JP2006229701A - Device and method for estimating the quality of tcp flow communication and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a device for estimating the quality of TCP flow communication capable of properly estimating the quality of communication of the entire flow in a corresponding link while reducing the size of a table required in flow management, and also to provide a method and a program for estimating the quality of TCP flow communication therefor. <P>SOLUTION: A collating part 32 for a packet header collates packet header information of a received packet with user flow information registered in a flow management table 40 for the user, and requests a flow managing part 33 to update the flow information of the user when the packet header information is registered. When the packet header information is not registered, a sampling part 34 extracts one packet with respect to N packets, transfers the packet to a packet header analyzing part 35 and requests registration of the arrival time of the packet and the packet header information, when an SYN flag is raised and when there is a space in the table 40. A flow managing means executes the request, and a part 36 estimating flow statistical information uses information of the table 40 to estimate the quality of the TCP flow communication. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a TCP flow communication quality estimation apparatus and method for managing a communication quality state of an IP network, and a program therefor, and in particular, can reduce a table size required for flow management and is biased toward communication with a large flow size. The present invention relates to a technology that can estimate communication quality without any problem.

  As IP networks are widely used, there is an increasing demand for communication quality assurance on IP networks. Accordingly, it has become important to measure the traffic flowing through the IP network and grasp the current communication quality state. In particular, a technique for measuring quality at a user flow level that directly represents the quality experienced by the user (the flow here indicates a TCP connection) has attracted attention.

  However, in order to measure the communication quality at the user flow level, it is necessary to capture (capture) all the packets flowing through the line, analyze the packet header information of all the packets, or analyze the flow information, Further, the table size (memory amount) required for flow management becomes enormous. Therefore, as the line speed increases, it becomes practically difficult to capture all packets and execute the above-described processing.

  Therefore, in recent years, attention has been paid to a technique for reducing processing required for flow management by performing packet sampling. The packet sampling method does not capture and refer to all the packets, but periodically captures and references one packet per N, and the original flow from the one sampled N packet. Statistical information is estimated.

  Also, Mori, Uchida, Kawahara, Goto “A method for identifying elephant flows from sampled packets” IEICE Technical Report NS2004-13, pp.17-20, 2004-04. A method of identifying a flow having a high link bandwidth occupancy rate using packet sampling is proposed.

  Also, C. Estan and G. Varghese “New Directions in Traffic Measurement and Accounting” ACM SIGCOMM 2002, Aug. 2002 (Non-Patent Document 2) proposes a method for obtaining statistics of a flow having a large flow size with high accuracy.

  However, what was proposed in Non-Patent Documents 1 and 2 described above is intended to identify flows that are large in size or have a high bandwidth occupancy rate and quickly identify users that generate excessive flows. However, it was not possible to grasp the communication quality of the entire flow on a link and the statistical information (flow rate distribution, etc.) of the entire flow.

  When the distribution related to the original flow information is estimated by this method, there is a problem that the distribution is biased toward a flow having a large flow size and cannot be estimated appropriately. The reason is that in normal packet sampling in which one packet is extracted for every N packets, a flow having a large size is likely to be sampled, and the probability that a flow having a small size is ignored increases.

  Furthermore, N. Duffield, C. Lund, and M. Thorup “Properties and Prediction of Flow Statistics from Sampled Packet Streams” ACM SIGCOMM Internet Measurement Conference 2002, Nov. 2002 and N. Duffield, C. Lund. , and M. Thorup “Estimating Flow Distributions from Sampled Flow Statistics” In Proceedings of ACM SIGCOMM, pp. 325-336, Aug. 2003. (Non-Patent Document 4) In packet sampling, among the sampled packets, the number of SYN packets (one of the TCP flags, meaning the start of communication) is used to calculate the average number of flow occurrences and the average and distribution of flow sizes that have not been sampled. A method of estimation is proposed.

  However, those proposed in these non-patent documents only estimate statistical information about the flow size, and the flow rate (corresponding to TCP throughput) indicating the quality of the user and the flow duration (file transfer time) Equivalent) was not possible.

Mori, Uchida, Kawahara, Goto “A method for identifying elephant flows from sampled packets” IEICE Technical Report NS2004-13, pp.17-20, 2004-04. C. Estan and G. Varghese “New Directions in Traffic Measurement and Accounting” ACM SIGCOMM2002, Aug. 2002. N. Duffield, C. Lund, and M. Thorup “Properties and Prediction of Flow Statistics from Sampled Packet Streams” ACM SIGCOMM Internet Measurement Conference 2002, Nov. 2002. N. Duffield, C. Lund, and M. Thorup “Estimating Flow Distributions from Sampled Flow Statistics” In Proceedings of ACM SIGCOMM, pp. 325-336, Aug. 2003.

