JP2015070519A - Network monitoring device, network monitoring system, network monitoring method, and network monitoring program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network monitoring device and the like capable of efficiently monitoring a network.SOLUTION: A network monitoring device (for example, capture device 21) comprises a failure determination unit for performing failure determination for each kind of messages (for example, a combination of IE types) on the basis of information on a request message and response message transmitted in a section between two communication devices (for example, MME device 2 and SGW device 4) configuring a network (for example, LTE network).

Description

  The present invention relates to a network monitoring device, a network monitoring system, a network monitoring method, and a network monitoring program.

  Patent Document 1 proposes a network quality monitoring device and a network quality monitoring method for SIP (Session Initiation Protocol) networks (see Patent Document 1). Specifically, after capturing and collecting SIP signaling messages in capture devices installed at multiple locations in the SIP network, the response time from request transmission to response reception or the number of request retransmissions is obtained for each capture section. A technique for determining that an abnormality has occurred in a corresponding section when an upper limit value that is determined to be abnormal is exceeded as a result of obtaining and statistically processing these values is proposed.

JP 2008-193482 A

3GPP TS 29.274 V11.7.0, June 2013

However, in the prior art as described above, since the request message flowing through the monitoring section is used for failure determination in the corresponding section, it is necessary to install a capture device for each section to be monitored, which is enormous in constructing a monitoring environment. There was a problem that costs were incurred.
For example, it is considered that the network quality monitoring apparatus and the network quality monitoring method proposed in Patent Document 1 are not limited to the SIP network but can be applied to an LTE (Long Term Evolution) network. In particular, the communication carrier that constructs and operates a large-scale LTE network has the above-described problems when applying the conventional technology as described above.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a network monitoring device, a network monitoring system, a network monitoring method, and a network monitoring program that can efficiently monitor a network. .

  (1) In order to solve the above-described problem, a network monitoring apparatus according to an aspect of the present invention is based on information on a request message and a response message that transmit a section between two communication apparatuses constituting a network. A failure determination unit for determining a failure for each message type is provided.

  (2) According to one aspect of the present invention, in the network monitoring device according to (1) described above, the message includes one or more types of information, and the type of the message includes the type of information The network monitoring apparatus includes a message analysis unit that identifies a combination of types of information included in the received message, and the failure determination unit includes a combination of types of information specified by the message analysis unit. A configuration may be used in which a failure is determined for each type of message corresponding to.

  (3) One aspect of the present invention is the network monitoring device according to any one of (1) or (2) described above, wherein the network monitoring device includes a sequence number included in the request message and the sequence number A mapping unit that associates the request message with the response message based on a sequence number included in the response message; and the failure determination unit includes information on the request message and the response message associated with the mapping unit. Based on this, a configuration for determining a failure for each type of message may be used.

  (4) One aspect of the present invention is the network monitoring device according to (3) described above, wherein the network monitoring device measures a response time related to the request message and the response message associated by the mapping unit. A configuration may be used in which a response time measurement unit is provided, and the failure determination unit determines a failure for each message type based on the response time measured by the response time measurement unit.

  (5) One aspect of the present invention is the network monitoring device according to any one of (1) to (4) described above, wherein the failure determination unit is configured to store the request message for each message type. A configuration may be used in which a device that processes a request is specified, and the specified device or a section leading to the device is specified as a failure location.

  (6) In order to solve the above-described problem, a network monitoring system according to an aspect of the present invention transmits a section between a first communication device and a second communication device configuring a network. A receiving unit that receives a message and a second message, a message analysis unit that identifies a combination of types of information included in the first message received by the receiving unit, and a sequence number included in the first message And a mapping unit that associates the first message with the second message based on a sequence number included in the second message, and a database that stores information about the first message and the second message And the message based on information about the first message and the second message For each type of messages corresponding to a combination of the type of information specified by the analyzing unit comprises a fault determining unit for determining the fault, the.

  (7) In order to solve the above-described problem, in the network monitoring method according to one aspect of the present invention, the reception unit transmits a request message and a response message that transmit a section between two communication devices constituting the network. The failure determination unit receives the failure and determines a failure for each message type based on the information about the request message and the response message received by the reception unit.

  (8) In order to solve the above-described problem, a network monitoring program according to an aspect of the present invention includes a request message and a response message in which a failure determination unit transmits a section between two communication devices constituting a network. This is a program for causing a computer to execute the step of determining a failure for each type of message based on the information on the message.

  According to the present invention, a network can be efficiently monitored.

