Traffic monitoring device and traffic monitoring method
Patent Information
- Application Number
- JP2025527230
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Filing Date
- 2023-06-19
- Publication Date
- 2024-12-26
AI Technical Summary
Conventional traffic monitoring devices face challenges in accurately measuring latency across large networks due to internal clock synchronization issues and clock correction timing discrepancies, leading to errors in latency calculation.
A traffic monitoring device and method that utilize multiple probes with internal clocks and timers, measuring packet reception times at predetermined cycles, synchronizing clocks based on a common time source, and correcting internal clock deviations to ensure accurate latency calculation by recording and transmitting timestamp, identification information, and correction flags to a controller for data analysis.
This approach enables accurate latency measurement across large networks by minimizing clock synchronization errors and maintaining consistency between probes, even when clock corrections occur at different times, thus providing reliable traffic monitoring data.
Abstract
Description
Traffic monitoring device and traffic monitoring method
[0001] The present invention relates to a traffic monitoring technique for monitoring traffic in a network.
[0002] Traffic monitoring devices capable of visualizing traffic for each packet flow have been disclosed (see, for example, Non-Patent Documents 1 and 2). Fig. 8 shows an example of the configuration of a conventional traffic monitoring device.
[0003] 8, a monitoring point (probe point) of a monitored network is tapped to receive copied or mirrored packets flowing through the monitored network. A header analysis unit extracts header information, and a flow identification unit has a table (rule table) that defines rules corresponding to each flow, and identifies the monitored flow by comparing the header information with the table.
[0004] The statistical information collection unit calculates the communication volume, such as the number of packets and bytes, for each flow based on the identification results from the flow identification unit. The statistical information obtained by the statistical information collection unit is periodically collected and reset by the processor unit (statistical information collection interval). The processor unit visualizes past and current collection results together.
[0005] In addition to the ability to visualize statistical information, conventional traffic monitoring devices also have the ability to measure jitter and latency by analyzing the sequence numbers in RTP (Real-time Transport Protocol) packets used to transport audio and video in real time.Latency can be measured by combining traffic mirrored at two monitoring points and inputting it into a single traffic monitoring device.
[0006] In conventional devices, mirrored packets are collected at two monitoring points (probe points) and latency is measured in a single traffic monitoring device, so a monitoring point (probe point) needs to be installed at the concentrating point of the monitored network. Therefore, when monitoring a large integrated network consisting of multiple subnetworks, it is not realistic to collect mirrored packets at the monitoring points (probe points) of multiple subnetworks with a single traffic monitoring device.
[0007] Ikeda et al., "Hardware Accelerator-Enabled Virtualization-Compatible Traffic Monitoring System (1) - System Architecture for Traffic Visualization," Institute of Electronics, Information and Communication Engineers General Conference, March 2020. Daiki et al., "Hardware Accelerator-Enabled Virtualization-Compatible Traffic Monitoring System (3) - Real-time Monitoring of RTP Packet Jitter and Latency," Institute of Electronics, Information and Communication Engineers General Conference, March 2020.
[0008] To measure the latency of packets transmitted between two points on a transmission path, one method is to record a timestamp for each packet when it passes through a probe at each point, collect the recorded timestamps in a controller at one location, and calculate the difference in timestamps when the same packet passes through.When measuring latency by combining timestamps recorded by multiple probes, it is necessary to synchronize the internal clocks of all probes.
[0009] However, even if the start time of time synchronization is set to the same for all probes, the timing at which the correction is actually reflected in the internal clock varies slightly for each probe. Also, if the timestamp when the same packet passes through one probe is stamped before the internal clock is corrected, and another probe stamps the timestamp after the internal clock is corrected, the correct latency cannot be calculated by taking the difference between the timestamp that reflects the time correction and the timestamp that does not.
[0010] Here, it is possible to reduce the error in the timestamps before and after the internal clock is corrected by synchronizing the internal clock at short intervals and correcting it while the internal clock error is still small, thereby reducing the amount of correction made during each time synchronization.However, when a large internal clock correction in seconds occurs, such as a leap second correction, the deviation from the correct latency may become a problem.
[0011] Therefore, in order to measure accurate latency, if an internal clock correction occurs during latency measurement and the time synchronization results are reflected in the internal clock at a slightly different timing for each probe, the latency error caused by the difference in the timing of the internal clock correction must be corrected.