  As described above, when all packets are targeted, there is a problem that a huge size (memory amount) is required as a table required for flow management, and high-speed processing is required. When sampling is performed, there is a problem that it is not possible to grasp the communication quality of the entire flow on a link and the statistical information of the entire flow (flow rate distribution, etc.), and the distribution is biased toward flows with a large flow size. There were a problem that it was not possible to estimate properly, a problem that it was not possible to estimate the flow rate (corresponding to TCP throughput) representing the user quality and the flow duration (corresponding to file transfer time).

  The object of the present invention is to solve the above-mentioned problems and reduce the size (memory amount) of the table required for flow management, while appropriately reducing the communication quality of the entire flow in the link to communication of a large flow size. An object of the present invention is to provide a TCP flow communication quality estimation device, a TCP flow communication quality estimation method, and a program therefor that can be estimated.

  In order to achieve the above object, the present invention improves the sampling method called the sample and hold method of Non-Patent Document 2 described above. The sample-and-hold method is a method in which the flow information is updated by capturing all packets belonging to the flow after the packet is once sampled by normal packet sampling.

  In this method, as described in the above [Background Art], since it is extracted with a bias toward a large flow, a new sampling method is devised to avoid this.

  In the present invention, only for flows in which SYN packets are sampled, packets belonging to the flow are captured, flow information is updated, and communication quality (flow rate, flow duration) of each flow is calculated.

  As described above, in the present invention, information is collected only for flows in which SYN packets are sampled. Therefore, the number of flows to be managed can be significantly reduced as compared with the case of using the sample and hold method of Non-Patent Document 3.

  Further, since the SYN packet has a property of being extracted with equal probability regardless of the flow size (see Non-Patent Documents 3 and 4), it is considered that the original distribution can be estimated without being biased toward a flow having a large size. The effect of reducing the number of flow management and the significant improvement of the original distribution estimation accuracy will be referred to in the section of [Effects of the invention] described later together with the results of actual measurement data analysis. Hereinafter, the features of the present invention will be described.

a) The TCP flow communication quality estimation device (30) of the present invention compares the packet header information of the received packet with the user flow information registered in the user flow management table (40), and the received packet is the user flow management table. If it belongs to the flow registered in (40), the flow management means (flow management unit 33) managing the user flow management table (40) is requested to update the user flow information and received. A packet header verification unit (packet header verification unit 32) for transferring the packet to a sampling unit (sampling unit 34) to be described later when the received packet does not belong to a flow registered in the user flow management table (40). , Extract one packet from the N packets transferred A sampling unit that transfers the packet that has not been extracted to the next node, and the packet header information of the transferred packet is read to represent the start of TCP communication. If the SYN flag is set and the user flow management table (40) is empty, the packet flow information that determines the arrival time of the packet and the user flow from which the packet is sent is stored in the user flow management table (40). A packet header analysis unit (packet header analysis unit 35) that requests the flow management unit to register a new entry, a packet header verification unit (packet header verification unit 32), and a packet header analysis unit (packet header analysis unit 35). The flow manager who receives the request and executes the request (Flow management unit 33) and flow statistical information estimation means (flow statistical information) for estimating the TCP flow communication quality of the entire flow via the link using the flow information entered in the user flow management table (40) And an estimation unit 36).

b) Further, for each flow, the user flow management table (40) stores the time T_first_i at which the packet from the flow i first arrived, the time T_last_i at which the packet last arrived, and the total number B_i of transferred packet bytes. The request from the packet header analysis means (packet header analysis unit 35) is to newly enter the user flow i to which the packet belongs in the user flow management table (40), T_first_i as the current time, and T_last_i as the current The request from the packet header verification means is a request to update T_last_i for the packet to the current time, and to update B_i to B_i + the packet size. The information estimation means (flow statistical information estimation unit 36) performs flow i for the user flow at regular intervals if T_last_i = T_first_i. -Exclude from the entry of the management table (40), if T_last_i> T_first_i, calculate the flow duration T_i of the flow i entered in the user flow management table (40) as T_i = (T_last_i-T_first_i) The flow rate R_i is calculated as R_i = B_i / T_i, and a distribution relating to the flow rate is created using R_i (i = 1 to the number of entered flows), and the flow rate of the entire original flow is calculated using the distribution. It is characterized by being estimated as a distribution.

c) Further, the packet header verification means refers to the packet header information of the received packet, determines whether the FIN flag indicating the end of TCP communication or the RST flag indicating the interruption of TCP communication is set, and arrives If the packet is from a flow i already entered in the user flow management table and the FIN flag or RST flag is set, T_last_i and B_i are updated in the flow management means (flow management unit 33). The flow management unit (flow management unit 33) updates T_last_i and B_i of the user flow management table (40) according to the request from the packet header verification unit (packet header verification unit 32). , The flow i is deleted, and flow statistical information estimation means (flow statistical information Tough 36) is characterized in that it is adapted to calculate the flow rate R_i based on the update of T_last_i and B_i of the user flow management table (40).