1 is a diagram illustrating a schematic configuration of a communication system according to an embodiment of the present invention. It is a block diagram which shows the structure of the capture apparatus which concerns on one Embodiment of this invention. It is a figure which shows the structure of the message which concerns on one Embodiment of this invention. It is a figure which shows an example of the response time which concerns on one Embodiment of this invention. It is a figure which shows the example of the different response time which concerns on one Embodiment of this invention. It is a figure which shows the example of several types of message which concerns on one Embodiment of this invention. It is a figure which shows the example of the apparatus corresponding to several types of message which concerns on one Embodiment of this invention. It is a flowchart figure which shows an example of the procedure of the process performed when a capture message which concerns on one Embodiment of this invention is received. It is a flowchart figure which shows an example of the procedure of the process performed when a response message is received in the capture apparatus which concerns on one Embodiment of this invention. It is a flowchart figure which shows an example of the procedure of the process performed at the time of a failure determination in the capture apparatus which concerns on one Embodiment of this invention. It is a block diagram which shows the structure of the capture device which concerns on the other structural example of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Outline of Communication System According to this Embodiment>
FIG. 1 is a diagram showing a schematic configuration of a communication system according to an embodiment of the present invention.
The communication system according to the present embodiment has a configuration in which a network monitoring device (capture device 21 in the present embodiment) is provided in an LTE network communication system.
The communication system according to the present embodiment includes a plurality (N in this embodiment) of base station devices (eNodeB) 1-1 to 1-N, an MME (Mobility Management Entity) device 2, and an HSS (Home Subscriber System). ) Device 3, SGW (Serving Gateway) device 4, multiple (in this embodiment, M) PGW (Packet data network Gateway) devices 5-1 to 5-M, and DNS (Domain Name System) server device 6, an authentication server device 7, other communication devices 8 to 10 (three are exemplified in the present embodiment), and a capture device 21.
Various apparatuses may be used as the communication apparatuses 8 to 10.

Here, the LTE network includes a radio network called eUTRAN (Evolved Universal Terrestrial Radio Network) and a core network called EPC (Evolved Packet Core).
eUTRAN is composed of only base station apparatuses 1-1 to 1-N.
The EPC includes a plurality of device groups such as the MME device 2, the HSS device 3, the SGW device 4, and the PGW devices 5-1 to 5-M.

  In the communication system according to the present embodiment, each base station apparatus 1-1 to 1-N and the MME apparatus 2 are connected. The MME device 2 and the HSS device 3 are connected. The MME device 2 and the SGW device 4 are connected, and a capture device 21 is provided between them. The SGW apparatus 4 is connected to each of the PGW apparatuses 5-1 to 5-M, the DNS server apparatus 6, and the authentication server apparatus 7. The PGW apparatus 5-1 and the communication apparatuses 8 to 10 are connected.

In the present embodiment, one device and another device are connected using a wired or wireless line, and one device and another device connected thereto are referred to as “section”. In the present embodiment, a capture device 21 is provided in a section between the MME device 2 and the SGW device 4.
In the communication system according to the present embodiment, one device (in this embodiment, as an example, the MME device 2) transmits a request message that is a message for making a predetermined request (request), and another device (this embodiment). In the form, as an example, the SGW device 4) is a message that responds to the request message by performing processing according to the request message request (including processing in the own device and processing for issuing a request to another device). Send a response message.
The configuration of the communication system illustrated in FIG. 1 is an example, and various configurations may be used as the arrangement and number of devices in the communication system.

<Outline of Capture Device According to this Embodiment>
FIG. 2 is a block diagram showing the configuration of the capture device 21 according to an embodiment of the present invention.
The capture device 21 according to the present embodiment includes a receiving unit 101 and a message processing unit 102.
The receiving unit 101 includes a request message receiving unit 111 and a response message receiving unit 112.
The message processing unit 102 includes a message analysis unit 121, a request message mapping unit 122, a message database 123, a response time measurement unit 124, and a failure determination unit 125.
For example, the receiving unit 101 is called an exporter, and the message processing unit 102 is called a collector.

<Outline of message according to this embodiment>
In this embodiment, the message is a message according to the standard of 3GPP TS 29.274 V11.7.0, and further a message according to GTPv2 (GPRS Tunneling Protocol version 2) related to GPRS (General Packet Radio Service) (for example, , Signaling message) is used as an example (see Non-Patent Document 1).
For example, packet communication is used as message communication.

FIG. 3 is a diagram showing a configuration of the message 201 according to an embodiment of the present invention.
In the present embodiment, the configuration of the message 201 is used as the configuration of the request message and the configuration of the response message.
In the frame of the message 201 according to the present embodiment, an L2 (Layer 2) header 211, an IP (Internet Protocol) header 212, a UDP (User Datagram Protocol) header 213, and a GTPv2 header 214 are arranged from the top of the frame, and subsequently. Thus, a combination of a type T (Type), a length (Length) L, and a value (Value) V is arranged for one or a plurality of n sets.

  In the example of FIG. 3, in the combination of the type T, the length L, and the value V in the message 201, first, T (1) that is the first type 215-1 and the first length 216-1. A certain L (1) and V (1) as the first value 217-1 are arranged, followed by the second and subsequent ones, and finally the nth type 215-n. T (n), L (n) that is the nth length 216-n, and V (n) that is the nth value 217-n are arranged. When n = 1, only the first one is arranged.

The message 201 includes a unique sequence number (for example, it may be substantially unique). The sequence number is included in the GTPv2 header 214, for example.
The sequence number of the request message matches the sequence number of the response message for the request message. That is, the response message includes the same sequence number as the sequence number included in the request message to be responded to. For one request message, for example, when a response is required, there is one response message. When a response is not required (only notification is required), the response message is Absent.

