Packet forwarding device and program

Abstract

To provide a packet transfer device for detecting abnormalities in a communication network composed of a plurality of packet transfer devices at an early stage.SOLUTION: A packet transfer device includes: acquisition means that acquires at least one type of information of first information about one or more connections used to exchange route information with one or more other packet transfer devices, second information about updating of a routing table, and third information about processing packets sent and received between other two packet transfer devices to exchange route information between the other two packet transfer devices; and processing means that, when the acquisition means acquires the information, performs processing to transmit the information to a monitoring device, or to transmit statistical information on the information acquired by the acquisition means to the monitoring device at predetermined intervals.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a packet forwarding device and a program. [Background technology]

[0002] A communication network has multiple packet forwarding devices that forward packets. The packet forwarding devices exchange route information according to routing protocols such as Border Gateway Protocol (BGP) and Open Shortest Path First (OSPF), and create routing tables to determine the forwarding destination of received packets. Patent Document 1 discloses a configuration for collecting route information advertised by BGP. Patent Document 2 discloses a configuration for detecting network anomalies by monitoring OSPF packets. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-245662 [Patent Document 2] Japanese Patent Application Laid-Open No. 2010-109729 Summary of the Invention [Problem to be solved by the invention]

[0004] In order to detect abnormalities in a communication network consisting of multiple packet forwarding devices at an early stage, it is necessary to acquire various information from each of the multiple packet forwarding devices.Furthermore, if a network monitoring device accesses each packet forwarding device to acquire information, it is not possible to detect abnormalities in the communication network at an early stage.

[0005] The present disclosure provides a packet forwarding device and a program for early detection of an abnormality in a communication network made up of a plurality of packet forwarding devices. [Means for solving the problem]

[0006] According to one aspect of the present disclosure, a packet forwarding device includes: Based on routing information exchanged with one or more other packet forwarding devices an acquisition means for acquiring at least one type of information among second information relating to updates of a routing table and third information relating to processing of packets transmitted and received between two other packet forwarding devices in order to exchange route information between the other two packet forwarding devices; and Detecting an abnormality in a communication network including the packet forwarding device and a processing means for transmitting the information acquired by the acquisition means to a monitoring device or for transmitting statistical information of the information acquired by the acquisition means to the monitoring device at predetermined intervals. [Effects of the Invention]

[0007] According to the present disclosure, it is possible to detect abnormalities in a communication network made up of a plurality of packet forwarding devices at an early stage. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram of a packet forwarding device according to an embodiment. [Figure 2] FIG. 10 is a diagram showing an example of monitoring information transmitted to a monitoring device. [Figure 3] FIG. 10 is a diagram showing an example of monitoring information transmitted to a monitoring device. [Figure 4] FIG. 10 is a diagram showing an example of monitoring information transmitted to a monitoring device. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention as claimed, and not all combinations of features described in the embodiments are necessarily essential to the invention. Two or more of the features described in the embodiments may be arbitrarily combined. Furthermore, the same reference numerals are used for the same or similar components, and redundant explanations will be omitted.

[0010] FIG. 1 is a configuration diagram of a packet forwarding device 1 according to this embodiment. A routing protocol control unit 10 exchanges route information with other packet forwarding devices 1 in accordance with a routing protocol. The type of routing protocol used by the routing protocol control unit 10 is not limited to one, and multiple types such as BGP, OSPF, IS-IS (Intermediate System to Intermediate System), and VRRP (Virtual Router Redundancy Protocol) can be used. A route information management unit 11 manages the route information acquired by the routing protocol control unit 10 and creates a routing table based on the route information. A forwarding unit 12 forwards packets in accordance with the routing table.

[0011] The acquisition unit 13 acquires monitoring information of the monitoring target from the routing control unit 10, the route information management unit 11, and the forwarding unit 12, and outputs it to the processing unit 100. The monitoring information can be classified into first type monitoring information and second type monitoring information. The transmission unit 15 of the processing unit 100 transmits the first type monitoring information input from the acquisition unit 13 as is to a monitoring device (not shown). The monitoring device is a device that collects various types of monitoring information from multiple packet forwarding devices 1 and performs processing to determine whether or not there is an abnormality in the communication network made up of multiple packet forwarding devices 1.

[0012] Meanwhile, the second type of monitoring information input from the acquisition unit 13 is input to the aggregation unit 14 in the processing unit 100. The aggregation unit 14 obtains statistical information on the second type of monitoring information in units of a predetermined period. The transmission unit 15 repeatedly transmits the statistical information for each predetermined period to the monitoring device at a predetermined timing. For example, if the predetermined period is one second, the aggregation unit 14 obtains statistical information for one second, and the transmission unit 15 transmits the statistical information to the monitoring device every second.

