JP2008283621A - Apparatus and method for monitoring network congestion state, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To monitor a congestion state for each node by accurately estimating a processing delay time of each node. <P>SOLUTION: The apparatus for monitoring a congestion state of a network, comprises: a response time calculating section for calculating, in accordance with a trace route command transmitted from a specific node in the network, a response time of the trace route command between the relevant node and another node; a round trip time (RTT) differential value arithmetic means 16 for calculating a difference of the response time corresponding to a neighboring node; an RTT differential minimum value table 26 for storing a minimum value of the difference of the response time; and a packet processing delay arithmetic means 20 for calculating a processing delay time of each node on the basis of a difference between the difference of the response time and the minimum value. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a network congestion status monitoring device, a network congestion status monitoring method, and a program.

  As a means to acquire node information and delivery route information existing on the network, send a trace route (trace route) command to return the response information from each node, based on the response information from each node to the trace route command, There are methods for acquiring node information and delivery route information. For example, Patent Document 1 describes a technique that applies a trace route command or a ping command.

  On the other hand, as a method for measuring the traffic volume of a node, there is a method using a network analysis protocol such as a tool for analyzing a flow called NetFlow or sFlow, a protocol analyzer called Sniffer, or SNMP (simple network management protocol). . For example, Patent Document 2 describes combining route information based on a trace route with information on traffic volume and quality (retransmission rate, throughput, etc.) of each node.

JP 2002-111665 A JP 2002-84278 A

  In the method described in Patent Document 1, a node is automatically detected and registered by a trace route command to each terminal, a ping command is transmitted to the registered node, and the status of each node is determined by whether or not there is a response. Although monitoring is realized, the purpose is to monitor the state of the node, so the congestion state cannot be grasped. In addition, although it is possible to assume the congestion status of a node using the measured RTT (Round Trip Time) value in the trace route command, it is not possible to measure the amount of traffic actually flowing through the node. There is. Furthermore, since the RTT value by the trace route is a value measured from the terminal to a certain node, the error in estimating the congestion state increases as the number of hops increases, and the congestion state is based on the RTT value. It is difficult to accurately obtain.

  In addition, the method described in Patent Document 2 also monitors quality information such as retransmission rate and throughput, so that the quality and congestion status of the path unit and the entire network can be estimated, but the congestion status focusing on each node Is difficult to estimate, and it is impossible to specify the congestion point. NetFlow, sFlow, Sniffer, and other tools and SNMP can collect traffic volume, CPU usage rate, retransmission rate, throughput, and so on. However, in this case as well, it is impossible to estimate the congestion state focusing on each node. In addition, it is difficult to estimate the congestion status in consideration of the degree of influence on the user because it is impossible to acquire network quality information and delivery route information experienced by the user.

  As described above, in the network monitoring according to the conventional technique, it is difficult to grasp for each node the network congestion state experienced by the user. That is, it is difficult to identify a congestion location that occurs due to aging of a node, processing delay due to traffic increase, or to detect a sign of congestion occurrence.

  In addition, the RTT value representing quality information experienced by the user obtained by using a ping command, a trace route command, and the like, the traffic amount of actual traffic information obtained by NetFlow, SNMP, etc., CPU usage rate, retransmission rate, throughput, etc. In fact, there is no method other than the manual mapping method when trying to display the above information simultaneously.

  Therefore, the present invention has been made in view of the above problems, and an object of the present invention is to monitor the congestion status of each node by accurately estimating the processing delay time of each node. It is an object of the present invention to provide a new and improved network congestion status monitoring apparatus, network congestion status monitoring method and program.

  In order to solve the above-described problem, according to one aspect of the present invention, there is provided an apparatus for monitoring a congestion state of a network, and the node and other nodes can be obtained by a trace route command transmitted from a specific node in the network. A response time calculation unit that calculates a response time of a trace route command between the node, a difference calculation unit that calculates a difference between the response times corresponding to adjacent nodes, and a minimum that stores a minimum value of the difference between the response times There is provided a network congestion status monitoring device including a value storage unit and a processing delay time calculation unit that calculates a processing delay time of each node based on the difference between the difference between the response times and the minimum value.