d) Further, the user flow management table (40) includes, for each flow, the time T_first_i at which the packet from the flow i first arrived, the time T_last_i at which the packet last arrived, and the total number B_i of the transferred packet bytes. The request from the packet header analysis means (packet header analysis unit 35) is to store the user flow i to which the packet belongs, into the user flow management table (40), T_first_i as the current time, and T_last_i as the request. This is a request to set the current time and B_i to the packet size, and the request from the packet header verification unit (packet header verification unit 32) updates T_last_i for the packet to the current time and sets B_i to B_i + the packet size The flow statistical information estimation means (flow statistical information estimation unit 36) updates the flow i for each fixed period. A flow size S_i is assumed to be B_i, a distribution relating to the flow size B is created using B_i (i = 1 to the number of entered flows), and the distribution is estimated as a flow size distribution of the entire original flow. It is characterized by being.

e) In addition, the user flow management table (40) includes, for each flow, the time T_first_i when the packet from the flow i first arrived, the time T_last_i when the packet last arrived, and the total number B_i of packet bytes transferred. The request from the packet header analysis means (packet header analysis unit 35) is to store the user flow i to which the packet belongs, into the user flow management table (40), T_first_i as the current time, and T_last_i as the request. This is a request to set the current time and B_i to the packet size, and the request from the packet header verification unit (packet header verification unit 32) updates T_last_i for the packet to the current time and sets B_i to B_i + the packet size The flow statistical information estimation means (flow statistical information estimation unit 36) updates T_last_i = T at regular intervals. If _first_i, the flow i is excluded from the entry of the user flow management table (40). If T_last_i> T_first_i, the flow duration T_i of the flow i entered in the user flow management table (40) is set to T_i = ( T_last_i-T_first_i) and create a distribution for the flow duration T using the T_i (i = 1 to the number of entered flows), and use the distribution as the flow duration distribution of the entire original flow. It is characterized by estimation.

f) A TCP flow communication quality estimation apparatus for estimating the communication quality of a TCP flow passing through a certain link in a communication network, and manages a user flow management table (80) for registering user flow information of a received flow. The flow management means (flow management unit 72) collates the packet header information of the received packet with the user flow information registered in the user flow management table (80), and the received packet is registered in the user flow management table (80). The flow management means (flow management unit 72) managing the user flow management table (80) is requested to update the user flow information, and the received packet is the user flow. If it does not belong to the flow registered in the management table (80), Packet header verification means (packet header verification section 71) for transferring the packet to the packet header analysis means (packet header analysis section 73) described later, and SYN indicating the start of TCP communication by reading the packet header information of the transferred packet If the flag is set, one packet is extracted from N packets, and if there is a vacancy in the user flow management table (80), the arrival time of the packet and the packet from which user flow the packet is from A packet header analysis unit (packet header analysis unit 73) for requesting the flow management unit (flow management unit 72) to register a new entry in the user flow management table (80). (Packet header verification unit 71) and packet header analysis means ( Via the link using the flow management means (flow management unit 72) that receives the request from the packet header analysis unit 73) and executes the request, and the flow information entered in the user flow management table (80). And a flow statistical information estimating means (flow statistical information estimating unit 76) for estimating the TCP flow communication quality of the entire flow.

g) When the flow management means (flow management units 33, 72) determines that there is no space in the user flow management table (40, 80), one of the already entered user flows is selected. The flow information is cleared and a new entry is made there.

h) In the TCP flow communication quality estimation method of the present invention, one packet is extracted from N arrival packets, the packet header is read, and a SYN flag indicating the start of TCP communication is set and prepared in advance. If there is a vacancy in the user flow management table, a new entry is registered in the user flow management table for packet header information that determines the arrival time of the packet and from which user flow the packet is, and one in N Independent of packet extraction, every time a packet arrives, it is checked whether there is a packet from a user flow that has already been entered in the user flow management table. The packet header information is read and the user in the user flow management table is read. The step of updating the information of the flow i and the processing of the above two steps are continued for a certain period, and then the flow information entered in the user flow management table is used for the TCP flow communication of the entire flow via the link And a step of estimating quality.

i) A program according to the present invention is a TCP flow communication quality estimation program for causing a computer to execute a TCP flow communication quality estimation method for estimating the communication quality of a TCP flow passing through a certain link in a communication network. Is a TCP flow communication quality estimation program for functioning as each means in the TCP flow communication quality estimation apparatus.

  By adopting the above-described configuration, the present invention reduces the size (memory amount) of the table necessary for flow management, and does not bias the TCP flow communication quality of the entire flow in the link to communication with a large flow size. It is possible to provide a TCP flow communication quality estimation device, a TCP flow communication quality estimation method, and a program therefor that can be estimated with high accuracy.