Information of the combination of type T, length L, and value V is information of IE (Information Element).
The type T specifies one of a plurality of types, for example, there are 150 types or more. As a specific example, as the IE type, it is defined that the first IE type is related to the International Mobile Subscriber Identity (IMSI) number, and the 71st IE type is related to the Access Point Name number. It is defined that the type of the 75th IE relates to the Mobile Equipment Identity number, and the types of IEs of other numbers are also defined (see Non-Patent Document 1). ).
The length L specifies the length of the value V and has, for example, a fixed length or a variable length.
The value V is an information string (for example, a character string).

One message 201 may include a plurality of pieces of information of combinations of type T, length L, and value V. That is, a plurality of IEs may be included in one message 201.
A message type is determined and specified for each IE or a combination of a plurality of IEs included in one message 201. The response time of the response message to the request message can be different because the device that processes the request for the request message, the processing content (for example, processing load), and the like can be different for each type of message.

In LTE, messages having different purposes may be defined by a message with the same name (in this embodiment, a request message or a response message), but in this embodiment, a combination of IEs (IE is 1). In each case, it is regarded as only one combination), and the message type is different and can be identified.
In LTE, a device that has received a request message issues a request to another device according to the content of the request, receives a response to the request, and transmits a response message. May communicate. This is a unique network configuration of LTE.

<Message transmission / reception and response time>
In the present embodiment, a capture device 21 is provided in a section between the MME device 2 and the SGW device 4, and the capture device 21 acquires a request message and a response message transmitted and received between the MME device 2 and the SGW device 4. By (capturing), the response time can be acquired (for example, calculated).

FIG. 4 is a diagram illustrating an example of a response time according to an embodiment of the present invention.
In the example of FIG. 4, the MME device 2 transmits a request message to the SGW device 4 (process ST1). The SGW device 4 receives the request message, performs processing according to the request (including processing in the device itself and processing for issuing a request to another device), and transmits a response message to the MME device 2. (Process ST2). The MME device 2 receives the response message.
In this case, for example, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is the response time T1.
Note that the response time start timing is not the timing at which the MME device 2 has transmitted the request message, but the timing at which the SGW device 4 has received the request message, or the timing between these transmissions and receptions, for example. May be. Similarly, as the end timing of the response time, for example, not the timing at which the MME device 2 receives the response message, but the timing at which the SGW device 4 transmits the response message, or the timing between these transmissions and receptions. May be used.

  As an example, when the terminal device is turned on by an operation performed by a user of a terminal device such as an LTE mobile phone (including a smartphone), the terminal device is initially connected to the LTE network. Will be connected to. In this case, the MME device 2 transmits a request message of a session establishment request (Create Session Request) to the SGW device 4, and the SGW device 4 that has received the request message performs necessary processing in response to the request. After that, a response message of a session establishment response (Create Session Response) is returned (transmitted) to the MME device 2.

In the LTE network, when the response time is calculated from the request message of the session establishment request transmitted by the MME device 2 and the response message of the session establishment response to which the SGW device 4 responds, the same SGW device as the same MME device 2 Even in the section between 4 (same section), the response time can be greatly different, for example, from several ms to several hundred ms.
This is because, for example, when the SGW device 4 performs processing only by its own device before the SGW device 4 returns a response message of the session establishment response to the request message of the session establishment request transmitted by the MME device 2, Alternatively, when a request message and a response message (which may be the same as or different from the original message) are transmitted and received in a section between the SGW apparatus 4 and another apparatus X, Alternatively, a request message and a response message (may be the same as or different from the original message) in a section between the SGW apparatus 4 and another apparatus Y (an apparatus different from the apparatus X). This is because transmission and reception may be performed. When transmission / reception of a request message and a response message is performed in a section between the SGW apparatus 4 and the other apparatuses X and Y, the SGW apparatus 4 transmits the response message to the MME apparatus 2 before returning the response message. It is necessary to wait for the time required for transmission and reception with X and Y.
The response time in the actual network can vary greatly depending on, for example, the number of other devices involved until the SGW device 4 responds and the processing content.

FIG. 5 is a diagram illustrating examples of different response times according to an embodiment of the present invention.
In one example in FIG. 5, the MME device 2 transmits a request message to the SGW device 4 (process ST11). The SGW apparatus 4 receives the request message, and sends a request message (which may be the same as or different from the received message) to the PGW apparatus 5-1 as a process according to the request. Transmit (process ST12). The PGW apparatus 5-1 receives the request message, performs a process corresponding to the request by itself, and transmits a response message to the SGW apparatus 4 (process ST13). The SGW apparatus 4 receives the response message and transmits a response message (which may be the same as or different from the received message) to the MME apparatus 2 (process ST14).
In this case, for example, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is the response time T11.

In another example in FIG. 5, the MME device 2 transmits a request message to the SGW device 4 (process ST21). The SGW apparatus 4 receives the request message and transmits a request message (which may be the same as or different from the received message) to the authentication server apparatus 7 as a process corresponding to the request. (Processing ST22). The authentication server device 7 receives the request message, performs a process corresponding to the request by itself, and transmits a response message to the SGW device 4 (process ST23). The SGW apparatus 4 receives the response message and transmits a response message (which may be the same as or different from the received message) to the MME apparatus 2 (process ST24).
In this case, for example, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is the response time T12.