  According to the above configuration, the response time of the trace route command between the node and another node is calculated based on the trace route command transmitted from a specific node in the network, and the response time corresponding to the adjacent node is calculated. The difference is calculated. Then, the minimum value of the difference in response time is stored, and the processing delay time of each node is calculated based on the difference between the difference in response time and the minimum value. Since the difference and minimum value of response time at each node can be considered as packet processing time when congestion does not occur, the value calculated by the difference between the difference and minimum value of response time is the congestion at that node. It can be estimated that the processing delay time caused by.

  Further, a node information acquisition unit that acquires an amount of traffic flowing through the node or a CPU usage rate of the node using the SNMP protocol may be provided. According to this configuration, it is possible to simultaneously measure the packet processing delay time, the traffic amount, the CPU usage rate, and the like, and it is possible to accurately estimate the congestion state for each node and each route.

  Further, based on the time when the processing delay time is acquired and the time when the traffic amount or CPU usage rate is acquired, the congestion situation in which the processing delay time, traffic amount and CPU usage rate of each node are stored in association with each other A storage unit may be further provided. According to such a configuration, the processing delay time, the traffic amount, and the CPU usage rate of each node are stored in association with each other based on the time when the processing delay time is acquired and the time when the traffic amount or CPU usage rate is acquired. Therefore, the processing delay time, traffic volume, and CPU usage rate of each node can be acquired at the same time, and the network congestion status can be monitored with high accuracy.

  In order to solve the above-described problem, according to another aspect of the present invention, a response to a trace route command between the node and another node by a trace route command transmitted from a specific node in the network. A step of calculating a time, a step of calculating a difference between the response times corresponding to adjacent nodes, a step of storing a minimum value of the difference between the response times, and a difference between the difference between the response times and the minimum value And a step of calculating a processing delay time of each node based on the network congestion status monitoring method.

  According to the above configuration, the response time of the trace route command between the node and another node is calculated based on the trace route command transmitted from a specific node in the network, and the response time corresponding to the adjacent node is calculated. The difference is calculated. Then, the minimum value of the difference in response time is stored, and the processing delay time of each node is calculated based on the difference between the response time and the minimum value. Since the difference and minimum value of response time at each node can be considered as packet processing time when congestion does not occur, the value calculated by the difference between the difference and minimum value of response time is the congestion at that node. It can be estimated that the processing delay time caused by.

  Further, it may further comprise a step of acquiring the amount of traffic flowing through the node or the CPU usage rate of the node using the SNMP protocol. According to this configuration, it is possible to simultaneously measure the packet processing delay time, the traffic amount, the CPU usage rate, and the like, and it is possible to accurately estimate the congestion state for each node and each route.

  In addition, the method further includes a step of associating the processing delay time, the traffic amount, and the CPU usage rate of each node based on the time when the processing delay time is acquired and the time when the traffic amount or CPU usage rate is acquired. There may be. According to this configuration, the processing delay time, the traffic amount, and the CPU usage rate of each node can be associated with each other based on the time when the processing delay time is acquired and the time when the traffic amount or CPU usage rate is acquired. The processing delay time, traffic volume, and CPU usage rate of each node can be acquired at the same time, and the network congestion status can be monitored accurately.

  In order to solve the above-mentioned problem, according to another aspect of the present invention, there is provided a program for causing a computer to function in order to monitor a network congestion state, wherein the trace route is transmitted from a specific node in the network. By means of a command, means for calculating a response time of a trace route between the node and another node, means for calculating a difference between the response times corresponding to adjacent nodes, and storing a minimum value of the difference between the response times There is provided a program for causing a computer to function as a means, a means for calculating a processing delay time of each node based on a difference between the response time difference and the minimum value.

  According to the above configuration, the response time of the trace route command between the node and another node is calculated based on the trace route command transmitted from a specific node in the network, and the response time corresponding to the adjacent node is calculated. The difference is calculated. Then, the minimum value of the difference in response time is stored, and the processing delay time of each node is calculated based on the difference between the response time and the minimum value. Since the difference and minimum value of response time at each node can be considered as packet processing time when congestion does not occur, the value calculated by the difference between the difference and minimum value of response time is the congestion at that node. It can be estimated that the processing delay time caused by.