[0012] The present invention has been made to solve the above-mentioned problems, and aims to provide a traffic monitoring device that can accurately measure latency even when the scale of the network being monitored for traffic is large.
[0013] In order to solve the above problem, a traffic monitoring device of the present invention comprises a plurality of probes and a controller installed on a transmission path, and the controller calculates latency based on differences in packet reception times measured by the plurality of probes, and each of the plurality of probes comprises an internal clock and a timer, and is configured to measure the packet reception time at a predetermined measurement period that is set longer than the expected latency, and to correct the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, and when the internal clock indicates the start time of the measurement period, reset the timer value of the timer to 0, record the value of the internal clock at the time the timer is reset as a timestamp, and record the timer value of the timer when a packet is received in association with identification information of the packet, and when the internal clock indicates the start time of the time synchronization, correct the internal clock based on the time source, and record the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, and the timestamp, the identification information, the timer value, the correction amount, and the correction flag are transmitted to the controller as measurement data for measuring the latency, and the controller holds the measurement data of a first measurement period received from the probe and the correction flag of the measurement data of a second measurement period immediately preceding the first measurement period, and if, in the measurement data of two probes for which the latency is to be measured, only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data of the first measurement period as the packet reception time of the packet, and if, in the measurement data of two probes for which the latency is to be measured, only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data of the first measurement period as the packet reception time of the packet, and if, in the measurement data of the two probes for which the correction flag is set, the controllerThe latency is calculated by calculating the difference between the packet reception times when the identification information matches.
[0014] In order to solve the above problem, a traffic monitoring method of the present invention is a traffic monitoring method executed by a traffic monitoring device comprising a plurality of probes and a controller installed on a transmission path, the controller calculating latency based on a difference between packet reception times measured by the plurality of probes, wherein each of the plurality of probes is equipped with an internal clock and a timer, measures the packet reception time at a predetermined measurement period that is set longer than the expected latency, corrects the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, resets the timer value of the timer to 0 when the internal clock indicates the start time of the measurement period, records the value of the internal clock at the time the timer is reset as a timestamp, records the timer value of the timer when a packet is received in association with identification information of the packet, corrects the internal clock based on the time source when the internal clock indicates the start time of the time synchronization, and records the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, the timestamp, the identification information, the timer value, the correction amount, and the correction flag in the measurement period of the first measurement period received from the probe, and the correction flag in the measurement data in the second measurement period immediately preceding the first measurement period; and if, in the measurement data of the two probes whose latency is to be measured, only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time when the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet; and if, in the measurement data of the two probes whose latency is to be measured, only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time when the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet; and if, in the measurement data of the two probes whose latency is to be measured, only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the value when the correction amount according to the correction flag is added to the time when the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet;The latency is calculated by calculating the difference between the packet reception times when the identification information matches.
[0015] According to the present invention, it is possible to provide a traffic monitoring device that can accurately measure latency even when the scale of the network to be monitored for traffic is large.
[0016] FIG. 1 is a diagram showing an example of the configuration of a traffic monitoring device according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of the configuration of a probe of a traffic monitoring device according to an embodiment of the present invention. FIG. 3 is a diagram showing an example of the configuration of a controller of a traffic monitoring device according to an embodiment of the present invention. FIG. 4 is an operation timing chart of a probe according to an embodiment of the present invention. FIG. 5 is an operation flowchart of a probe according to an embodiment of the present invention. FIG. 6A is an example of the configuration of measurement data of a probe according to an embodiment of the present invention. FIG. 6B is an example of the configuration of measurement data of a probe according to a first embodiment of the present invention. FIG. 7 is an operation flowchart of a controller according to an embodiment of the present invention. FIG. 8 is a diagram showing the configuration of a conventional packet capture device.
[0017] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the following embodiments.
[0018] First Embodiment A first embodiment of the present invention will be described below, but the present invention is not limited to the embodiment described below.
[0019] <Configuration of Traffic Monitoring Device> Figure 1 is a diagram showing an example of the configuration of a traffic monitoring device according to an embodiment of the present invention. The traffic monitoring device 1 includes N (N≧1) probes (20-1 to 20-N) installed on a transmission path to monitor multiple sub-networks (50-1 to 50-N) that make up an integrated network 50 to be monitored, and a controller 10 that collects measurement data output from each probe (20-1 to 20-N) and measures packet latency. Each probe (20-1 to 20-N) and the controller 10 periodically synchronize their time using time information from a common time source 30, such as a time synchronization server.
