Analysis device and analysis method

Abstract

Provided is an analysis device (10) wherein a collection unit (15a) collects flow information (14a) indicating the content of traffic that has passed through each edge router from a core router (C) which integrates the edge routers. An analysis unit (15b) analyzes a failure status by using the collected flow information (14a) and connection relationship information (14b) indicating the connection relationship between devices in a network.

Description

Analytical device and analytical method

[0001] The present invention relates to an analytical device and an analytical method.

[0002] Large-scale carrier networks operated by telecommunications operators are made up of numerous transfer and transmission devices, and when operating and monitoring carrier networks, it is necessary to quickly grasp the status of failures and recovery in each device that makes up the network, as well as the number of so-called affected users who have been affected by the failures.

[0003] Conventionally, operation and monitoring have been carried out using syslog, SNMP trap, etc., which issue messages indicating the occurrence of pre-specified abnormal events and the status of the device (see Non-Patent Documents 1 to 3).

[0004] “What is the difference between MIB and syslog?” [online], Nikkei XTECK, [Retrieved July 18, 2023], Internet<URL:https: / / xtech.nikkei.com / it / atcl / column / 17 / 011900625 / 011900009 / > “The Syslog Protocol”, [online], RFC5424, [Retrieved July 18, 2023], Internet<URL:https: / / datatracker.ietf.org / doc / html / rfc5424> "A Simple Network Management Protocol (SNMP)", [online], RFC1157, [Retrieved July 18, 2023], Internet<URL:https: / / datatracker.ietf.org / doc / html / rfc1157>

[0005] However, with conventional technology, it can be difficult to accurately grasp the status of a failure. For example, when an edge router, which has a large number of devices in a carrier network, experiences a high-load failure that causes multiple simultaneous restarts, it is difficult to obtain an alarm and grasp the impact of whether the system has recovered. Furthermore, apart from static information on the number of users accommodated by each device, it is difficult to accurately grasp the number of users who were actually unable to communicate or who were affected at the time of the failure.

[0006] The present invention has been made in view of the above, and has as its object to accurately grasp the state of a failure.

[0007] In order to solve the above-mentioned problems and achieve the objectives, the analysis device of the present invention is characterized by having a collection unit that collects flow information representing the content of traffic circulating through each edge router from a core router that aggregates edge routers, and an analysis unit that analyzes the failure situation using the collected flow information and information representing the connection relationships between devices within the network.

[0008] According to the present invention, it is possible to accurately grasp the state of a failure.

[0009] FIG. 1 is a diagram for explaining an overview of the analysis device of this embodiment. FIG. 2 is a schematic diagram illustrating the general configuration of the analysis device of this embodiment. FIG. 3 is a diagram for explaining the processing of the analysis unit. FIG. 4 is a diagram for explaining the processing of the analysis unit. FIG. 5 is a diagram for explaining the processing of the analysis unit. FIG. 6 is a diagram for explaining the processing of the analysis unit. FIG. 7 is a flowchart showing an analysis processing procedure. FIG. 8 is a diagram showing an example of a computer that executes an analysis program.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0011] [Outline of the Analysis Device] Fig. 1 is a diagram for explaining an outline of the analysis device of this embodiment. As shown in Fig. 1, a carrier network of a telecommunications carrier is composed of forwarding devices such as an edge router E and a core router C that forward IP packets, and transmission devices that connect geographically separated sections.

[0012] An end user's user premises transfer device is connected to the network via an edge router E. The edge router E is aggregated into a core router C, and the core router C is aggregated into a transmission device. In a transmission section, there may be multiple transmission devices between the transmission devices at both ends that have transponders. Furthermore, multiple optical paths with different wavelengths are accommodated between the transmission devices using wavelength division multiplexing, and multiple transfer devices are connected to the transmission device.

[0013] In such a carrier network, since a large number of edge routers E are installed, for example, if a high-load failure occurs in the edge routers E, such as when multiple edge routers E are repeatedly restarted simultaneously, there is a risk that it will be impossible to obtain alarm information and it will be impossible to distinguish between devices that have recovered and devices that have not. Also, there is no way to know which users were communicating using each transfer device when the failure occurred, making it difficult to accurately determine the number of users who are actually unable to communicate or who are impaired.

[0014] Therefore, the analysis device of this embodiment analyzes the failure situation using flow information 14a collected from a core router C that aggregates multiple edge routers E and connection relationship information 14b that represents the connection relationships between devices within the network.

[0015] Here, the flow information 14a is information that represents the contents of the traffic that has circulated through the edge router E. Specifically, the flow information 14a has undergone a format conversion process that enables packets inside the capsules of encapsulated packets to be extracted and analyzed, and is information that reveals the contents of the traffic that has circulated through the edge router E. For example, the flow information 14a includes the source IP address / destination IP address of the traffic, the source port number / destination port number, the input interface / output interface, the number of bytes of the flow information, the number of packets, etc.