  According to the present invention, there are provided a network congestion status monitoring device, a network congestion status monitoring method, and a program capable of accurately estimating the processing delay time of each node and monitoring the congestion status of each node. be able to.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

  FIG. 1 is a schematic diagram for explaining a network congestion state monitoring apparatus 100 according to an embodiment of the present invention. Here, the upper part of FIG. 1 shows a functional block diagram showing the configuration of the network congestion status monitoring apparatus 100. Further, the lower part of FIG. 1 shows a state in which RTT (Round Trip Time) values are acquired from the terminal 102, the node (1) 104, the node (2) 106, and the node (3) 108. The terminal 102, the node (1) 104, the node (2) 106, and the node (3) 108 are connected by an ISP (Internet Service Provider) network 40. The nodes 102 to 108 are components that include various devices such as terminals (servers) and have information and communication processing functions.

  The network congestion status monitoring device 100 is realized by a configuration having a computer, software that operates on the computer, and a storage unit (memory) that stores various tables. Further, the network congestion status monitoring apparatus 100 includes a display unit (not shown) that displays the congestion status. As shown in the upper part of FIG. 1, the network congestion status monitoring apparatus 100 includes two functional units, a route information collection function unit 10 and a traffic monitoring function unit 12, a port IP-monitoring IP conversion unit 14, and an RTT difference value calculation unit 16. , RTT difference minimum value judging means 18, four processing units of packet processing delay calculating means 20, traffic monitoring IP address table 22, route information table 24, RTT difference minimum value table 26, traffic information table 28, route information / traffic information The table 30 is composed of five databases.

  The terminal 102 transmits a trace route and receives a response to the trace route from each node in the ISP network 40. This response includes the port IP address of each node. The route information collection function unit 10 stores information such as the measurement time, the port IP address of each node, the number of hops (HOP), and the RTT value, which are measurement results of the trace rate transmitted from the terminal 102. And a function of analyzing a route in the ISP network 40. Here, the measurement time includes the transmission time of the trace route and the reception time of the response from each node. The hop (HOP) represents between the nodes in the ISP network 40, and the number of hops (HOP) is the number of hops interposed between the terminal 102 that transmitted the trace route and the node that responded to the trace route. Shows the number. The RTT value represents a response time from when the trace route is transmitted until a response is received.

  The port IP-monitoring IP conversion unit 14 refers to the traffic monitoring IP address table 22 and extracts the monitoring IP address from the port IP address. The monitoring IP address is an address corresponding to each node on a one-to-one basis. As shown in the table below, in the traffic monitoring IP address table 22, the port IP address and the monitoring IP address are associated with each other. The port IP-monitoring IP conversion unit 14 has a function of uniquely determining a node even if it is a measurement result of a trace route to a plurality of ports held by the node by extracting a monitoring IP address.

  Based on the RTT value corresponding to each node, the RTT difference value calculation means 16 [the RTT value of the node having the number of hops (HOP) N−the RTT value of the node having the number of hops (HOP) N−1] (hereinafter referred to as RTT). This is a means for calculating the RTT values of all nodes. Thereby, the RTT value between the terminal 102 and each node can be converted into the RTT value between each hop. Furthermore, if the physical distance between each hop is about the longest distance assumed in Japan, the transmission time due to line propagation is extremely small compared to the packet processing time of the node, and the RTT difference value is It can be considered that it is almost equal to the packet processing time. For the terminal to the first node, the measured RTT value is used as it is as the RTT difference value.

  In the example shown in the lower part of FIG. 1, the RTT value (RTT1) between the terminal 102 and the node (1) 104, the RTT value (RTT2) between the terminal 102 and the node (2) 106, and between the terminal 102 and the node (3) 108 The RTT values (RTT3) are measured. The RTT difference value calculation means 16 calculates the difference between the RTT values. For example, when the difference between RTT2 and RTT1 is calculated, the RTT value is converted between the node (1) 104 and the node (2) 106, and when the difference between RTT3 and RTT2 is calculated, the node (2) 106 and the node (3) 108 are calculated. Conversion to an RTT value in between.

  The RTT difference minimum value determining means 18 refers to the RTT difference minimum value table 26, determines whether or not the RTT difference value obtained by the RTT difference calculating means 16 is the minimum compared with the past accumulated data, and determines the minimum In this case, the RTT difference minimum value table 26 is updated. As shown in the following table, the smallest RTT difference value in the past is stored in the RTT difference minimum value table 26 in association with the monitoring IP address of each node. The minimum RTT difference value at each node is the minimum value of the packet processing time of each node, and can be considered as the packet processing time when congestion does not occur.