[0020] The probes (20-1 to 20-N) are configured to measure the packet reception time of packets at a predetermined measurement period that is set longer than the expected latency, and to perform time synchronization by correcting the internal clock based on the time information of the time source at a predetermined time synchronization period that is set longer than the measurement period of the packet reception time.
[0021] The controller 10 calculates latency based on the difference between packet reception times measured by a plurality of probes (20-1 to 20-N). The measurement data measured by each probe (20-1 to 20-N) includes the correction amount of the internal clock of each probe (20-1 to 20-N), and the controller 10 is configured to use this information on the correction amount of the internal clock to correct latency errors caused by differences in the timing of correction of the internal clock.
[0022] 2 is a diagram showing an example of the configuration of a probe of a traffic monitoring device according to an embodiment of the present invention. The probe (20-1) comprises a header analysis unit 21, a flow identification unit 22, a latency data measurement unit 23 that measures data for calculating latency, an internal clock 25, a timer 26, and a time management unit 24.
[0023] The header analysis unit 21 identifies the IP address, sequence number, etc. contained in the packet header so that the flow identification unit 22 can identify the packet and flow, and also assigns to the received packet the timer value of the timer 26 at the time the packet was received, and outputs the packet's identification information, such as the sequence number, to the flow identification unit 22.
[0024] The flow identification unit 22 identifies a flow for which latency is to be measured based on the settings in the rule table, which contains settings for the flow for which latency is to be measured.
[0025] The latency data measurement unit 23 holds the identification information and timer value information of packets of the latency measurement target flow identified by the flow identification unit 22, and transmits them to the controller 10 at predetermined measurement intervals. The timer value of the timer 26 when a packet is received is recorded in association with the packet identification information for each flow, and transmitted to the controller 10.
[0026] When the internal clock 25 indicates the start time of a predetermined measurement cycle, the time management unit 24 resets the timer value of the timer 26 to 0 and records the value of the internal clock 25 at the time the timer is reset as a timestamp. Furthermore, when the internal clock 25 indicates the start time of time synchronization, the time management unit 24 corrects the internal clock 25 based on the time information of the time source 30 and records the correction amount of the internal clock 25 and a correction flag indicating that the internal clock 25 has been corrected.
[0027] The interface (IF) conversion unit 27 is an IF for connecting the probe and the controller. Measurement data for measuring latency is output to the controller through the IF conversion unit. When the timer is reset and measurement in the next measurement period begins, the probe transmits to the controller 10 as measurement data the timestamp, identification information, timer value, internal clock correction amount, and correction flag for the measurement period immediately before the measurement period in which measurement ended.
[0028] The probes (20-1 to 20-N) in this embodiment can be implemented in various forms. For example, they may be realized by hardware on a computer board, or the functions of the probes (20-1 to 20-N) may be realized by software running on a computer.
[0029] The computers that operate as the probes (20-1 to 20-N) can be realized by a computer equipped with a CPU (Central Processing Unit), a storage device, and an external interface, and a program that controls these hardware resources.
[0030] 3 is a diagram showing an example of the configuration of the controller of the traffic monitoring device according to the first embodiment of the present invention. The controller 10 comprises a processor unit 11, a latency calculation unit 12, and an interface conversion unit 13.
[0031] The controller 10 calculates the latency based on the measurement data transmitted from the multiple probes (20-1 to 20-N), determines whether to correct the latency error based on the correction flag of the internal clock in the transmitted data, and corrects the latency error, if necessary, using information on the correction amount of the internal clock.
[0032] The interface conversion unit 13 receives measurement data including a time stamp, identification information, timer value, correction amount of the internal clock, and correction flag from each probe (20-1 to 20-N).
[0033] The processor unit 11 collects and visualizes statistical information on traffic in the monitored network using information on communication volume such as the number of packets and bytes per flow and information on communication quality such as packet jitter and latency. The statistical information on traffic is collected periodically, and visualization and analysis are performed by combining past collection results with the current collection results.
[0034] The latency calculation unit 12 calculates the latency by calculating the difference in packet reception time of packets having specified identification information using the timestamp, identification information, and timer value information received from the probes (20-1 to 20-N), and also corrects latency errors caused by deviations in the timing of internal clock correction using information on the internal clock correction amount and correction flag.
