Analysis system and analysis method

Abstract

An analysis device (1) has a measurement device (10) and a flow information collection device (20). The measurement device (10) associates and stores a probe packet bearing marking and information on a path of the probe packet in a logical network, and transmits the probe packet to the logical network. The flow information collection device (20) identifies the probe packet on the basis of the marking from among packets collected as flow information from the logical network, and acquires information on the identified probe packet from the measurement device (10).

Description

Analysis system and analysis method

[0001] The present invention relates to an analytical system and an analytical method.

[0002] In recent years, the spread of 5G and e-sports has led to stringent network requirements, such as ultra-low latency, low jitter, and high reliability. Network monitoring technology is also needed to ensure these requirements.

[0003] Another known method of network monitoring is to send probe packets through the network, but this method may not be able to determine the route taken by the probe packets in a virtual private network (VPN) where the inside of the network cannot be seen from the outside.

[0004] In response to this, a technology is known in which an arbitrary VPN label is specified and the VPN route is grasped using a traceroute mechanism (see, for example, Non-Patent Document 1). Also known is a technology in which fine-grained flow information is collected by combining IPFIX (header sample) and a format conversion device, and the VPN route is identified from information such as input / output I / F and MPLS label included in the flow information.

[0005] “MPLS Ping and Traceroute for BGP and IGP Prefix-SID,” Segment Routing Configuration Guide for Cisco NCS 540 Series Routers (IOS XR Release 6.3.x), Cisco, [Retrieved February 14, 2024], Internet (https: / / www.cisco.com / c / ja_jp / td / docs / iosxr / ncs5xx / segment-routing / 63x / b-segment-routing-cg-63x-ncs540 / b-segment-routing-cg-63x-ncs540_chapter_01100.html)

[0006] However, with conventional techniques, there are cases where the route of a probe packet in a VPN cannot be identified.

[0007] For example, the Traceroute described in Non-Patent Document 1 has a problem in that it cannot uniquely identify a route in a section to which ECMP (Equal Cost Multi Path) is applied.

[0008] Furthermore, for example, in the method using flow information, in the case of a network in which information corresponding to the measurement destination (e.g., VPAN) is not included in the packet in the VPN section, even if flow information is collected within the network, there is a problem in that it is not possible to identify which measurement destination the probe packet is for.

[0009] In order to solve the above-mentioned problems and achieve the objectives, the analysis system is an analysis system having a measurement device and a flow information collection device, wherein the measurement device stores marked probe packets in association with information on the route of the probe packets in a logical network, transmits the probe packets to the logical network, and the flow information collection device identifies the probe packets based on the marking from among packets collected as flow information from the logical network, and obtains information on the identified probe packets from the measurement device.

[0010] According to the present invention, it is possible to identify the route of a probe packet in a VPN.

[0011] FIG. 1 is a diagram illustrating the configuration and operation of an analysis system according to a first embodiment. FIG. 2 is a diagram illustrating an example configuration of an analysis system according to the first embodiment. FIG. 3 is a diagram illustrating an example of information associating identifiers with measurement locations. FIG. 4 is a diagram illustrating an example of information associating identifiers with measurement results. FIG. 5 is a diagram illustrating the configuration of a transmitted probe packet. FIG. 6 is a diagram illustrating the configuration of a collected probe packet. FIG. 7 is a flowchart illustrating the processing flow of a measurement device according to the first embodiment. FIG. 8 is a flowchart illustrating the processing flow of a flow information collection device according to the first embodiment. FIG. 9 is a diagram illustrating an example configuration of an analysis system according to a second embodiment. FIG. 10 is a diagram illustrating an example of a computer that executes an analysis program.

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings, in which: FIG.

[0013] First, the configuration of the analysis system according to the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram illustrating the configuration and operation of the analysis system according to the first embodiment.

[0014] As shown in FIG. 1, the analysis system 1 includes a measurement device 10 and a flow information collection device 20. The network to be analyzed includes PEs 41, 42, 43, 44, CEs 51, 52, 53, and 54. The PEs are provider edge routers in the provider network. The CEs are customer edge routers in the user network. Network devices such as routers (not shown) are also located in the provider network.

[0015] A logical network 30 is configured in a provider network having PE41, PE42, PE43, and PE44 at its edges. Furthermore, a VPN is configured inside the logical network 30. VPN 31 connects PE41 and PE42. VPN 32 connects PE43 and PE44.