Here, the SGW apparatus 4 may perform the process according to the request of the received request message in its own apparatus. In this case, the MME device 2 transmits a request message to the SGW device 4, and the SGW device 4 receives the request message, performs a process according to the request by itself, and sends a response message to the MME device 2. Send to.
Further, in the example of FIG. 5, a configuration according to a request is performed in another device (PGW device 5-1 or authentication server device 7) directly connected to the SGW device 4 that has received the request message from the MME device 2. However, as another configuration example, a configuration that performs processing according to a request in a device connected to the SGW device 4 that has received the request message via another device may be used. A configuration in which processing according to a request is performed in a plurality of apparatuses may be used.

Regarding processing in response to a request message request, the device that performs the processing (routed device) and the content of the processing differ depending on the content of the request message.
In this embodiment, the type of message varies depending on the number and type of IEs carried in GTPv2. Therefore, in this embodiment, each IE type carried by the request message is analyzed, a group of request messages having the same combination of IE types is clustered (classified), and such a group (combination of IE types). Each time, the response time is aggregated and statistically processed, or an individual threshold value is set for the response time.
Normally, the number of combinations of IE types is finite.

FIG. 6 is a diagram illustrating an example of a plurality of types of messages according to an embodiment of the present invention.
The example of FIG. 6 shows an example of three types of messages (request message and response message pairs) that carry combinations of different IE types.
The first (first type) message carries the type of the first IE and the type of the 77th IE, and the response time is 1 ms.
The second (second type) message carries the first IE type and the 78th IE type, and the response time is 10 ms.
The third (third type) message carries the first IE type and the 80th IE type, and the response time is 100 ms.

As an example, for each message type (in this embodiment, a combination of IE types), the response time can be aggregated for statistical processing.
As another example, a threshold corresponding to the response time can be set for each type of message (in this embodiment, a combination of IE types). For example, for the first (first type) message carrying the first IE type and the 77th IE type, a threshold of 10 ms is set for the response time, and the first IE type and the 78th IE type are set. For the second (second type) message carrying the type, a 60 ms threshold is set for the response time, and for the third (third type) message carrying the first IE type and the 80th IE type. A threshold of 150 ms is set for the response time.

In addition, for each message type, it is possible to determine the processing content of the message (for example, whether or not a message is transmitted to or received from another device).
As an example, information for identifying a device that has processed a request message request (in this embodiment, IP address information) is included in the value V of the corresponding IE in the response message for the request message. Based on the information, the device can be determined (specified).
As another example, for each message type (in this embodiment, a combination of IE types), an association (linkage) with a device that processes a message request is stored in advance. When a message is transmitted / received to / from a device, it is possible to determine (specify) the other device and a section leading to the device.
In the present embodiment, it becomes possible to determine a failure in another section with respect to the section including the capture device 21, and as a result, only by monitoring the section between the MME device 2 and the SGW device 4, It becomes possible to monitor faults over a wider area.

FIG. 7 is a diagram illustrating an example of an apparatus corresponding to a plurality of types of messages according to an embodiment of the present invention.
FIG. 7 shows three types of messages similar to those shown in FIG.
The first (first type) message carries the type of the first IE and the type of the 77th IE, and corresponds to the device X, assuming that the device X performs processing according to the request message request. It is attached. In addition, it is stored that the determination result regarding whether or not the response time has exceeded the threshold value is a determination result of “none (not exceeding)” (this determination and this result is one example).
The second (second type) message carries the type of the first IE and the type of the 78th IE, and the device Y (a device different from the device X) performs processing according to the request message request. Is associated with the device Y. Note that it is stored that the result of the determination as to whether or not the response time has exceeded the threshold value is a determination result of “present (exceeded)” (this determination and this result is one example).
The third (third type) message carries the type of the first IE and the type of the 80th IE, and performs processing corresponding to the request message request by a device different from the devices Z (devices X and Y). ) Is associated with the device Z. In addition, it is stored that the determination result regarding whether or not the response time has exceeded the threshold value is a determination result of “none (not exceeding)” (this determination and this result is one example).

As an example, for each same message type, statistical processing can be performed on the response time to determine the presence or absence of a failure. As a specific example, a moving average of response times is obtained for each type of message, and an outlier (a value that deviates from a predetermined moving average from a past moving average value) is searched, and an outlier falls within a predetermined time range. Can be determined that there is a failure when there is a predetermined number of times (one or more predetermined times). Also, variance can be used instead of moving average. Moreover, as an outlier, for example, an instantaneous value at the time of measurement can be used, or an average value of a plurality of instantaneous values close in time can be used.
As another example, a threshold is set for the response time for each message type, and it is determined that there is a failure when the time required for message response processing (in this embodiment, the response time) exceeds the threshold. be able to. As a threshold for the response time, for example, a fixed value is set in advance for each message type, or an average value of response times in a predetermined time range is obtained for each message type, and the average value is obtained. A value obtained by adding a predetermined value (for example, a positive value) to can be used as the threshold value.

Further, as an example, a device that processes a request message request is specified for each message type, and the specified device (or a section leading to the device) is a location of a failure (for example, presumptive Can be specified).
As a specific example, in the example of FIG. 7, when the devices linked by the respective message types (ie, combinations of IE types) are the devices X, Y, and Z, the response time of messages related to the device Y When a failure is determined for, it is possible to narrow down the corresponding device Y (or the section leading to the device Y) as the location of the failure.