  The packet processing delay calculation means 20 is a means for calculating the difference between the RTT difference value and the RTT difference minimum value and calculating the packet processing delay time of each node. Since the RTT difference minimum value is the minimum value of the packet processing time of a certain node, the value calculated based on the difference from the RTT difference value can be estimated as the packet processing delay time caused by congestion in the node.

  The calculated packet processing delay time is stored in the route information table 24 together with the number of hops of each node, the monitoring IP address, the port IP address, the RTT value, and the RTT difference value, as shown in the table below.

  The traffic monitoring function unit 12 uses a protocol such as SNMP, collects information such as measurement time, monitoring IP address of each node, each port IP address, traffic volume, CPU usage, and the traffic information table 28. It has a function of storing collected data and a function of storing data in the traffic monitoring IP address table 22. As shown in the table below, the traffic information table 28 stores the traffic volume and CPU usage rate corresponding to the node of each monitored IP address at a certain time.

  Further, the traffic monitoring function unit 12 extracts the packet processing delay time, the traffic amount, and the CPU usage rate in each node based on the time in the route information table 24 and the traffic information table 28 and the monitoring IP address, and the route information / Store in the traffic information table 30. At this time, since the time information in the route information table 24 may not be unique, the average value of the time information in the route information table 24 is calculated, and the time information in the traffic information table 28 corresponds to the closest time. Traffic volume and CPU usage rate. Thereby, the traffic information table 30 in which the monitoring IP address, the number of hops, the packet processing delay time, the traffic amount, and the CPU usage rate of each node are associated can be acquired. The information of each table is shown in the following table.

  As described above, according to the network congestion status monitoring apparatus 100 of the present embodiment, the packet processing delay time, the traffic amount, the CPU usage rate, and the like of each node for each path can be simultaneously measured in the ISP network 40. . The measured information is displayed on a display unit (not shown) of the network congestion monitoring device 100. Therefore, it is possible to accurately estimate the congestion status for each node and for each route, and it is possible to quickly respond to inquiries from the user. In addition, by detecting a sign of congestion, it becomes possible to detect an aging facility and a bottleneck at an early stage, and it is possible to efficiently perform network operation.

CPU (Central) included in the network congestion monitoring device 100 as a computer
In the processing unit), with the configuration described above, a step of calculating an RTT value between the terminal 102 and the other nodes 104, 106, 108 by a trace route command transmitted from the terminal 102, and the adjacent nodes 104, 106, Based on the difference between the RTT difference value and the minimum value, the step of calculating the RTT difference value at 108, the step of storing the minimum value of the RTT difference value in the RTT difference minimum value table 26, and the respective nodes 104, 106, 108. The processing by the step of calculating the packet processing delay time is sequentially executed. The software (program) operating on the CPU is for causing the network congestion status monitoring device 100 as a computer to execute these processes. The network congestion status monitoring device 100 includes a recording medium such as a hard disk drive or a magnetic medium. It can be stored in an external recording medium such as a disk.

  FIG. 2 is a schematic diagram showing a state in which the congestion state of the ISP network 40 is monitored by the network congestion state monitoring device 100. In the configuration shown in FIG. 2, other ISP networks 42 and 44 and access networks 46 and 48 are connected to the ISP network 40. A terminal 102 that transmits a trace route is connected to the ISP network 40. In addition, nodes 104, 106, 108,..., 116 are connected to the ISP network 40.

  First, an example of steady monitoring of the congestion status of the ISP network 40 will be described below for the steady monitoring of the network congestion status. In the example of FIG. 2, in the ISP network 40, the terminal 102 that transmits the trace route is installed at a connection point with the other ISP networks 42, 44 or a connection point with the access networks 46, 48, and other connection points. Alternatively, a trace route is constantly transmitted to various servers in service, and measurement is performed. At this time, a method of transmitting a trace route from another node itself instead of the terminal 102 is also possible. The measurement results are periodically collected by the network congestion monitoring device 100. If it is desired to reduce the bandwidth used for the test traffic by the trace route, it can be handled by a method such as scheduling the test traffic.