[0035] In this embodiment, the packet reception time is calculated by adding the timer value at the time the packet is received to the timestamp value indicating the time information of the internal clock when the timer value is reset, and the latency is calculated using the difference in the packet reception times.
[0036] By recording the time of packet reception using a timer value that is reset at a predetermined interval rather than the value indicated by the internal clock, the timing at which time synchronization of the internal clock occurs can be determined in units of the timer reset interval, making it easier to manage the timing of time synchronization compared to managing it on a packet-by-packet basis.
[0037] In this embodiment, whether or not to correct the latency error caused by the correction of the internal clock is determined depending on whether or not the correction flag is included in the measurement data.
[0038] The latency calculation unit 12 determines whether to correct the latency error caused by the correction of the internal clock based on the correction flags of the measurement data in the most recent measurement period (first measurement period) for the two probes that are the targets of latency monitoring and the correction flags of the measurement data in the measurement period immediately before the most recent measurement period (second measurement period).
[0039] Specifically, if the correction flag is set (indicating "corrected") for only one of the first and second measurement periods, the time obtained by adding the timer value to the timestamp in the measurement data for the first measurement period of the probe for which the correction flag is set is calculated as the packet reception time of the packet. In this case, no correction is made for the error based on the correction amount of the internal clock.
[0040] For example, in the first and second measurement periods described above, if the correction flag for the most recent first measurement period in probe #1 on the upstream side of the transmission path indicates "corrected" and the correction flag for the immediately preceding second measurement period indicates "not corrected," and if the correction flags for the two measurement periods in probe #2 on the downstream side of the transmission path indicate "not corrected," then no correction of the error based on the correction amount of the internal clock is performed. Because the time synchronization timing of the two probes is set to the same time, even if there is a difference in the timing at which the time correction is reflected, it is considered to be within the range of two consecutive periods. Therefore, in the above example, it can be expected that the time correction will be reflected in probe #2 in the next measurement period. In such a case, if the error based on the correction amount of the internal clock is corrected in one probe (probe #1 in the above example), the other probe (probe #2 in the above example) has not yet been corrected, which may increase the latency error.
[0041] On the other hand, in cases other than those mentioned above, i.e., when there is not only one of the probes with the correction flag set (indicating "corrected") in the first measurement period or the second measurement period, the packet reception time of the packet is calculated as the time obtained by adding the timer value to the timestamp in the measurement data of the first measurement period of the probe with the correction flag set, plus the amount of correction according to the correction flag of the first measurement period.
[0042] For example, in the first and second measurement periods described above, if the correction flag for the most recent first measurement period at probe #1 on the upstream side of the transmission path indicates "corrected" and the correction flag for the immediately preceding second measurement period indicates "not corrected," and similarly for probe #2 on the downstream side of the transmission path, the correction flag for the most recent first measurement period indicates "corrected" and the correction flag for the immediately preceding second measurement period indicates "not corrected," then an error correction is performed based on the correction amount of the internal clock.
[0043] In such a case, in order to reflect the correction of the internal clock in the measurement data in one measurement period and calculate the latency accurately, in the most recent first measurement period of both the upstream probe #1 and the downstream probe #2 on the transmission path, the correction amount of the internal clock is reflected in the packet reception time according to the correction flag "corrected" for the first measurement period.
[0044] Furthermore, in the first and second measurement periods, if the correction flag for the most recent first measurement period at probe #1 on the upstream side of the transmission path indicates "corrected" and the correction flag for the immediately preceding second measurement period indicates "not corrected," and if the correction flag for the most recent first measurement period at probe #2 on the downstream side of the transmission path indicates "not corrected" and the correction flag for the immediately preceding second measurement period indicates "corrected," then an error correction is performed based on the correction amount of the internal clock.
[0045] In such a case, in order to reflect the correction of the internal clock in the measurement data in one measurement period and calculate the latency accurately, in the first measurement period immediately preceding the first measurement period of the upstream probe #1, the correction amount of the internal clock is reflected in the packet reception time according to the correction flag of the first measurement period being "corrected." Note that in probe #2, the timestamp of the first measurement period is based on the internal clock that was corrected in the previous second measurement period, so the correction amount is not reflected according to the correction flag of the first measurement period being "not corrected."