<Outline of processing performed in capture device according to this embodiment>
An overview of processing performed in the capture device 21 according to the present embodiment is shown.
The request message receiving unit 111 receives a request message. In the present embodiment, the request message receiving unit 111 receives a request message transmitted from the MME device 2 to the SGW device 4.
The response message receiving unit 112 receives a response message. In the present embodiment, the response message receiving unit 112 receives a response message transmitted from the SGW device 4 to the MME device 2.

Here, as an example, the receiving unit 101 includes a switch (or may be referred to as a tap) connected between the MME device 2 and the SGW device 4, and a capture unit connected to the switch. Composed.
The switch relays a message (a request message or a response message in the present embodiment) transmitted between the MME device 2 and the SGW device 4. At this time, the signal of the i-th port (where i is an arbitrary integer) is mirrored to the j-th port (j is an arbitrary integer, for example, i−1 or i + 1) (the same signal is generated) and mirrored. The signal is acquired by the capture unit. This mirroring is only one way of acquiring.
A functional unit that acquires a request message by such mirroring corresponds to the request message receiving unit 111, and a functional unit that acquires a response message by such mirroring corresponds to the response message receiving unit 112.
Whether the message is a request message or a response message can be determined by the request message receiving unit 111 or the response message receiving unit 112 based on information included in the message header, for example. .

  The message analysis unit 121 analyzes the request message received by the request message reception unit 111. In the present embodiment, the message analysis unit 121 includes the request message received by the request message reception unit 111 in the reception time of the request message, the combination of IE types included in the request message, and the request message. The sequence number is analyzed and specified, and information about the request message is stored (stored) in the message database 123.

  The message database 123 stores information regarding request messages and response messages. In the present embodiment, the message database 123 includes information for specifying a combination of IE types, information for specifying a sequence number, information for specifying a reception time, and the like as information about a request message and a response message, Information specifying the message type (for example, “session establishment” or the like) is stored in association with each other. Here, the type of message is determined according to a combination of IE types.

  The request message mapping unit 122 associates (maps) the response message received by the response message receiving unit 112 with the request message. In the present embodiment, the request message mapping unit 122 analyzes and identifies the response message received by the response message receiving unit 112 by analyzing the reception time of the response message and the sequence number included in the response message, and the message database Information related to the response message is stored (stored) in the message database 123 in association with the request message having the same sequence number included in the stored content of 123.

Note that the combination of IE types related to the response message and the type of message may be specified by, for example, the request message mapping unit 122 analyzing the response message, or the same information as the corresponding request message may be read and used. Also good.
As an example, the request message mapping unit 122 does not store the information about the response message in the message database 123 when the information about the request message corresponding to the response message is not stored in the message database 123. As another example, when the information about the request message corresponding to the response message is not stored in the message database 123, the request message mapping unit 122 sets the information about the response message to the message database 123 regardless of the request message. To remember.

The response time measurement unit 124 measures the response time of the response message with respect to the request message. In the present embodiment, the response time measurement unit 124 obtains a value obtained by subtracting the reception time of the request message from the reception time of the response message for the request message and the response message associated with each other (difference between these reception times). Is detected (measured) as a response time.
In this embodiment, the time from the timing at which the MME device 2 transmits the request message to the timing at which the MME device 2 receives the response message is used as an example of the response time. , Approximately the time from the timing of receiving the request message transmitted by the MME device 2 (request message reception time) to the timing of receiving the response message to the MME device 2 (response message reception time) It is regarded as response time. Note that other methods for acquiring the response time may be used.

The failure determination unit 125 determines a failure related to the network based on the response time measured by the response time measurement unit 124. In the present embodiment, as an example, the failure determination unit 125 aggregates the response times measured by the response time measurement unit 124 for each message type and performs statistical processing, thereby determining failure based on a moving average or the like. I do. As another example, the failure determination unit 125 determines a failure for the response time (for example, one measurement value) measured by the response time measurement unit 124 based on a threshold value determined for each type of message. Do. Also, other methods for determining a failure may be used.
Further, the failure determination unit 125 specifies the device (or the section leading up to the device) as the location of the failure by specifying the device associated with the type of message determined to have failed. be able to.

  Here, in the capture device 21 according to the present embodiment, a pair of request message and response message (in this embodiment, the sequence numbers match) are associated with each other, and information related to these messages is stored in the message database 123. Although the configuration is shown, as another configuration example, when information about a request message and information about a response message are separately stored in the message database 123 and a message is read from the message database 123 (for example, read by the response time measurement unit 124) In addition, a configuration for specifying a pair of a request message and a response message based on the sequence number may be used.

<Example of processing flow>
FIG. 8 is a flowchart illustrating an example of a procedure of processing performed when a request message is received by the capture device 21 according to an embodiment of the present invention.
When the request message reception unit 111 receives the request message (step S1), the message analysis unit 121 analyzes the received request message and analyzes the IE type and the like (step S2). Then, the message analysis unit 121 stores necessary information in the message database 123 (step S3). Thereby, this process is complete | finished.