[0016] The analysis system 1 transmits a probe packet. The probe packet passes through the PE 42, the logical network 30, and the PE 41, and returns to the analysis system 1. The analysis system 1 can use the probe packet to measure network continuity, delay, jitter, and the like.

[0017] Furthermore, if the route that the probe packet passed through can be identified, it will be useful for isolating the abnormal section and taking operational measures based on the measurement results. For example, in operational measures, it will be possible to change the network route so as to bypass the section determined to be abnormal.

[0018] On the other hand, like user packets, the route of a probe packet in a VPN section is determined by a PE based on BGP (Border Gateway Protocol), OSPF (Open Shortest Path First), etc. Also, as described above, it is difficult to identify the route of a probe packet in a VPN using conventional techniques.

[0019] In contrast, the analysis system 1 of this embodiment can identify the route of a probe packet in a VPN.

[0020] The configuration of the analysis system 1 will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the configuration of the analysis system according to the first embodiment.

[0021] 2, the measurement device 10 includes a logical network measurement unit 11, a topology grasping unit 12, and a logical network grasping unit 13. The measurement device 10 also stores a measurement result DB 14 and a node information DB 15.

[0022] The topology grasping unit 12 grasps the topology of the physical network that constitutes the logical network 30. The topology of the physical network includes identification information of nodes such as routers including PEs, addresses, adjacency relationships, links, labels, etc. The labels are, for example, MPLS (Multi-Protocol Label Switching) labels. The topology grasping unit 12 stores the obtained topology in the node information DB 15.

[0023] The topology understanding unit 12 can acquire the topology using information from routing protocols such as OSPF (Open Shortest Path First) and ISIS (Intermediate System to Intermediate System), or link state information such as BGP-LS (Border Gateway Protocol - Link State).

[0024] The logical network grasping unit 13 grasps the configuration of the logical network 30. The logical network grasping unit 13 has an identifier grasping unit 131 and an information collecting unit 132. The identifier grasping unit 131 grasps the identifier embedded in the packet passing through the logical network 30. The embedding of the identifier will be described later. The information collecting unit 132 collects identification information of the endpoints (e.g., PE41, PE42) of the logical network 30, labels (VPN label, MPLS label), information of the interface for CE (e.g., MAC address, IP address, VLAN ID), etc.

[0025] The logical network measurement unit 11 includes a normal measurement packet transmitting / receiving unit 111 , a marked measurement packet transmitting / receiving unit 112 , a network linking unit 113 , and a logical network measurement path calculation unit 114 .

[0026] The NW tying unit 113 ties the node information acquired by the topology grasping unit 12 with the VPN information acquired by the logical NW grasping unit 13. The logical NW measurement path calculation unit 114 calculates the path of the probe packet based on the result of the tying by the NW tying unit 113.

[0027] The normal measurement packet transmitting / receiving unit 111 transmits probe packets without marking to the logical network 30. The marking measurement packet transmitting / receiving unit 112 transmits probe packets with an embedded identifier to the logical network 30. The probe packet route is as calculated by the logical network measurement route calculation unit 114.

[0028] The normal probe packet transmitting / receiving unit 111 and the marking-added probe packet transmitting / receiving unit 112 store measurement results such as delay and jitter of the received probe packets in the measurement result DB 14. The normal probe packet transmitting / receiving unit 111 and the marking-added probe packet transmitting / receiving unit 112 can measure probe packets using the method described in Reference 1.

[0029] Reference 1: International Publication No. 2022 / 176123

[0030] The flow information collection device 20 includes a route identification unit 21 , a marking analysis unit 22 , a flow information collection unit 23 , a bandwidth calculation unit 24 , and a collaboration unit 25 .

[0031] The flow information collection unit 23 collects flow information of the logical network 30. For example, the flow information collection unit 23 collects flows using IPFIX (IP Flow Information Export).

[0032] The marking analysis unit 22 analyzes the markings. That is, the marking analysis unit 22 identifies probe packets from among packets collected as flow information from the logical network 30 based on the markings.

[0033] The bandwidth calculation unit 24 calculates the bandwidth for transmitting and receiving the packets to be analyzed based on the flow information. The calculated bandwidth is used for analyzing the marking.

[0034] Based on the analysis result by the marking analysis unit 22, the route identification unit 21 identifies the route of the marked probe packet, including the VPN section, in the logical network 30.

[0035] The marking-attached probe packet transmitting / receiving unit 112 marks probe packets using an identifier embedding method or a packet size increasing method.