Hereinafter, the effect by this invention is demonstrated in detail using drawing.
FIG. 7 is a diagram showing a result of actually verifying the operation of the present invention using actually measured data. This is a result of using data obtained by capturing all packet headers for several days in August 2003 on a line between a certain company LAN and ISP. In FIG. 7, the horizontal axis represents x [byte], and the vertical axis represents the rate at which the flow size exceeds x [byte] (= P [flow size> x]).

  FIG. 7 shows the original distribution of the flow size in one hour (“original” in the figure) and the distribution estimated by the method proposed in the present invention by setting N = 100 (“proposed” in the figure). It is. For comparison, when the flow size is obtained by the sample size (“sampled” in the figure) from which at least one packet is extracted by normal packet sampling and the sample-and-hold method (see Non-Patent Document 2). The result (“sample-hold” in the figure) is also shown.

  As a result, in “sampled” and “sample-hold”, the distribution is biased toward large flows that do not match the result of “original”, whereas in the method proposed in the present invention, the original distribution is It can be seen that the estimation is accurate (that is, the result matches the “original” result). FIG. 8 is a diagram showing the number of flows sampled by each method.

  From this, it can be seen that in the method proposed in the present invention, the number of management flows can be made very small compared to other methods, and can be reduced to about 1/100 of the original number of flows.

  FIG. 9 is a diagram illustrating an estimation result for the flow rate. In FIG. 9, the horizontal axis represents x [kbps], and the vertical axis represents the rate at which the flow rate exceeds x [kbps] (= P [flow rate> x]). It can be seen that the method proposed in the present invention can estimate the flow rate distribution more accurately than in the case of the sample and hold method (see Non-Patent Document 2) (“sample-hold”).

(Summary of Invention)
First, before describing a specific embodiment of the present invention, the most characteristic configuration of the present invention will be described. The present invention relates to a technique for estimating the communication quality of an IP network, in particular, a packet header analysis unit (packet header analysis means) that determines whether a SYN packet is seen by looking at a SYN (synchronization) flag in TCP, and a SYN packet. In this case, a flow management unit (flow management means) that registers information related to the packet in a predetermined table and updates only the registered packet flow for subsequent received packets is provided. Accordingly, it is possible to appropriately estimate the communication quality of the entire flow in the link without biasing to communication of a large flow size, while reducing the size (memory amount) of the table required for flow management.

(Example)
Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a configuration diagram showing an example of a basic configuration of an IP network to which the present invention is applied. As shown in FIG. 1, the TCP flow communication quality estimation device 30 according to the present invention is used in a form of being inserted into a link between the node 10 and the node 20.

<Example 1>
First, Example 1 of the present invention will be described.
FIG. 2 is a block diagram illustrating a configuration example of the TCP flow communication quality estimation apparatus according to the first embodiment of the present invention. FIG. 3 is a flowchart for explaining a communication quality estimation method using the TCP flow communication quality estimation apparatus according to the first embodiment of the present invention. FIG. 4 is a diagram showing an example of a user flow management table used in the present invention.

  As shown in the flowchart of FIG. 3, in the TCP flow communication quality estimation apparatus 30 shown in FIG. 2, when a packet arrives from the previous node (step S1), the packet counter 31 counts up the counter C (step S2). Thereafter, the header information (source IP address, destination IP address, source port number, destination port number, protocol number) is read from the packet in the packet header verification unit 32 and already exists in the flow management unit 33. Whether or not the packet is from the flow entered in the user flow management table 40 (step S3). If the packet is from the entered flow (step S3: Y), the header information is stored in the flow management unit 33. The user is notified and the flow management unit 33 will be described later. Updates the information of the flow of the low management table 40 (step S4), and the packet is forwarded to the subsequent node 20.

  If it is determined in step S3 that the packet arriving from the previous node is not a packet from a flow entered in the user flow management table 40 existing in the flow management unit 33 (step S3: N), The packet is transferred to the sampling unit 34.

  The sampling unit 34 reads the value of the counter C of the packet count unit 31 and checks whether the remainder obtained by dividing the value of the counter C by N (N is a predetermined sampling period) is equal to 0 (step S5).

  If the remainder is 0 (step S5: Y), the packet is transferred to the packet header analysis unit 35, and at the same time, the packet is transferred to the subsequent node 20.

  If the remainder is not 0 (step S5: N), the packet is simply transferred only to the subsequent node 20 (or a random number is generated in the range of 0 to 1 for each packet arrival, and the result is 1 / N or less. If so, the packet may be transferred to the packet header analysis unit 35 and then transferred to the subsequent node 20; otherwise, it may be transferred only to the subsequent node 20).