FIG. 9 is a flowchart showing an example of a procedure of processing performed when a response message is received by the capture device 21 according to an embodiment of the present invention.
When the response message receiving unit 112 receives the response message (step S11), information about the request message (request message having the same sequence number in this embodiment) corresponding to the response message received by the request message mapping unit 122 is stored in the message database. It is determined and checked whether or not it is stored in 123 (presence / absence) (step S12).
As a result of this confirmation (step S12), if the response message receiving unit 112 determines that the information about the request message corresponding to the received response message is not stored in the message database 123, for example, the process ends. To do.

  On the other hand, as a result of the above confirmation (step S12), if the response message receiving unit 112 determines that information about the request message corresponding to the received response message is stored in the message database 123, necessary information Is stored in the message database 123 (step S13). Thereby, this process is complete | finished.

FIG. 10 is a flowchart showing an example of a procedure of processing performed at the time of failure determination in the capture device 21 according to an embodiment of the present invention.
The response time measuring unit 124 measures the response time for each message (in this embodiment, a combination of a request message and a response message) (step S21).
Then, the failure determination unit 125 determines a failure based on the measurement result (step S22). Thereby, this process is complete | finished.

Here, in this embodiment, the process at the time of failure determination shown in FIG. 10 is asynchronous and independent of the process at the time of receiving a request message shown in FIG. 8 and the process at the time of receiving a response message shown in FIG. (E.g. non-real time). For example, the processing at the time of failure determination shown in FIG. 10 can be performed at various timings such as a regular timing.
As another configuration example, the processing at the time of failure determination shown in FIG. 10 is synchronized with the processing at the time of receiving a request message shown in FIG. 8 and the processing at the time of receiving a response message shown in FIG. A configuration to be performed may be used. As an example, the processing flow of steps S21 to S22 shown in FIG. 10 is arranged immediately after the processing of step S13 shown in FIG. 9 (that is, performed in real time together with the processing flow shown in FIG. 9). It is also possible to use.

Here, in the capture device 21 according to the present embodiment, the request message is first received for the set of the request message and the response message, information about the request message is stored in the message database 123, and then the response message is stored. Although the operation of receiving and associating with the request message corresponding to the response message has been described, as another configuration example, the order of reception may be reversed. That is, for a set of request message and response message, the response message is received first, information about the response message is stored in the message database 123, and then the request message is received and the response corresponding to the request message is received. A configuration for associating with a message may be used.
In addition, various types of information such as the IE type related to the message may be acquired based on information included in the request message, or may be acquired based on information included in the response message, or It may be acquired based on information included in both the request message and the response message.

As described above, the capture device 21 in the communication system according to the present embodiment captures a request message and a response message in the LTE network, and sends a message for each combination of IE types (message types) carried in the request message. (For example, request message and response message) are clustered.
In the capture device 21 in the communication system according to the present embodiment, the response time is measured and statistically processed for a group of request messages and response messages clustered for each combination of IE types (message types). Determine the failure. Here, the statistical processing can be performed at various timings such as a regular timing.
Further, in the capture device 21 in the communication system according to the present embodiment, a device related to a message (for example, a device that performs processing according to a request message request) is associated with each combination of IE types (message type). If the response time threshold is exceeded, the location of the failure is narrowed down.

As described above, according to the capture device 21 in the communication system according to the present embodiment, for example, in the LTE network, a message (message flowing in the predetermined interval) captured by the capture device 21 installed in a predetermined interval is used. Thus, it is possible to detect a failure that occurs in another section. For this reason, it is possible to determine a failure in a wide range with a relatively small number of capture devices 21. Also, the failure determination can be performed with high accuracy by the capture device 21 compared to the case where the failure determination is performed only for the section where the capture device 21 is installed, for example. Thereby, for example, the quality of the network in the mobile network can be monitored.
Thus, according to the capture device 21 in the communication system according to the present embodiment, the network can be efficiently monitored.

  Here, in the capture device 21 according to the present embodiment, as a message (in this embodiment, a message transmitted / received in a section between the MME device 2 and the SGW device 4), a request message for a session establishment request and a session establishment response. Although the case where the response message is used is shown, various other messages may be used. As specific examples, a request message of a session release request (Delete Session Request) and a response message of a session release response (Delete Session Response) are used, and a request message and a bearer change response (Modify Bearer) of a bearer change request (Modify Bearer Request). (Response) response message can be used.

  In the capture device 21 according to the present embodiment, a configuration is shown in which a message that is provided between the MME device 2 and the SGW device 4 and that is transmitted and received in the section is captured. However, the transmission and reception is performed in various other sections. A configuration may be used that captures messages that are received. For example, the capture device 21 may be provided in various other sections, and may be configured to capture messages transmitted / received in the sections, and the base station apparatus (in this embodiment, the base station apparatus 1- 1-1-N) and the capture device 21 may be provided in a section between the MME device 2. The capture device 21 can capture a message transmitted / received in the section according to the section in which the capture device 21 is provided, and can determine a failure related to another section based on the captured message.

  In the present embodiment, the configuration of the capture device 21 including the reception unit 101 and the message processing unit 102 is shown. As another configuration example, the capture device 21 including the reception unit 101 but not including the message processing unit 102 is illustrated. In this case, the function of the message processing unit 102 is provided in a device other than the capture device 21 (corresponding to an example of a network monitoring device in this configuration example). This device (a device other than the capture device 21) may be provided in a section in which the capture device 21 is provided, or may be provided in any other place (for example, another section). Information related to a message transmitted after being received by the receiving unit 101 of the device 21 (may include information on the message itself) is received from the capture device 21 and processed.