[0016] In addition, the connection relationship information 14b includes information that can identify the edge router E on the traffic route, information that can identify the end user home transfer device or VPN group that is the source, information on the transponder to which the core router C is connected, information on a certain transponder and its opposing transponder, and information on the transmission devices that exist between the two, and information on the transponders accommodated in a certain transmission device.

[0017] The analysis device then analyzes the status of the failure, for example, by a flow information visualization process that aggregates and visualizes the amount of inflow traffic and outflow traffic for each edge router E. Alternatively, the analysis device performs an affected user count process that identifies end users or VPN groups affected by the failure, using flow information at the time of the failure collected by a core router C connected to the network device where the failure occurred. In this way, the analysis device makes it possible to accurately grasp the status of the failure.

[0018] [Configuration of the analysis device] Fig. 2 is a schematic diagram illustrating the general configuration of the analysis device of this embodiment. As illustrated in Fig. 2, the analysis device 10 of this embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0019] The input unit 11 is realized using input devices such as a keyboard and a mouse, and inputs various instruction information such as a command to start processing to the control unit 15 in response to input operations by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, etc. For example, the output unit 12 displays the results of the analysis processing described below.

[0020] The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between the control unit 15 and external devices via telecommunication lines such as a LAN (Local Area Network) or the Internet. For example, the communication control unit 13 controls communication between the control unit 15 and a core router C, other network devices, a management device that manages various types of information, and the like.

[0021] The storage unit 14 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores in advance the processing programs that operate the analysis device 10 and data used during execution of the processing programs, or temporarily stores them each time processing is performed. The storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13. In this embodiment, the storage unit 14 has flow information 14a and connection relationship information 14b.

[0022] The flow information 14a is flow information of traffic flowing through each edge router E, collected by a collector 15a (described later) from a core router C that aggregates edge routers E. Specifically, the flow information 14a is information collected from the core router C and processed (format conversion processing) to extract and analyze packets inside the capsules of encapsulated packets, and is information that reveals the contents of traffic flowing through edge routers E subordinate to the core router C. The flow information 14a includes, for example, the source IP address / destination IP address, source port number / destination port number, input interface / output interface, number of bytes of flow information, number of packets, etc. of the traffic.

[0023] The connection relationship information 14b is information that represents the connection relationships between devices in the network, and includes, for example, information that can identify the edge router E on the traffic route, information that can identify the end-user home transfer device or VPN group of the source, information on the transponder connected to the core router C, information on a certain transponder and its opposing transponder and information on the transmission devices existing between them, information on the transponders accommodated in a certain transmission device, etc. The connection relationship information 14b is collected in advance from, for example, a management device that manages various information such as the setting information of each network device, and is stored in the storage unit 14.

[0024] The control unit 15 is realized using a CPU (Central Processing Unit) or the like, and executes a processing program stored in memory. As a result, the control unit 15 functions as a collection unit 15a and an analysis unit 15b, as illustrated in FIG. 2, and executes analysis processing. Note that these functional units may be implemented in different hardware. The control unit 15 may also include other functional units.

[0025] The collector 15a collects flow information of traffic flowing through each edge router E from the core router C that aggregates the edge routers E. Specifically, the collector 15a periodically collects flow information from the core router C via the communication control unit 13. The collector 15a also performs a format conversion process on the collected flow information to extract packets inside capsules of encapsulated packets. As a result, the collector 15a extracts flow information that reveals the contents of traffic flowing through the edge routers E subordinate to the core router C, and stores the extracted flow information in the flow information 14a of the storage unit 14. The collector 15a may also directly transfer the extracted flow information to the analysis unit 15b described below without storing it in the storage unit 14.

[0026] The analysis unit 15b analyzes the status of the failure using the collected flow information 14a and connection relationship information 14b that indicates the connection relationships between devices in the network.

[0027] For example, the analysis unit 15 b performs a flow information visualization process. That is, the analysis unit 15 b aggregates the traffic volume of the collected flow information for each edge router E, and analyzes whether the edge router E has recovered from the failure as the failure status.

[0028] 3 to 6 are diagrams for explaining the processing of the analysis unit. First, FIGS. 3 and 4 illustrate examples of flow information visualization processing. In this case, as illustrated in FIG. 3(1), the analysis unit 15b acquires, from the flow information 14a, flow information of a core router C that aggregates the edge router E to be monitored, for example, flow information going back a predetermined time from the current time. Then, as illustrated in FIG. 3(2), the analysis unit 15b refers to the connection relationship information 14b and acquires information that associates the flow information with the edge router E through which the traffic of the flow information passed, thereby identifying the edge router E through which the acquired flow information passed.