  The packet header analysis unit 35 checks whether or not the TCP SYN (synchronization) flag is set (step S6). If the SYN flag is set (step S6: Y), header information (source IP address, incoming call) is set. The destination IP address, source port number, destination port number, and protocol number) are read out, the information is notified to the flow management unit 33, and a new user flow entry is requested to be registered in the user flow management table 40.

  In the flow management unit 33, a user flow management table 40 for managing a state for each flow is prepared in advance. In the user flow management table 40, for example, as shown in FIG. 4, for each flow id (i = 1, 2,...), The time T_first_i when the packet from the flow i first arrives, the packet arrives last. Time T_last_i, the total number of transferred packet bytes B_i is stored.

  In the example of FIG. 4, the source IP address, destination IP address, source port number, destination port number, protocol number) for flow 1 are (111.11.1.1, 123.45.6.7, 80, 6321, tcp) , T_first_i is 10.2 s, T_last_i is 15.5 s, B_i is 100 bytes, the source IP address, destination IP address, source port number, destination port number, protocol number) for flow 2 is (211.11.1.1, 223.45.6.7, 20, 6321, tcp), T_first_i is 0.5 s, T_last_i is 0.82 s, and B_i is 50 bytes.

  When the flow management unit 33 receives a request for a new user flow entry from the packet header analysis unit 35, the flow management unit 33 checks whether or not the number of flows entered in the user flow management table 40 is smaller than a predetermined upper limit (that is, the user Check whether there is a space in the flow management table 40) (step S7). If so (step S7: Y), the flow to which the packet belongs is registered in the user flow management table 40, and the corresponding T_first_i, T_last_i Is set to the current time, B_i is set to the packet size (step S8), and the process is terminated (step S9).

  When the header information of the packet from the already entered user flow id is notified from the packet header verification unit 32, T_last_i is updated to the current time, and B_i ← B_i + the packet size is updated.

  The above procedure is performed from the start of measurement until a predetermined time period t0 elapses, and when the time t0 elapses, information in the user flow management table 40 is notified to the flow statistics information estimation unit 36.

  In the flow statistics information estimation unit 36, for each entered flow, if T_last_i = T_first_i, the flow i is excluded from the entry of the user flow management table 40, and if T_last_i> T_first_i, the user flow management table 40 is excluded. Is calculated as T_i = (T_last_i−T_first_i), and the flow rate R_i is calculated as R_i = B_i / T_i.

  The flow rate R_i (i = 1 to Num, where Num is the number of entered flows) is R′_i that is rearranged in ascending order with respect to R_i, and the original distribution P [flow rate ≦ x] for the flow rate R is expressed as P [Flow rate ≦ R'_i] = Estimated as i / Num. Here, P [flow rate ≦ x] means the ratio of the number of flows with a flow rate of x or less to the total number of flows.

For example, the number of entered flows Num is Num = 5, and the result of rearranging the rates of each flow in ascending order is R_1 '= 10kbps, R_2' = 50kbps, R_3 '= 60kbps, R_4' = 100kbps, R_5 ' = 200kbps At this time, the flow rate distribution P [flow rate ≦ x] is estimated as follows.
P [Flow rate ≦ 10kbps] = 1/5
P [Flow rate ≦ 50kbps] = 2/5
P [Flow rate ≦ 60kbps] = 3/5
P [Flow rate ≦ 100kbps] = 4/5
P [Flow rate ≦ 200kbps] = 1

<Example 2>
Next, a second embodiment of the present invention will be described.
In the first embodiment, the flow rate is calculated using the flow information entered in the user flow management table 40 until the predetermined time period t0 elapses, and the flow rate distribution is estimated. However, in the second embodiment, the flow rate is calculated and the flow rate distribution is estimated when the FIN flag indicating the end of the TCP communication or the RST flag indicating the interruption of the TCP communication is set instead of the time period t0. It is a thing.

  That is, in the second embodiment, the arrived packet is a packet from a flow that has already been entered in the user flow management table 40, and the FIN flag indicating the end of TCP communication or the RST flag indicating the interruption of TCP communication is set. If so, the flow rate R_i is calculated after updating the time T_last_i at which the packet from the flow i last arrived and the total number of packet bytes B_i transferred from the flow i, and the flow i is deleted from the user flow management table 40. To do. Other processes are the same as those in the first embodiment.

<Example 3>
Next, a third embodiment of the present invention will be described.
In the first embodiment, the flow rate is calculated using the flow information entered in the user flow management table 40 and the flow rate distribution is estimated. In the third embodiment, the flow rate is calculated. Instead, when the time t0 has elapsed, the flow size S_i of the flow i is calculated as S_i = B_i.