  Further, in the present embodiment, a configuration in which the functions of the processing units 111 to 112 and 121 to 125 illustrated in FIG. 2 are provided in an integrated device (capture device 21 in the present embodiment) has been described. As an alternative, a configuration in which these functions are distributed to two or more devices may be used.

Further, in the present embodiment, the configuration in which the failure is determined based on the response time from the request message to the response message is shown for each message type, but the configuration in which the failure is determined based on other information is used. May be. As a specific example, when retransmitting a request message, it is possible to use a configuration in which a failure is determined based on the number of retransmissions. For example, the failure is replaced with the number of retransmissions instead of the response time in this embodiment. It is possible to make a determination.
In the present embodiment, an LTE network is shown, but the present invention may be applied to other various networks.

<An example of the effect of this embodiment with respect to a comparative example with this embodiment>
In addition, the example of the effect of this embodiment with respect to a comparative example with this embodiment is shown.
As a comparative example to this embodiment, after measuring the response time (or the number of retransmissions of the request message) from the transmission of the request message to the reception of the response message for each section to be monitored, In order to determine whether or not a failure has occurred, the response time (or the number of retransmissions) is uniformly determined using all the request messages and all the response messages that flow through the section between the MME device and the SGW device. Consider a measurement technique (a technique according to a comparative example).
In the technology according to the comparative example, in the capture device installed in the section between the MME device and the SGW device, a failure that affects all messages flowing in the corresponding section, that is, between the MME device and the SGW device. Only failures that occur in the section can be detected. As a specific example, in the technique according to the comparative example, three types of messages (for example, request message and response message) having different combinations of IE types are captured, and the reference value of the response time of each type of message is 1 ms, 10 ms. In this case, a threshold value (response time threshold value) such as 50 ms is set based on the average value of 37 (= 111/3) ms, for example, by these statistical processes. It is difficult to determine a failure suitable for each type, and it is difficult to determine a failure in another section.
On the other hand, in the present embodiment, it is possible to execute failure determination suitable for each type of message, and it is possible to perform failure determination in other sections, thus monitoring the network with high accuracy. can do.

<Capture device according to another configuration example>
FIG. 11 is a block diagram showing a configuration of a capture device 501 according to another configuration example of the present invention. In FIG. 11, the same components as those of the capture device 21 shown in FIG.
The capture device 501 according to this configuration example includes a receiving unit 601 and a message processing unit 602.
The receiving unit 601 includes a first message receiving unit 611 and a second message receiving unit 612.
The message processing unit 602 includes a message analysis unit 621, a message mapping unit 622, a message database 123, a response time measurement unit 124, and a failure determination unit 125.

With respect to the processing performed in the capture device 501 according to the present configuration example, a part different from the case of the capture device 21 shown in FIG. 2 will be mainly described.
The first message receiving unit 611 receives a message (request message or response message). Then, the first message receiver 611 outputs the received message to the message analyzer 621.
The second message receiving unit 612 receives a message (request message or response message). Then, the second message receiving unit 612 outputs the received message to the message mapping unit 622.
The message analysis unit 621 analyzes the message received by the first message reception unit 611. In this configuration example, the message analysis unit 621 has a processing function for analyzing a request message and a processing function for analyzing a response message.
The message mapping unit 622 associates (maps) the message received by the second message receiving unit 612 with the message received by the first message receiving unit 611.

In this configuration example, for example, when a request message and a response message corresponding to each other are received first by the first message receiving unit 611 and then the response message is received by the second message receiving unit 612 The message mapping unit 622 associates the response message with the corresponding request message already managed by the message database 123. Similarly, with respect to the request message and the response message corresponding to each other, when the response message is first received by the first message receiving unit 611 and then the request message is received by the second message receiving unit 612, the message The mapping unit 622 associates the request message with the corresponding response message already managed by the message database 123.
The request message and the response message are associated with each other based on the sequence number as in the case of the capture device 21 shown in FIG.

[Configuration example according to the above embodiment]
As one configuration example, a request message and a response message that transmit a section between two communication devices (in this embodiment, the MME device 2 and the SGW device 4) that configure a network (in this embodiment, an LTE network). Network monitoring device (in this embodiment, the capture device shown in FIG. 2) including a failure determination unit (in this embodiment, the failure determination unit 125) that performs failure determination for each message type based on the information about 21).

  As one configuration example, the message includes information of one or more types (in this embodiment, IE type). The message type is determined by a combination of the types of information. The network monitoring device includes a message analysis unit (in this embodiment, a message analysis unit 121) that identifies a combination of types of information included in a received message. The failure determination unit determines a failure for each message type corresponding to the combination of types of information specified by the message analysis unit.

  As one configuration example, the network monitoring device is configured to associate the request message with the response message based on the sequence number included in the request message and the sequence number included in the response message (in this embodiment, A request message mapping unit 122). The failure determination unit determines a failure for each type of message based on information on the request message and the response message associated by the mapping unit.

  As one configuration example, the network monitoring device includes a response time measurement unit (in this embodiment, a response time measurement unit 124) that measures a response time related to the request message and the response message associated by the mapping unit. . The failure determination unit determines a failure for each message type based on the response time measured by the response time measurement unit.