[0029] The analysis unit 15b also aggregates the inflow / outflow traffic volume of the flow information for each edge router E. The analysis unit 15b visualizes the aggregation result and outputs it to the output unit 12, for example, as shown in Fig. 4. In the example shown in Fig. 4, the traffic volume of the flow information from before the time t1 when a failure occurred in the carrier network to the current time t2 is visualized for each of the edge routers E1 and E2.

[0030] In this case, as exemplified for edge router E1, if the traffic volume at the current time t2 remains above a predetermined threshold (for example, 70%) of the traffic volume immediately before the failure time t1 for a predetermined period of time, it is possible to determine that the failure has been recovered from or is not having any impact.

[0031] On the other hand, as exemplified for edge router E2, if the traffic volume at the current time t2 remains less than a predetermined threshold (e.g., 70%) of the traffic volume immediately before the failure time t1 for a predetermined period of time, it is possible to determine that the failure is continuing.

[0032] In this way, the analysis unit 15b can analyze whether the edge router E has recovered from the failure by aggregating the traffic volume of the flow information for each edge router E.

[0033] Alternatively, the analysis unit 15b performs a process of grasping the number of affected users. In this case, the analysis unit 15b first acquires, from the collected flow information 14a, flow information collected from the core router C connected to the network device in which the failure occurred. Then, the analysis unit 15b identifies, as the failure status, the end users included in the flow information as users affected by the failure.

[0034] 5 and 6 illustrate the process of determining the number of affected users. In this case, first, as shown in Fig. 5(1), the analysis unit 15b receives an input specifying the network device in which a failure has occurred via the input unit 11 or the communication control unit 13. Next, as shown in Fig. 5(2), the analysis unit 15b refers to the connection relationship information 14b and identifies all core routers C connected to the specified network device.

[0035] For example, when a failure occurs in a transmission device, the analysis unit 15b refers to the connection relationship information 14b, and based on information about a certain transponder, its opposing transponder, and the transmission devices present between them, identifies all routes including the transmission device where the failure occurred, and identifies all transponders included in the routes. The analysis unit 15b also refers to the connection relationship information 14b and identifies the core router C connected to the transponder.

[0036] If a failure occurs in a transponder, in FIG. 5(2), the analysis unit 15b refers to the connection relationship information 14b and identifies the core router C connected to the transponder in which the failure occurs.

[0037] Then, as shown in FIG. 5(3), the analysis unit 15b acquires, from the flow information 14a, flow information collected from the identified core router C around the time of the failure occurrence.

[0038] Also, if a failure occurs in core router C, the analysis unit 15b acquires, from the flow information 14a in FIG. 5(3), flow information collected from the core router C where the failure occurred around the time of the failure.

[0039] Also, if a failure occurs in edge router E, the analysis unit 15b acquires, from the flow information 14a in FIG. 5 (3), flow information that passed through edge router E where the failure occurred around the time of the failure.

[0040] Next, as shown in FIG. 5(4), the analysis unit 15b refers to the connection relationship information 14b, identifies at least one of the end-user transfer device and the VPN group that sent or received the flow information, and creates a list.

[0041] Here, there is no flow information for users or VPNs that were not communicating around the time of the failure. On the other hand, if there is communication from a user home transfer device under the opposing transponder, flow information exists, so it is possible to identify the user or VPN as being affected by the failure.

[0042] Therefore, the analysis unit 15b presents the created list of user home transfer devices or VPN groups to the output unit 12 as affected users or affected VPNs, as shown in FIG. 5(5).

[0043] Fig. 6 shows an example of a screen displaying the results of the process for determining the number of affected users. In the example shown in Fig. 6, H5 and H6 exist under the control of the transponder opposite to transponder T1, and H1, H2, H4, and H6 were communicating around the time of the failure. In the example shown in Fig. 6, a list of end-user home transfer devices affected by the failure and their total number, and a list of VPN groups affected by the failure and their total number are displayed as the failure status.

[0044] In this way, the analysis unit 15b can identify at least one of the end-user home transfer devices or VPN groups that were actually communicating around the time of the failure and were affected by the failure.

[0045] [Analysis Processing] Next, the analysis processing performed by the analysis device 10 according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a flowchart showing the procedure of the analysis processing. The flowchart in Fig. 7 starts, for example, when the user performs an operation input to instruct the start of the analysis processing.