[0046] In this embodiment, the packet reception time is calculated by adding the timer value when the packet is received to the timestamp value indicating the time information of the internal clock when the timer value is reset, and the packet reception time is corrected by adding the correction amount of the internal clock to the timestamp value.Therefore, even if the timer reset timing and time synchronization timing in each probe do not match perfectly, it is possible to calculate a packet reception time that is consistent between probes.
[0047] In addition, the internal clock correction flags for the most recent measurement period and the previous measurement period are used to determine whether to reflect the correction amount of the internal clock, and the correction amount of the internal clock is reflected based on the result of that determination.Therefore, even if the time synchronization timing of the two probes is out of sync and spans two measurement periods, it is possible to avoid taking a difference between the reception time in which time synchronization is reflected and the reception time in which time synchronization is not reflected.
[0048] 4 is an operation timing chart of a probe according to an embodiment of the present invention, showing an example of a timing chart of the measurement period and time synchronization of the internal clocks of probe #1 on the upstream side of the transmission path and probe #2 on the downstream side.
[0049] As shown in Figure 4, even if the measurement period start time and measurement period are set to the same for all probes, the timing at which the timer value is actually reset and the actual measurement period will differ slightly for each probe. The same is true for time synchronization; even if the time synchronization start time is set to the same, the timing at which the time correction is actually reflected in the internal clock will differ slightly for each probe.
[0050] In Figure 4, the packets for which latency is measured are RTP packets of a specific flow, and the packet identification information is the sequence number (SN) included in the header of the RTP packet. Tmr1_0 to Tmr1_6 are the timer values when packets with sequence numbers (SN = 1 to SN = 6) received by probe #1 are received. The sequence numbers SN and timer values are recorded in association with each other. The same is true for probe #2. Furthermore, T1_0 to T1_6 are the values of the internal clock when the packets are received.
[0051] In this embodiment, a case will be described in which a sequence number (SN) included in the packet header is used as identification information for identifying a packet, but a value in a specific field in the packet header may also be used as long as it can identify the packet. Furthermore, a packet may also be identified using a value obtained by converting at least part of the information in the packet using a conversion formula common to multiple probes, for example, a hash value of part of the information in the packet header or payload.
[0052] 4, in probe #1, the timer is reset at a predetermined measurement period, and the value T1_rst_i of the internal clock at the time the timer is reset at each measurement period is recorded as a timestamp. The internal clock is corrected based on the time information of the time source at a predetermined time synchronization period. The correction amount of the internal clock in the i-th week measurement period is represented by ΔT1_i, and the correction flag indicating that the internal clock has been corrected in the i-th week measurement period is set to "1", indicating "corrected". The same is true for probe #2.
[0053] The measurement period, which indicates the timing at which the timer is reset, is set longer than the expected latency. The time synchronization period, which corrects the internal clock, is also set longer than the measurement period. For example, if the measurement period is 10 seconds for a latency of several tens of milliseconds, the time synchronization period is set to, but is not limited to, 3600 seconds.
[0054] In Figure 4, in probe #1 on the upstream side of the transmission path, the correction flag for the most recent measurement period indicates "corrected," and similarly in probe #2 on the downstream side of the transmission path, the correction flag for the most recent measurement period indicates "corrected." Therefore, in both probe #1 and probe #2, the latency error is corrected based on the correction amount of the internal clock.
[0055] In Figure 4, for packets with sequence numbers = 1 and 2, the timestamp when received by probe #1 is the [before correction] of the internal clock, and the timestamp when received by probe #2 is the [after correction] of the internal clock, so if the latency is calculated using the reception times (T1_1, T1_2, T2_1, T2_2) stamped by the internal clock, the latency error caused by the timing deviation of the time synchronization will be large.
[0056] In this embodiment, the packet reception time is calculated by adding the timer value at the time the packet is received to the timestamp value, and the packet reception time is corrected by adding the correction amount of the internal clock to the timestamp value.Therefore, even if the timer reset timing and time synchronization timing in each probe do not match perfectly, it is possible to calculate a packet reception time that is consistent between the probes and produce the correct latency.
[0057] <Probe Operation> Fig. 5 is a flowchart showing the operation of a probe according to an embodiment of the present invention. When the probe receives a packet for which latency is to be measured, it records the packet identification information in association with the timer value at the time of receiving the packet (S1-1, S1-2).