  As one configuration example, the failure determination unit is a device that processes the request message request (for example, PGW devices 5-1 to 5-M, DNS server device 6, authentication server) in each embodiment. The server device 7 and the communication devices 8 to 10 are identified, and the identified device (or the section leading to the device) is identified as the location of the failure.

  As a configuration example, a first transmission is performed in a section between a first communication device (MME device 2 in the present embodiment) and a second communication device (SGW device 4 in the present embodiment) configuring a network. And a second message (in this embodiment, a request message and a response message, in any order), a receiving unit (in this embodiment, a receiving unit 101), and a first message received by the receiving unit A message analysis unit that identifies a combination of types of information included in one message, the first message based on a sequence number included in the first message and a sequence number included in the second message; A mapping unit for associating the second message, and information related to the first message and the second message are stored Types of messages corresponding to combinations of types of information specified by the message analysis unit based on the database (in this embodiment, the message database 123) and information on the first message and the second message A network monitoring system (in this embodiment, a system having a function similar to that of the capture device 21 shown in FIG. 2).

  As one configuration example, the receiving unit receives a request message and a response message that transmit a section between two communication devices that form a network, and the failure determination unit receives the request message and the response that are received by the receiving unit. This is a network monitoring method (in this embodiment, a method performed by the capture device 21 shown in FIG. 2) in which a failure is determined for each message type based on information about the message.

  As an example of the configuration, a step in which a failure determination unit determines a failure for each message type based on information on a request message and a response message that transmit a section between two communication devices that constitute a network. A network monitoring program to be executed by a computer (in this embodiment, a program for executing processing performed by the capture device 21 shown in FIG. 2).

[Summary of the above embodiments]
As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the concrete structure is not restricted to this embodiment, The design change etc. of the range which does not deviate from the summary of this invention are included.

  Further, a program for realizing the function of each device (for example, the capture device 21) according to the above-described embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded on the computer. Processing may be performed by causing the system to read and execute.

The “computer system” herein may include hardware such as an operating system (OS) and peripheral devices.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM (Read Only Memory), a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disk), A storage device such as a hard disk built in a computer system.

Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (DRAM) inside a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Dynamic Random Access Memory)) that holds a program for a certain period of time is also included.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be for realizing a part of the functions described above. Further, the above program may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.

1-1 to 1-N: base station device, 2 ... MME device, 3 ... HSS device, 4 ... SGW device, 5-1 to 5-M ... PGW device, 6 ... DNS server device, 7 ... authentication server device, 8 to 10: Communication device, 21, 501 ... Capture device, 101, 601 ... Receiving unit, 102, 602 ... Message processing unit, 111 ... Request message receiving unit, 112 ... Response message receiving unit, 121, 621 ... Message analysis unit 122 ... request message mapping unit, 123 ... message database, 124 ... response time measurement unit, 125 ... failure determination unit, 201 ... message, 211 ... L2 header, 212 ... IP header, 213 ... UDP header, 214 ... GTPv2 header, 215-1 to 215-n ... IE type, 216-1 to 216-n ... IE length, 217- ~217-n ... IE Value, 611 ... first message receiving unit, 612 ... second message receiving unit, 622 ... message mapping unit

Claims (8)

A failure determination unit configured to determine a failure for each type of message based on information about a request message and a response message transmitted in a section between two communication devices constituting a network;
Network monitoring device. The message includes one or more types of information,
The message type is determined by a combination of the types of information,
The network monitoring device includes a message analysis unit that identifies a combination of types of information included in a received message,
The failure determination unit determines a failure for each type of message corresponding to a combination of types of information specified by the message analysis unit.
The network monitoring apparatus according to claim 1. The network monitoring device includes a mapping unit that associates the request message with the response message based on a sequence number included in the request message and a sequence number included in the response message,
The failure determination unit determines a failure for each type of message based on information on the request message and the response message associated by the mapping unit.
The network monitoring apparatus according to any one of claims 1 and 2. The network monitoring device includes a response time measuring unit that measures a response time related to the request message and the response message associated by the mapping unit,
The failure determination unit performs failure determination for each message type based on the response time measured by the response time measurement unit.
The network monitoring apparatus according to claim 3. The failure determination unit specifies, for each message type, a device that processes the request message request, and specifies that the specified device or a section leading to the device is a failure point.
The network monitoring device according to any one of claims 1 to 4. A receiving unit that receives a first message and a second message that transmit a section between a first communication device and a second communication device that form a network;
A message analysis unit for specifying a combination of types of information included in the first message received by the reception unit;
A mapping unit that associates the first message with the second message based on a sequence number included in the first message and a sequence number included in the second message;
A database for storing information relating to the first message and the second message;
A failure determination unit that determines a failure for each type of message corresponding to a combination of types of information specified by the message analysis unit, based on information about the first message and the second message;
A network monitoring system comprising: The receiving unit receives a request message and a response message that transmit a section between two communication devices constituting the network,
The failure determination unit performs failure determination for each type of message based on information on the request message and the response message received by the reception unit.
Network monitoring method. A step of determining a failure for each type of message based on information on a request message and a response message transmitted by a failure determination unit between two communication devices constituting a network;
Network monitoring program to be executed by a computer.

Images