  That is, in the third embodiment, the flow size of the flow i is set to the total number B_i of packet bytes transferred from the flow i (i = 1 to Num, Num is the number of flows entered), and the total number of packet bytes B_i is B'_i is the one sorted in ascending order, and the original distribution P [flow size ≤ B'_i] for flow size B is estimated as P [flow size ≤ B'_i] = i / Num. is there. Other processes are the same as those in the first embodiment.

<Example 4>
Next, a fourth embodiment of the present invention will be described.
In the first embodiment, the flow rate is calculated using the flow information entered in the user flow management table 40 and the flow rate distribution is estimated. In the fourth embodiment, the flow rate is calculated. Instead, the flow duration is calculated and the distribution of the flow duration is estimated.

  That is, in the fourth embodiment, instead of calculating the flow rate in the first embodiment, the flow duration T_i of the flow i is calculated in the same manner as in the first embodiment, and the flow duration T_i (i = 1 to Num, where Num is the number of entered flows) are sorted in ascending order as T′_i, and the original distribution P [flow duration ≦ T′_i] for the flow duration T is expressed as P [flow duration ≤T'_i] = Estimated as i / Num. Other processes are the same as those in the first embodiment.

<Example 5>
Next, a fifth embodiment of the present invention will be described.
FIG. 5 is a block diagram illustrating a configuration example of the TCP flow communication quality estimation apparatus according to the fifth embodiment of the present invention. FIG. 6 is a flowchart for explaining a communication quality estimation method using the TCP flow communication quality estimation apparatus according to the fifth embodiment of the present invention.

  In the first embodiment, one out of N packets is extracted, and if the SYN flag is set in the header and there is a space in the user flow management table, the entry is made in the table. In the fifth embodiment, however, The processing order is changed. First, it is checked whether or not the SYN flag is set every time the packet arrives. When the SYN flag is set, one packet is extracted from N packets, and packet header information of the packet is extracted. Is registered as a new entry.

  In the fifth embodiment, as shown in the flowchart of FIG. 6, in the communication quality estimation apparatus 70 shown in FIG. 5, when a packet arrives from the previous node (step S <b> 11), the packet header verification unit 71 Information (source IP address, destination IP address, source port number, destination port number, protocol number) is read out from a flow already entered in the user flow management table 80 existing in the flow management unit 72. Whether the packet is a packet from the entered flow (step S12: Y), header information is notified to the flow management unit 72, and the flow management unit 72 describes a user flow management table described later. While updating the information of 80 flows (step S13), Packet is forwarded to the subsequent node 60.

  If it is determined in step S12 that the packet arriving from the preceding node is not a packet from a flow entered in the user flow management table 80 existing in the flow management unit 72 (step S12: N), The packet is transferred to the packet header analysis unit 73.

  The packet header analysis unit 73 checks whether or not the TCP SYN (synchronization) flag is set (step S14). If the SYN flag is set (step S14: Y), the packet is sent to the packet counter unit 74. .

  When receiving the packet, the packet counting unit 74 counts up the counter C (step S15), and then the packet is transferred to the sampling unit 75.

  The sampling unit 75 reads the value of the counter C of the packet count unit 74 and checks whether the remainder obtained by dividing the value of the counter C by N (N is a predetermined sampling period) is equal to 0 (step S16).

  If the remainder is 0 (step S16: Y), the packet is transferred to the packet header analysis unit 73, and at the same time, the packet is transferred to the subsequent node 60.

  If the remainder is not 0 (step S16: N), the packet is simply transferred only to the subsequent node 60 (or a random number is generated in the range of 0 to 1 for each packet arrival, and the result is 1 / N or less. If so, the packet may be transferred to the packet header analysis unit 73 and then transferred to the succeeding node 60, otherwise, it may be transferred only to the succeeding node 60).

  The packet header analysis unit 73 reads header information (source IP address, destination IP address, source port number, destination port number, protocol number) from the packet and notifies the flow management unit 72 of the information. Request registration of a new user flow entry to the user flow management table 80.

  As in the first embodiment, the flow management unit 72 has a user flow management table 80 for managing the state for each flow. In the user flow management table 80, for example, as shown in FIG. 4, for each flow id (i = 1, 2,...), The time T_first_i when the packet from the flow i first arrives, the packet arrives last. Time T_last_i, the total number of transferred packet bytes B_i is stored.

  When the flow management unit 72 receives a registration request for a new user flow entry from the packet header analysis unit 73, the flow management unit 72 checks whether the number of flows entered in the user flow management table 80 is smaller than a predetermined upper limit value. If the user flow management table 80 is empty, the flow to which the packet belongs is registered in the user flow management table 80 (step S18), and the process ends (step S21).