[0058] When the internal clock indicates the start time of time synchronization, the probe corrects the internal clock based on the time source, and after the correction is reflected in the internal clock, records the amount of correction of the internal clock and a correction flag indicating that the internal clock has been corrected (S1-3 to S1-6).
[0059] When the internal clock indicates the start time of the measurement period, the probe resets the timer value of the timer to 0, and after the reset is reflected in the timer, the probe records the value of the internal clock at the time the timer was reset as a timestamp (S1-7 to S1-10).
[0060] When the timer is reset and measurement in the next measurement period begins, the probe transmits the measurement data from the measurement period immediately before the measurement period in which measurement ended, i.e., the timestamp at the time the timer was reset, the packet identification information and the timer value at the time the packet was received, the correction amount of the internal clock, and the correction flag, to the controller (S1-11).
[0061] <Configuration example of measurement data> Figures 6A and 6B show configuration examples of measurement data of probes according to an embodiment of the present invention. Figure 6A shows measurement data in the ith measurement cycle of probe #1 in Figure 4. Figure 6B shows measurement data in the ith measurement cycle of probe #2 in Figure 4.
[0062] 4, the internal clocks are corrected in the ith measurement cycle of probe #1 and probe #2, so the correction flag indicating whether the internal clock has been corrected is set to "1" indicating "corrected." The packet sequence number, which is the packet identification information, and the timer value at the time the packet was received are recorded in association with each other.
[0063] 7 is a flowchart showing the operation of the controller according to the embodiment of the present invention. When the controller receives measurement data from the probe, it stores the measurement data received one cycle before and the most recently received measurement data (S2-1 to S2-3).
[0064] The controller reads the measurement data of the two probes for which latency is to be measured from the stored measurement data. If, among the measurement data of the two probes for which latency is to be measured, only one of the probes has a correction flag set (indicating "corrected") in the most recent measurement period or the measurement period immediately before (S2-5: Yes), the controller calculates the time obtained by adding the timer value to the timestamp in the measurement data of the most recent measurement period as the packet reception time (S2-4 to S2-6).
[0065] If the correction flag is set (indicating "corrected") for either the most recent measurement period or the previous measurement period for more than one probe (S2-5: No), the time obtained by adding the timer value to the timestamp in the measurement data for the most recent measurement period, plus the correction amount according to the correction flag, is calculated as the packet reception time of the packet (S2-5, S2-7).
[0066] The controller searches the measurement data of the two probes for packets with matching packet identification information, calculates the difference between the reception time of the packet from the probe downstream of the packet with matching identification information and the reception time of the packet from the probe upstream of the packet, and calculates the latency of the packet.The controller then repeats the search for packet identification information and the calculation of latency for all combinations with matching identification information (S2-8 to S2-10).
[0067] In this embodiment, the packet reception time is calculated by adding the timer value when the packet is received to the timestamp value that indicates the time information of the internal clock when the timer value is reset. By recording the packet reception time using a timer value that is reset at a predetermined interval rather than a value indicated by the internal clock, the timing when time synchronization of the internal clock occurs can be determined in units of timer reset intervals, making it easier to manage the timing of time synchronization compared to managing it on a packet-by-packet basis.
[0068] Furthermore, in this embodiment, the packet reception time is calculated by adding the timer value at the time the packet is received to the timestamp value indicating the time information of the internal clock when the timer value is reset, and the packet reception time is corrected by adding the correction amount of the internal clock to the timestamp value.Therefore, even if the timer reset timing and time synchronization timing in each probe do not match perfectly, it is possible to calculate a packet reception time that is consistent between probes.
[0069] In addition, the correction flags of the internal clock in the most recent measurement period and the measurement period immediately before are used to determine whether to reflect the correction amount of the internal clock, and the correction amount of the internal clock is reflected based on the result of that determination.Therefore, even if the time synchronization timing in the two probes is different and spans two measurement periods, it is possible to avoid taking the difference between the reception time when time synchronization is reflected and the reception time when time synchronization is not reflected, and to perform accurate latency measurement.
[0070] <Second embodiment> If the internal clock is significantly out of sync when it is corrected, the latency already calculated in the measurement period before the measurement period in which the time was corrected may be corrected. For example, if the time synchronization period is 3600 seconds and the measurement period is 10 seconds, measurements are taken (time synchronization period) / (measurement period) = 360 times between two time synchronizations. In this case, it is possible that the internal clocks of the two probes are out of sync between the two time synchronizations.