[0046] First, the collector 15a collects flow information of traffic flowing through each edge router E from the core router C that aggregates the edge routers E (step S1). Specifically, the collector 15a periodically collects flow information from the core router C via the communication control unit 13. The collector 15a also performs a format conversion process on the collected flow information to extract packets inside the capsules of encapsulated packets. As a result, the collector 15a extracts flow information that reveals the contents of traffic flowing through the edge routers E subordinate to the core router C, and stores the extracted flow information in the flow information 14a of the storage unit 14.

[0047] Next, the analysis unit 15b analyzes the status of the failure using the collected flow information 14a and the connection relationship information 14b that indicates the connection relationships between devices in the network (step S2).

[0048] For example, the analysis unit 15b performs a flow information visualization process. That is, the analysis unit 15b aggregates the traffic volume of the collected flow information for each edge router E, thereby analyzing whether the edge router E has recovered from the failure.

[0049] Alternatively, the analysis unit 15b performs a process of determining the number of affected users. In this case, the analysis unit 15b first acquires, from the collected flow information, flow information collected from the core router C connected to the network device in which the failure occurred. Then, the analysis unit 15b identifies end users included in the flow information as users affected by the failure.

[0050] Furthermore, the analysis unit 15b outputs the analysis results (step S3). For example, when the analysis unit 15b has performed the flow information visualization process, it aggregates the inflow / outflow traffic volume of the flow information for each edge router E, visualizes the aggregation result, and outputs it to the output unit 12. Alternatively, when the analysis unit 15b has performed the affected user number grasping process, it outputs to the output unit 12 a list of at least either the end-user home transfer devices or the VPN groups that were actually communicating around the time of the failure occurrence and were affected by the failure. This completes the series of analysis processes.

[0051] [Effects] As described above, in the analysis device 10 of this embodiment, the collection unit 15a collects flow information 14a representing the contents of traffic circulating through each edge router E from the core router C that aggregates the edge routers E. The analysis unit 15b analyzes the failure situation using the collected flow information 14a and connection relationship information 14b representing the connection relationships between devices in the network.

[0052] Specifically, the analysis unit 15b aggregates the traffic volume of the collected flow information 14a for each edge router E, and analyzes whether the edge router E has recovered from the failure as the failure status.

[0053] Alternatively, the analysis unit 15b acquires flow information collected from the core router C connected to the device in which the failure occurred from the collected flow information 14a, and identifies the end users included in the flow information as users affected by the failure, as the status of the failure.

[0054] In this way, by aggregating the traffic volume of flow information for each edge router E, it is possible to analyze whether the edge router E has recovered from a failure. Alternatively, by using flow information that was actually communicating around the time of the failure, it is possible to identify at least one of the end-user home transfer device or VPN group that was affected by the failure. In this way, the analysis device 10 makes it possible to accurately understand the status of the failure.

[0055] [Program] A program written in a computer-executable language may be created to execute the processes performed by the analysis device 10 according to the above embodiment. In one embodiment, the analysis device 10 can be implemented by installing an analysis program that executes the above analysis process as package software or online software on a desired computer. For example, by executing the analysis program on an information processing device, the information processing device can function as the analysis device 10. The information processing device referred to here includes general-purpose computers such as server computers and desktop or notebook personal computers. Other information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the analysis device 10 may also be implemented on a cloud server.

[0056] 8 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0057] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0058] Here, the hard disk drive 1031 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or the memory 1010, for example.

[0059] The analysis program is stored in the hard disk drive 1031 as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the analysis device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0060] Furthermore, data used for information processing by the analysis program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0061] The program module 1093 and program data 1094 related to the analysis program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the analysis program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0062] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0063] REFERENCE SIGNS LIST 10 Analysis device 11 Input unit 12 Output unit 13 Communication control unit 14 Storage unit 14a Flow information 14b Connection relationship information 15 Control unit 15a Collection unit 15b Analysis unit C Core router E Edge router

Claims

1. An analysis device comprising: a collection unit that collects flow information representing the contents of traffic circulating through each edge router from a core router that aggregates edge routers; and an analysis unit that analyzes failure conditions using the collected flow information and information representing the connection relationships between devices within the network.

2. The analysis device described in claim 1, characterized in that the analysis unit analyzes whether or not the edge router has recovered from the failure as the failure status by aggregating the traffic volume of the collected flow information for each edge router.

3. The analysis device described in claim 1, characterized in that the analysis unit acquires flow information collected from a core router connected to a device in which a failure has occurred from the collected flow information, and identifies, as the status of the failure, end users included in the flow information as users affected by the failure.

4. An analysis method executed by an analysis device, comprising: a collection step of collecting flow information representing the contents of traffic circulating through each edge router from a core router that aggregates edge routers; and an analysis step of analyzing a failure situation using the collected flow information and information representing the connection relationships between devices in the network.