  At the same time, using a protocol such as SNMP, the amount of traffic flowing through each of the nodes 104, 106, 108,... Collect regularly. With the above-described configuration, the administrator of the network congestion status monitoring apparatus 100 sets parameters such as packet processing delay times 104, 106, 108,..., 116, traffic volume, and CPU usage rate of each node for each path. Browse and monitor the congestion status of the ISP network 40. At this time, a threshold is individually set for each parameter, and an alarm is transmitted when any of the parameters exceeds the threshold. Further, an alarm may be sent when a plurality of parameters exceed a threshold value. In this way, it is possible to reduce false detections by performing alarm transmission in various ways.

  Next, an example of non-stationary monitoring for investigating the congestion status of the ISP network 40 at the time of an inquiry from the user will be described below. The measurement method is the same as in the case of steady monitoring. A connection point in the ISP network 40 and a server in service are specified from the user inquiry status, and trace route measurement is executed for a certain period. At this time, the method of specifying two points for measuring the trace route can be automated by linking with existing user management information. Each node is designated from the IP address of each node obtained by the trace route measurement, and the amount of traffic flowing through the node, the CPU usage rate of the node, and the like are measured for a certain period using a protocol such as SNMP. Then, by collecting the measurement results in the network congestion status monitoring device 100, it is possible to browse the same measurement results as in the case of steady monitoring and investigate the congestion status for the inquiring user.

  As described above, according to the present embodiment, the packet processing delay time, the traffic amount, the CPU usage rate, and the like of each node for each path can be simultaneously measured in the ISP network 40. Therefore, it is possible to accurately estimate the congestion state for each node and for each route, and it becomes possible to detect an aging facility and a bottleneck at an early stage, thereby enabling efficient network operation.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to the example which concerns. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Understood.

It is a schematic diagram for demonstrating the network congestion condition monitoring apparatus which concerns on one Embodiment of this invention. It is a schematic diagram which shows a mode that the congestion condition of an ISP network is monitored by the network congestion condition monitoring apparatus.

Explanation of symbols

12 Traffic Monitoring Function Unit 16 RTT Difference Value Calculation Unit 18 RTT Difference Minimum Value Determination Unit 20 Packet Processing Delay Calculation Unit 26 RTT Difference Minimum Value Table

Claims (7)

A device that monitors network congestion:
A response time calculation unit that calculates a response time of a trace route command between the node and another node by a trace route command transmitted from a specific node in the network;
A difference calculating unit for calculating a difference between the response times corresponding to adjacent nodes;
A minimum value storage unit for storing a minimum value of the response time difference;
A processing delay time calculation unit that calculates a processing delay time of each node based on a difference between the difference between the response times and the minimum value;
A network congestion status monitoring device comprising:   The network congestion state monitoring apparatus according to claim 1, further comprising a node information acquisition unit configured to acquire an amount of traffic flowing through the node or a CPU usage rate of the node using an SNMP protocol.   Based on the time when the processing delay time is acquired and the time when the traffic volume or CPU usage rate is acquired, the congestion status storage unit stores the processing delay time, traffic volume and CPU usage rate of each node in association with each other. The network congestion status monitoring device according to claim 1, further comprising: Calculating a response time of the trace route command between the node and another node by a trace route command transmitted from a specific node in the network;
Calculating a difference between the response times corresponding to adjacent nodes;
Storing a minimum value of the response time difference;
Calculating a processing delay time of each node based on a difference between the response time difference and the minimum value;
A network congestion status monitoring method comprising:   5. The network congestion status monitoring method according to claim 4, further comprising a step of acquiring an amount of traffic flowing through the node or a CPU usage rate of the node using an SNMP protocol.   The method further comprises the step of associating the processing delay time, the traffic amount, and the CPU usage rate of each node based on the time when the processing delay time is acquired and the time when the traffic amount or the CPU usage rate is acquired. The network congestion status monitoring method according to claim 4 or 5. A program that allows a computer to function to monitor network congestion:
Means for calculating a response time of a trace route between the node and another node by a trace route command transmitted from a specific node in the network;
Means for calculating a difference between the response times corresponding to adjacent nodes;
Means for storing a minimum value of the response time difference;
Means for calculating a processing delay time of each node based on a difference between the difference between the response times and the minimum value;
As a program to make the computer function.

Images