[0071] In this embodiment, the measurement data from the most recent measurement period and the measurement data from the previous measurement period are stored, and when the correction flags for the first or second measurement period in both of the two probes indicate "corrected," the correction amount per measurement period can be estimated using the difference in the correction amounts of the internal clocks between the two probes, and the latency calculated in the past can be corrected according to the number of measurement periods that have elapsed since the previous time synchronization. Note that the timestamp, identification information, and timer value of the measurement data from the previous measurement period are not essential for this correction.
[0072] Specifically, the latency i cycles ago may be corrected by adding the following to the latency: [{(most recent internal clock correction amount of the downstream probe) x (most recent internal clock correction flag of the downstream probe) + (internal clock correction amount of the downstream probe one cycle ago) x (internal clock correction flag of the downstream probe one cycle ago)} - {(most recent internal clock correction amount of the upstream probe) x (most recent internal clock correction flag of the upstream probe) + (internal clock correction amount of the upstream probe one cycle ago) x (internal clock correction flag of the upstream probe one cycle ago)}] / {(time synchronization cycle) / (measurement cycle)} x {(time synchronization cycle) / (measurement cycle) - i}
[0073] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration of the present invention within the scope of the present invention.
[0074] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.
[0075] (Supplementary Note 1) A traffic monitoring device comprising a plurality of probes and a controller installed on a transmission path, the controller calculating latency based on a difference between packet reception times measured by the plurality of probes, wherein each of the plurality of probes comprises an internal clock and a timer, and is configured to measure the packet reception time at a predetermined measurement period that is set longer than the expected latency, and to correct the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, resetting the timer value of the timer to 0 when the internal clock indicates the start time of the measurement period and recording the value of the internal clock at the time the timer is reset as a timestamp, recording the timer value of the timer when a packet is received in association with identification information of the packet, correcting the internal clock based on the time source when the internal clock indicates the start time of the time synchronization, and recording the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, the timestamp, the identification information, the timer value, the correction amount, and the correction flag in the immediately preceding measurement period are transmitted to the controller as measurement data for measuring the latency, and the controller holds the measurement data in a first measurement period received from the probe and the correction flag of the measurement data in a second measurement period immediately preceding the first measurement period, and in the measurement data of two probes for which the latency is to be measured, if the correction flag is set in either the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet, and if the correction flag is not set in either the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet,a traffic monitoring device configured to calculate a difference between the reception times of the packets having the same identification information to obtain the latency.
[0076] (Supplementary Note 2) The traffic monitoring device according to Supplementary Note 1, wherein each of the plurality of probes stores the identification information and the timer value separately for each flow, and the controller calculates the latency for each flow.
[0077] (Supplementary Note 3) The traffic monitoring device according to Supplementary Note 1 or Supplementary Note 2, wherein the identification information is a value of a specific field in a header of the packet.
[0078] (Supplementary Note 4) The traffic monitoring device according to any one of Supplementary Notes 1 to 3, wherein the identification information is a value obtained by converting at least part of information of the packet using a conversion formula common to a plurality of the probes.
[0079] (Supplementary Note 5) The traffic monitoring device according to any one of Supplementary Notes 1 to 4, wherein the controller holds the correction amount and the correction flag of the measurement data in the second measurement period, and when the correction flag is set in the first measurement period or the second measurement period in both of the two probes, estimates the correction amount per measurement period using the difference in the correction amount between the two probes, and corrects the latency calculated in the past according to the number of measurement periods that have elapsed since the previous time synchronization.
[0080] (Supplementary Note 6) A traffic monitoring method is executed in a traffic monitoring device comprising a plurality of probes and a controller installed on a transmission path, the controller determining latency based on a difference between packet reception times measured at the plurality of probes, wherein each of the plurality of probes comprises an internal clock and a timer, measures the packet reception times at a predetermined measurement period that is set longer than the expected latency, and corrects the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, resets the timer value of the timer to 0 when the internal clock indicates the start time of the measurement period, and records the value of the internal clock at the time the timer is reset as a timestamp, records the timer value of the timer when a packet is received in association with identification information of the packet, and corrects the internal clock based on the time source when the internal clock indicates the start time of the time synchronization, and records the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, transmits the timestamp, the identification information, the timer value, the correction amount, and the correction flag in the immediately previous measurement period to the controller as measurement data for measuring the latency, the controller holds the measurement data in a first measurement period received from the probe and the correction flag of the measurement data in a second measurement period immediately preceding the first measurement period, and in the measurement data of the two probes for which the latency is to be measured, if the correction flag is set in either the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet, and if the correction flag is not set in either the first measurement period or the second measurement period, calculates the value at which the correction amount according to the correction flag is added to the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet,a traffic monitoring method for calculating the latency by calculating a difference between the reception times of the packets having the same identification information.