[0013] 2 shows an example of monitoring information (first information) that the acquisition unit 13 acquires from the routing protocol control unit 10. As shown in FIG. 2, all of the monitoring information that the acquisition unit 13 acquires from the routing protocol control unit 10 is of the second type. "TCP connection" is information indicating that a TCP connection for exchanging route information has been established. "TCP retransmission" is information indicating that a TCP packet has been retransmitted in an established TCP connection. "TCP drop" is information indicating that a TCP packet has been discarded in an established TCP connection. "TCP round trip delay" is information indicating the round trip delay of an established TCP connection. "TCP window size" is information indicating the window size of an established TCP connection.

[0014] The aggregation unit 14 obtains the cumulative values ​​for "TCP connection," "TCP retransmission," and "TCP drop" per second, i.e., the number of times an event occurs, as statistical information. That is, the aggregation unit 14 obtains, as statistical information, information indicating the number of TCP connections established per second in the packet forwarding device 1, information indicating the number of retransmissions of TCP packets that occurred per second in the packet forwarding device 1, and information indicating the number of TCP packets discarded per second in the packet forwarding device 1. The transmission device 15 transmits this information to the monitoring device. Note that, for example, the information indicating the number of retransmissions of TCP packets that occurred per second and the information indicating the number of TCP packets discarded per second may be cumulative values ​​across one or more TCP connections established in the packet forwarding device 1, rather than a specific TCP connection.

[0015] Furthermore, the aggregation unit 14 obtains the average values ​​of "TCP round trip delay" and "TCP window size" over one second as statistical information. That is, the aggregation unit 14 transmits the average value of the round trip delay and the average value of the window size of the TCP connection that the acquisition unit 13 acquires from the routing protocol control unit 10 over one second as statistical information to the monitoring device. Note that the acquisition unit 13 acquires the "TCP round trip delay" and the "TCP window size" from the routing protocol control unit 10 multiple times over one second. Furthermore, the average values ​​of the "TCP round trip delay" and the "TCP window size" may be average values ​​across one or more TCP connections established in the packet forwarding device 1, rather than average values ​​for a specific TCP connection.

[0016] When congestion or anomalies occur in the network, the quality of the TCP connections used to exchange routing information also deteriorates. This deterioration increases the number of TCP packet retransmissions and discards, increases the average TCP round-trip delay, and decreases the average TCP window size. Furthermore, if the TCP connections used to exchange routing information deteriorate, routing information cannot be exchanged correctly, leading to further anomalies in the communication network. Therefore, by transmitting the information shown in Figure 2 to a monitoring device, the monitoring device can detect anomalies in the communication network at an early stage.

[0017] 2 may be managed in the kernel space of an operating system (OS). In such cases, any technology for acquiring information managed in the kernel space of an OS, such as the eBPF (Extended Berkeley Packet Filter) technology in Linux (registered trademark), may be used.

[0018] FIG. 3 shows an example of monitoring information (second information) that the acquisition unit 13 acquires from the route information management unit 11. As shown in FIG. 3, all of the monitoring information that the acquisition unit 13 acquires from the route information management unit 11 is of the first type. "Entry addition" is information indicating that a new entry has been added to the routing table, and "entry deletion" is information indicating that an entry has been deleted from the routing table. These pieces of information further include information indicating the contents of the added or deleted entry. For example, the information indicating the contents of the entry is information indicating a prefix or a next-hop.

[0019] When a failure occurs in a communication network, the routing table is also frequently changed. Therefore, by sending the information shown in Figure 3 to the monitoring device each time a failure occurs, the monitoring device can detect an abnormality in the communication network at an early stage.

[0020] FIG. 4 shows an example of monitoring information (third information) acquired by the acquisition unit 13 from the forwarding unit 12. As shown in FIG. 2, all of the monitoring information acquired by the acquisition unit 13 from the forwarding unit 12 is of the second type. In this embodiment, the monitoring target of the forwarding unit 12 is discarding events by the forwarding unit 12 of IP packets transmitted and received for the exchange of route information between two other packet forwarding devices 1. In other words, the monitoring target is discarding events of IP packets in which a value corresponding to each routing protocol is set in the protocol field of the header. "BGP discarded," "OSPF discarded," "IS-IS discarded," and "VRRP discarded" are information indicating that packets of BGP, OSPF, IS-IS, and VRRP have been discarded, respectively. The aggregation unit 14 obtains, for example, the number of packets discarded per second for each routing protocol as statistical information.

