fault detection trigger when a fault is detected in the reception of the packet; a capture control unit that stops writing of the data based on the fault detection trigger; a capture file generating unit that reads the data written in the ring buffer and outputs the data to a capture file based on a flag added to the data; Equipped with The capture control unit calculates a write stop address by tracing back in chronological order on the ring buffer from the write address at the time when the fault detection trigger was issued based on a preset address retention ratio, and stops writing to the ring buffer when writing to the ring buffer reaches or exceeds the write stop address. A packet capture device comprising:

4. The failure detection unit issues the failure detection trigger when a cumulative value of the number of bytes of the packets in a predetermined period exceeds a failure detection threshold.

4. The packet capture device according to claim 3.

5. The capture file generating unit determines whether the flag is a predetermined value, and determines whether the end of the packet to which the data belongs is lost.

5. The packet capture device according to claim 3 or 4.

6. A flow identification unit is provided in front of the failure detection unit.

6. The packet capture device according to claim 3, wherein the packet capture device is a packet capture device that captures a packet from the packet.

Images