[0036] (Identifier Embedding Method) The identifier embedding method is a method in which an identifier is embedded in the area of ​​measurement metadata of a probe packet.

[0037] When a flow of packets with an embedded identifier is collected, the marking analysis unit 22 causes the linking unit 25 to acquire the identifier and information about the measurement destination from the measurement device 10. The information about the measurement destination is information that identifies the contracted VPN line, such as a VLAN ID. The information about the measurement destination only needs to be included in the information about the logical network 30 collected by the information collection unit 132 of the measurement device 10, and may be an interface, an MPLS label, or the like.

[0038] The linking unit 25 acquires information on the logical network 30 collected by the information collecting unit 132 of the measuring device 10, which associates identifiers with measurement locations as shown in Fig. 3. Fig. 3 is a diagram showing an example of information associating identifiers with measurement locations.

[0039] The route identification unit 21 identifies the route of the probe packet in the VPN from the information on the measurement destinations. In the example of Fig. 3, the route identification unit 21 identifies that the probe packet with the identifier "0x00000000" has passed through the measurement destination corresponding to "400-1000" and the measurement destination corresponding to "400-1001".

[0040] As shown in Fig. 4, the measurement device 10 can associate identifiers with measurement results in the measurement result DB 14. Fig. 4 is a diagram showing an example of information in which identifiers are associated with measurement results.

[0041] (Packet Size Increasing Method) The packet size increasing method is a method in which the packet size of the probe packet is increased. For example, the marking-attached probe packet transmitting / receiving unit 112 increases the variable area of ​​the size measurement metadata.

[0042] If the bandwidth calculated by the bandwidth calculation unit 24 based on the flow information is greater than the threshold, the marking analysis unit 22 acquires the identifier of the probe packet with an increased packet size and information about the measurement site from the measurement device 10. The subsequent processing by the flow information collection device 20 is the same as in the case of the identifier embedding method.

[0043] (Configuration of Probe Packet) A packet transmitted by the marked probe packet transmitting / receiving unit 112 will be described with reference to Fig. 5. Fig. 5 is a diagram illustrating the configuration of a probe packet to be transmitted.

[0044] As shown in FIG. 5, the probe packet 71 transmitted by the marking-attached probe packet transmitting / receiving unit 112 has a region 711 , a region 712 , a region 713 , a region 714 , and a region 715 .

[0045] Area 711 contains the physical network path from the measurement system (measuring device 10) to the starting point (PE42). Area 712 contains the logical network path on the starting point side (PE42). Area 713 contains the logical network path on the ending point side (PE41). Area 714 contains the physical network path from the ending point (PE41) to the measurement system (measuring device 10). The logical network path is, for example, an IP address. The physical network is, for example, a MAC address.

[0046] Additionally, measurement metadata, i.e., identifier, header, sent time, and received time, are stored in area 715. Additionally, area 715 includes a variable area that can be padded.

[0047] Packets collected as flow information by the flow information collection unit 23 using IPFIX will be described with reference to Fig. 6. Fig. 6 is a diagram for explaining the structure of a collected probe packet.

[0048] As shown in FIG. 6, the probe packet 72 collected by the flow information collection unit 23 has a region 721 , a region 722 , a region 723 , a region 724 , and a region 725 .

[0049] An IPFIX header (input / output I / F, source router) is entered in field 721. An area 722 contains the logical network path (start point to end point) of the VPN section. An area 723 contains the logical network path on the end point side (PE41). An area 724 contains the physical network path from the end point (PE41) to the measurement system. An area 725 contains the transmission time, reception time, and identifier.

[0050] The processing flow of the measurement device 10 will be described with reference to Fig. 7. Fig. 7 is a flowchart showing the processing flow of the measurement device according to the first embodiment. As shown in Fig. 7, first, the measurement device 10 calculates a measurement path (step S101).

[0051] Next, the measurement device 10 determines whether the measurement destination is a target for route visualization (step S102). If the measurement destination is a target for route visualization (step S102, Yes), the measurement device 10 generates and transmits a probe packet with a marking (step S103).

[0052] If the measurement destination is not a target for route visualization (No at step S102), the measurement device 10 generates and transmits a conventional probe packet, that is, a probe packet without marking (step S104).

[0053] Thereafter, the measuring device 10 receives the probe packet (step S105), and records the measurement result (step S106).

[0054] The processing flow of the flow information collection device 20 will be described with reference to Fig. 8. Fig. 8 is a flowchart showing the processing flow of the flow information collection device according to the first embodiment.