[0081] 1...traffic monitoring device, 10...controller, 20, 20-1, 20-2, 20-N...probes, 30...time source, 50...monitored integrated network.
Claims
1. A traffic monitoring device comprising a plurality of probes and a controller installed on a transmission path, the controller determining latency based on a difference between packet reception times measured by the plurality of probes, wherein each of the plurality of probes is equipped with an internal clock and a timer, and is configured to measure the packet reception time at a predetermined measurement period that is set longer than the expected latency, and to correct the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, resetting the timer value of the timer to 0 when the internal clock indicates the start time of the measurement period, and recording the value of the internal clock at the time the timer is reset as a timestamp, recording the timer value of the timer when a packet is received in association with identification information of the packet, correcting the internal clock based on the time source when the internal clock indicates the start time of the time synchronization, and recording the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, and transmitting the timestamp, the identification information, the timer value, the correction amount, and the correction flag in the previous measurement period to the controller as measurement data for measuring the latency, the controller holds the measurement data in a first measurement period received from the probe and the correction flag of the measurement data in a second measurement period immediately preceding the first measurement period, and in the measurement data of the two probes for which the latency is to be measured, if only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet, and if only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the packet reception time of the packet as the value at which the correction amount according to the correction flag is added to the time at which the timer value is added to the timestamp in the measurement data in the first measurement period,a traffic monitoring device configured to calculate a difference between the reception times of the packets having the same identification information to obtain the latency.
2. The traffic monitoring device according to claim 1, wherein each of the plurality of probes stores the identification information and the timer value separately for each flow, and the controller calculates the latency for each flow.
3. The traffic monitoring device according to claim 1, wherein the identification information is a value of a specific field in a header of the packet.
4. The traffic monitoring device according to claim 1, wherein the identification information is a value obtained by converting at least a portion of the information of the packet using a conversion formula common to a plurality of the probes.
5. The traffic monitoring device of claim 1, wherein the controller holds the correction amount and the correction flag of the measurement data in the second measurement period, and if the correction flag is set in the first measurement period or the second measurement period in both of the two probes, estimates the correction amount per measurement period using the difference in the correction amount between the two probes, and corrects the latency calculated in the past according to the number of measurement periods that have elapsed since the last time synchronization.
6. A traffic monitoring method executed in a traffic monitoring device comprising a plurality of probes and a controller installed on a transmission path, the controller determining latency based on a difference between packet reception times measured at the plurality of probes, wherein each of the plurality of probes comprises an internal clock and a timer, measures the packet reception times at a predetermined measurement period that is set longer than the expected latency, and corrects the internal clock based on time information of a time source at a predetermined time synchronization period that is set longer than the measurement period, resets the timer value of the timer to 0 when the internal clock indicates the start time of the measurement period, and records the value of the internal clock at the time the timer is reset as a timestamp, records the timer value of the timer when a packet is received in association with identification information of the packet, and corrects the internal clock based on the time source when the internal clock indicates the start time of the time synchronization, and records the correction amount of the internal clock and a correction flag indicating that the internal clock has been corrected, transmits the timestamp, the identification information, the timer value, the correction amount, and the correction flag in the previous measurement period to the controller as measurement data for measuring the latency, the controller holds the measurement data in a first measurement period received from the probe and the correction flag of the measurement data in a second measurement period immediately preceding the first measurement period, and in the measurement data of the two probes for which the latency is to be measured, if only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet, and if only one of the probes has the correction flag set in the first measurement period or the second measurement period, calculates the value at which the correction amount according to the correction flag is added to the time at which the timer value is added to the timestamp in the measurement data in the first measurement period as the packet reception time of the packet,A traffic monitoring method comprising: calculating a difference between reception times of the packets having the same identification information to obtain the latency.