[0021] 2, by notifying the monitoring device of the discard status of packets related to the routing protocol, the monitoring device can detect abnormalities in the communication network at an early stage. Note that, although in this embodiment, the number of packets discarded in a predetermined period is tallied for each routing protocol, it is also possible to configure the total number of discarded packets to be used as statistical information regardless of the routing protocol.

[0022] In addition, the packet forwarding device 1 transmits the information shown in Figures 2 to 4 to the monitoring device autonomously, that is, without waiting for read access by the monitoring device, so that the monitoring device can detect abnormalities in the communication network early.

[0023] The monitoring information transmitted to the monitoring device is not limited to that shown in FIGS. 2 to 4. The packet forwarding device 1 can be configured so that the user can specify the monitoring information to be transmitted to the monitoring device. The information shown in FIGS. 2 and 4 can also be configured to be changed to a first type by user setting. For example, when "TCP retransmission" in FIG. 2 is changed to the first type, the processing unit 100 can be configured to immediately notify the monitoring device of a TCP packet retransmission event when it occurs. Alternatively, when "TCP retransmission" is changed to the first type, the processing unit 100 can be configured to immediately notify the monitoring device of a TCP packet retransmission event when it occurs, and also to obtain statistical information related to TCP packet retransmission and notify the monitoring device of the event.

[0024] According to the present disclosure, there is provided a computer program including program instructions that, when executed by one or more processors in a device having the one or more processors, causes the device to function as the packet forwarding device 1. The computer program can be stored in a computer-readable storage medium or distributed via a network.

[0025] The invention is not limited to the above-described embodiment, and various modifications and variations are possible within the scope of the gist of the invention.

[0026] This configuration enables early detection of anomalies in communication networks consisting of multiple packet forwarding devices, thereby contributing to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization, and foster innovation." [Explanation of symbols]

[0027] 13: Acquisition unit, 100: Processing unit

Claims

1. A packet forwarding device, an acquisition means for acquiring at least one type of information among second information relating to updating of a routing table based on route information exchanged with one or more other packet forwarding devices, and third information relating to processing of packets transmitted and received between the other two packet forwarding devices in order to exchange route information between the other two packet forwarding devices; a processing means for transmitting, when the acquiring means acquires the information, the information to a monitoring device that detects an abnormality in a communication network including the packet forwarding device, or for transmitting statistical information of the information acquired by the acquiring means to the monitoring device at predetermined intervals; A packet forwarding device comprising:

2. A packet forwarding device as described in Claim 1, wherein the acquisition means further acquires first information regarding one or more connections used to exchange the route information with the one or more other packet forwarding devices.

3. 3. The packet forwarding device according to claim 2, wherein said processing means transmits statistical information of said first information acquired by said acquisition means to said monitoring device.

4. 4. The packet forwarding device of claim 3, wherein the first information includes at least one of information indicating that establishment of the one or more connections has occurred, information indicating that retransmission of a packet has occurred in the one or more connections, information indicating that packet discarding has occurred in the one or more connections, information indicating a window size of the one or more connections, and information indicating a round-trip delay of the one or more connections.

5. 5. The packet forwarding device of claim 4, wherein the statistical information of the first information includes at least one of information indicating the number of times the one or more connections were established during the specified period, information indicating the number of times packets were retransmitted in the one or more connections, information indicating the number of packets discarded in the one or more connections, information indicating the average window size of the one or more connections, and information indicating the average round-trip delay of the one or more connections.

6. 2. The packet forwarding device according to claim 1, wherein said processing means transmits said second information obtained by said obtaining means to said monitoring device.

7. 7. The packet forwarding device according to claim 6, wherein the second information includes information indicating that an entry has been added to the routing table, or information indicating that an entry has been deleted from the routing table.

8. 8. The packet forwarding device according to claim 7, wherein the second information includes information indicating the content of the added or deleted entry.

9. 2. The packet forwarding device according to claim 1, wherein said processing means transmits statistical information of said third information acquired by said acquisition means to said monitoring device.

10. 10. The packet forwarding device according to claim 9, wherein said third information includes information indicating that said packet transmitted and received between said other two packet forwarding devices has been discarded.

11. 11. The packet forwarding device according to claim 10, wherein the statistical information of the third information includes information indicating the number of times the packets transmitted and received between the other two packet forwarding devices during the predetermined period were discarded.

12. the third information includes information about a routing protocol used to exchange the route information between the other two packet forwarding devices; 12. The packet forwarding device according to claim 11, wherein the statistical information of the third information indicates the number of times the packet has been discarded for each of the routing protocols.

13. A program that, when executed by one or more processors of an apparatus having one or more processors, causes the apparatus to function as the packet forwarding apparatus according to any one of claims 1 to 12.

Images