[0055] As shown in FIG. 8, the flow information collection device 20 repeatedly collects flow information (steps S201 and S209).

[0056] The flow information collection device 20 determines whether the packet collected as flow information is a probe packet (step S202). If the collected packet is a probe packet (step S202, Yes), the flow information collection device 20 determines whether the marking method is an identifier embedding method (step S203).

[0057] If the marking method is the identifier embedding method (Yes at step S203), the flow information collection device 20 acquires measurement location information from the measurement system (measuring device 10) based on the identifier (step S204).

[0058] If the marking method is not the identifier embedding method (step S203, No), the flow information collection device 20 determines whether the bandwidth is larger than that of other probe packets (step S205). The flow information collection device 20 may also determine whether the packet size exceeds a threshold.

[0059] If the bandwidth is larger than that of other probe packets (step S205, Yes), the flow information collection device 20 acquires measurement location information with an increased size from the measurement system (measuring device 10) (step S206).If the bandwidth is not larger than that of other probe packets (step S205, No), the flow information collection device 20 proceeds to step S209.

[0060] The flow information collection device 20 identifies the route of the probe packet based on the acquired information (step S208). The identified route includes the route of the VPN section.

[0061] Furthermore, if the collected packet is not a probe packet (step S202, No), the flow information collection device 20 performs analysis processing on other packet types (for example, non-probe packets) (step S207). At this time, the flow information collection device 20 does not need to identify the path.

[0062] Second Embodiment As shown in Fig. 9, the functions of the measurement device 10 may be provided in a user's home. Fig. 9 is a diagram showing an example of the configuration of an analysis system according to a second embodiment.

[0063] The measuring device 10b has a marking-attached packet transmitting / receiving unit 112b. The measuring device 10c has a marking-attached packet transmitting / receiving unit 112c. Marking-attached probe packets are transmitted and received between the measuring device 10b and the measuring device 10c via the logical network 30.

[0064] The measurement location information is stored in the measurement system DB 15a. The measurement location ascertaining unit 25a of the flow information collecting device 20 acquires the measurement location information corresponding to the marked probe packet from the measurement system DB 15a.

[0065] [System Configuration, etc.] The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic. The program may be executed not only by the CPU but also by other processors such as a GPU.

[0066] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0067] [Program] In one embodiment, the measurement device 10 and the flow information collection device 20 can be implemented by installing an analysis program that executes the above-described processes as package software or online software on a desired computer. For example, by executing the above-described analysis program on an information processing device, the information processing device can function as the measurement device 10 or the flow information collection device 20. The information processing device referred to here includes desktop and notebook personal computers. Other information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0068] 10 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0069] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0070] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the measurement device 10 and the flow information collection device 20 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configurations of the measurement device 10 and the flow information collection device 20 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0071] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0072] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0073] REFERENCE SIGNS LIST 10 Measurement device 11 Logical network measurement unit 12 Topology grasping unit 13 Logical network grasping unit 14 Measurement result DB 15 Node information DB 20 Flow information collection device 21 Route identification unit 22 Marking analysis unit 23 Flow information collection unit 24 Bandwidth calculation unit 25 Collaboration unit 30 Logical network 31, 32 VPN 41, 42, 43, 44 PE 51, 52, 53, 54 CE 111 Normal measurement packet transmission / reception unit 112 Marked measurement packet transmission / reception unit 113 NW linking unit 114 Logical network measurement path calculation unit 131 Identifier grasping unit 132 Information collection unit

Claims

1. An analysis system having a measurement device and a flow information collection device, wherein the measurement device stores marked probe packets in association with information on the route of the probe packets in a logical network, and transmits the probe packets to the logical network; and the flow information collection device identifies the probe packets based on the marking from packets collected as flow information from the logical network, and obtains information on the identified probe packets from the measurement device.

2. The analytical system of claim 1, wherein the measurement device applies the marking by embedding an identifier in the probe packet.

3. The analytical system according to claim 1, wherein the measurement device applies marking by increasing a paddable variable area of ​​the probe packet.

4. An analysis method executed by an analysis system having a measurement device and a flow information collection device, wherein the measurement device stores marked probe packets in association with information on the route of the probe packets in a logical network, and transmits the probe packets to the logical network; and the flow information collection device identifies the probe packets based on the marking from among packets collected as flow information from the logical network, and obtains information on the identified probe packets from the measurement device.

Images