  Otherwise (that is, if there is no space in the user flow management table 80), a random number is generated in the range of 0 to 1, and the result is p (where p is a predetermined overwrite permission rate, 0 ≦ p If it is ≦ 1) or less (step S19: Y), for example, the information of the oldest flow is selected from the already entered user flows, the information of the flow is cleared (step S20), and new information is added there. The entry is registered (step S18), and the process ends (step S21).

  The processes in steps S19 to S20 can also be applied to step S7: N in the first embodiment.

  If the value of p is set large, past data is cleared frequently and only the latest data is collected. Conversely, if p is set small, more past data remains, so network operation The value may be determined depending on which one places importance on the person.

  The packet header verification unit, packet header analysis unit, packet counter unit, sampling unit, flow management unit, and flow statistical information estimation unit in the TCP flow communication quality estimation device of the present invention correspond to each process stored in the storage unit. This is realized by executing a program to be executed by a CPU (computer).

  These programs are created by converting the processing to be performed by each unit in the TCP flow communication quality estimation apparatus of the present invention described using the flowchart into a program code, and the created programs are CD-ROM, DVD, FD, etc. It is distributed to users via a computer-readable recording medium or a network such as the Internet, installed in the storage unit of the user's computer, and executed by the CPU.

It is a block diagram which shows the basic structural example of the network to which this invention is applied. It is a block diagram which shows the structural example of the TCP flow communication quality estimation apparatus which concerns on this invention. It is a flowchart of the TCP flow communication quality estimation apparatus which concerns on this invention. It is a figure which shows an example of the user flow management table used in this invention. It is a block diagram which shows the structural example of the TCP flow communication quality estimation apparatus which concerns on Example 5 of this invention. It is a flowchart for demonstrating the communication quality estimation method using the TCP flow communication quality estimation apparatus which concerns on Example 5 of this invention. It is a figure which shows an example of the result of having estimated the flow size distribution by this invention. It is a figure which shows the number of flows sampled by each system. It is a figure which shows an example of the result of having estimated the flow rate distribution by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10,20: Node 30: TCP flow communication quality estimation apparatus 31: Packet count part 32: Packet header collation part 33: Flow management part 34: Sampling part 35: Packet header analysis part 36: Flow statistics information estimation part 40: User flow Management table 50, 60: Node 70: TCP flow communication quality estimation device 71: Packet header verification unit 72: Flow management unit 73: Packet header analysis unit 74: Packet count unit 75: Sampling unit 76: Flow statistics information estimation unit 80: User flow management table

Claims (9)

A TCP flow communication quality estimation device for estimating the communication quality of a TCP flow via a link in a communication network,
A flow management unit that manages a user flow management table for registering user flow information of a received flow, receives a request from a packet header verification unit and a packet header analysis unit described later, and executes the request;
When the packet header information of the received packet is compared with the user flow information registered in the user flow management table, and the received packet belongs to the flow registered in the user flow management table, the user flow When requesting the flow management means managing the management table to update the user flow information and the received packet does not belong to the flow registered in the user flow management table, the packet is sent to a sampling unit described later. Packet header verification means for forwarding to,
Sampling means for extracting one packet from the transferred N packets and transferring it to the packet header analysis means, and transferring the unextracted packet to the next node;
If the packet header information of the transferred packet is read and the SYN flag indicating the start of TCP communication is set and the user flow management table is empty, the arrival time of the packet and the user flow from which the packet Packet header analysis means for requesting the flow management means to register a new entry in the user flow management table for packet header information that defines whether the packet is a packet;
A TCP flow communication quality estimation device comprising: flow statistical information estimation means for estimating the TCP flow communication quality of the entire flow passing through the link using the flow information entered in the user flow management table . In the TCP flow communication quality estimation apparatus according to claim 1,
The user flow management table stores, for each flow, a time T_first_i at which the packet from the flow i first arrived, a time T_last_i at which the packet last arrived, and a total number B_i of transferred packet bytes.
The request from the packet header analysis means is a request for newly entering the user flow i to which the packet belongs in the user flow management table, setting T_first_i to the current time, T_last_i to the current time, and B_i to the packet size. ,
The request from the packet header verification means is a request to update the T_last_i for the packet at the current time and to update the B_i to B_i + the packet size.
The flow statistic information estimating means excludes the flow i from the entry of the user flow management table if T_last_i = T_first_i, and is entered in the user flow management table if T_last_i> T_first_i. The flow duration T_i of the flow i is calculated as T_i = (T_last_i−T_first_i), the flow rate R_i is calculated as R_i = B_i / T_i, and the flow rate is calculated using R_i (i = 1 to the number of entered flows). A TCP flow communication quality estimation device characterized in that a distribution relating to a flow rate is created and estimated as a flow rate distribution of the entire original flow using the distribution. In the TCP flow communication quality estimation apparatus according to claim 2,
The packet header verification means further refers to the packet header information of the received packet, determines whether the FIN flag indicating the end of TCP communication or the RST flag indicating the interruption of TCP communication is set, and arrives the packet Is a packet from the flow i already entered in the user flow management table, and the FIN flag or the RST flag is set, the flow management means is requested to update the T_last_i and the B_i. Is what
The flow management means updates the T_last_i and the B_i of the user flow management table according to the request from the packet header matching means, and deletes the flow i.
The TCP flow communication quality estimation device, wherein the flow statistical information estimation means calculates a flow rate R_i based on an update of T_last_i and B_i of the user flow management table. In the TCP flow communication quality estimation apparatus according to claim 1,
The user flow management table stores, for each flow, a time T_first_i at which the packet from the flow i first arrived, a time T_last_i at which the packet last arrived, and a total number B_i of transferred packet bytes.
The request from the packet header analysis means is a request for newly entering the user flow i to which the packet belongs in the user flow management table, setting T_first_i to the current time, T_last_i to the current time, and B_i to the packet size. ,
The request from the packet header verification means is a request to update the T_last_i for the packet at the current time and to update the B_i to B_i + the packet size.
The flow statistic information estimation means creates a distribution relating to the flow size B using B_i (i = 1 to the number of entered flows) and sets the flow size S_i of the flow i to B_i for each predetermined period. Thus, a TCP flow communication quality estimation apparatus, which estimates the flow size distribution of the entire original flow. In the TCP flow communication quality estimation apparatus according to claim 1,
The user flow management table stores, for each flow, a time T_first_i at which the packet from the flow i first arrived, a time T_last_i at which the packet last arrived, and a total number B_i of transferred packet bytes.
The request from the packet header analysis means is a request for newly entering the user flow i to which the packet belongs in the user flow management table, setting T_first_i to the current time, T_last_i to the current time, and B_i to the packet size. ,
The request from the packet header verification means is a request to update the T_last_i for the packet at the current time and to update the B_i to B_i + the packet size.
The flow statistic information estimating means excludes the flow i from the entry of the user flow management table if T_last_i = T_first_i, and is entered in the user flow management table if T_last_i> T_first_i. The flow duration T_i of the flow i is calculated as T_i = (T_last_i−T_first_i), and a distribution regarding the flow duration T is created using the T_i (i = 1 to the number of entered flows). A TCP flow communication quality estimation device characterized by estimating the flow duration distribution of the entire original flow. A TCP flow communication quality estimation device for estimating the communication quality of a TCP flow via a link in a communication network,
Flow management means for managing a user flow management table for registering user flow information of received flows;
When the packet header information of the received packet is compared with the user flow information registered in the user flow management table, and the received packet belongs to the flow registered in the user flow management table, the user flow When requesting the flow management means managing the management table to update the user flow information and when the received packet does not belong to the flow registered in the user flow management table, the packet header is described later. A packet header verification means for transferring to the analysis means;
When the packet header information of the transferred packet is read and the SYN flag indicating the start of TCP communication is set, one packet is extracted from the N packets, and there is a vacancy in the user flow management table. Packet header analysis means for requesting the flow management means to register a new entry in the user flow management table with packet header information defining the arrival time of the packet and from which user flow the packet is,
A flow management means for receiving a request from the packet header verification means and the packet header analysis means and executing the request;
A TCP flow communication quality estimation device comprising: flow statistical information estimation means for estimating the TCP flow communication quality of the entire flow passing through the link using the flow information entered in the user flow management table . In the TCP flow communication quality estimation apparatus according to any one of claims 1 to 6,
When the packet header analysis means determines that there is no space in the user flow management table, one of the user flows already entered is selected, the flow information is cleared, and a new entry is made there. A TCP flow communication quality estimation apparatus characterized by the above. In the TCP flow communication quality estimation method for estimating the communication quality of a TCP flow via a certain link in a communication network,
If one packet is extracted from N arrival packets, the packet header is read, the SYN flag indicating the start of TCP communication is set, and the user flow management table prepared in advance has a vacancy, the packet Registering a new entry in the user flow management table with packet header information that defines the arrival time and from which user flow the packet is,
Independent of extracting one packet out of every N packets, every time a packet arrives, it is checked whether there is a packet from a user flow that has already been entered in the user flow management table. The packet header information is read, and the user flow i information in the user flow management table is updated, and
And a step of estimating the TCP flow communication quality of the entire flow via the link using the flow information entered in the user flow management table after continuing the processing of the above two steps for a certain period. A characteristic TCP flow communication quality estimation method. A TCP flow communication quality estimation program for causing a computer to execute a TCP flow communication quality estimation method for estimating communication quality of a TCP flow passing through a certain link in a communication network,
A TCP flow communication quality estimation program for causing a computer to function as each means in the TCP flow communication quality estimation apparatus according to any one of claims 1 to 7.

Images