JP2005110038A - Congestion detecting device, and method for detecting congestion of tcp traffic, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To specify a congestion part in a backbone network and an access network by the measurement result of a quality parameter related to the retransmission of TCP (transmission control protocol) communication different in congestion places of a network. <P>SOLUTION: This congestion detecting device specifies a congestion place in the backbone network and the access network by a quality parameter measuring means for monitoring data transmitted from one terminal to the other terminal and measuring a quality parameter related to retransmission of TCP communication, a statistic processing means for performing the statistic processing of the measurement result on the basis of an occurrence period and an occurrence frequency and an access network congestion detecting means for detecting the congestion of a transmitting side access network or a receiving side access network on the basis of the result of the statistic processing. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an Internet failure detection technique for constantly grasping the current Internet state by constantly measuring user traffic on the Internet, and for efficiently detecting congestion, network failure, etc., and identifying the location and cause. Belonging to the field.

Conventionally, as a method of measuring quality related to user traffic on the Internet, a method of monitoring packet data transmitted from a transmission side terminal by a monitor and measuring IP traffic passively, There is known a method in which a tester is attached and a test packet is actively transmitted and received (see, for example, Non-Patent Document 1).
“A Bottleneck Identification Method Based on Measurements on the Internet” Hitotsubashi, Shingo Ata, Masayuki Murata, The Institute of Electronics, Information and Communication Engineers, Telecommunications Management Study Group, p65-70, November 2000.

However, the above passive measurement usually measures the IP traffic volume by monitoring a single line on the Internet, and the congestion of the line is determined by the IP address header information based on the IP address header information. Various statistical analyzes are carried out by different tabulations. However, according to such a method, it is difficult to acquire quality information of upper layers such as TCP and route information on the network.
On the other hand, active measurement is realized by sending and receiving test packets in which ICMP and UDP-based time information, transmission sequence numbers, and the like are transmitted and received by testers installed at two points on the Internet.
For this reason, by transmitting such test packets periodically, highly accurate measurement can be realized, but a large number of test packets are transmitted over the Internet, which itself causes a problem of congestion.

  Therefore, the present invention has been made in view of the above-described problems, and uses the measurement results of quality parameters related to retransmission of TCP communication in which the congestion location of the network is different, so that the congestion location in the backbone network or the access network. It is an object of the present invention to provide a congestion detection apparatus, a TCP traffic congestion detection method, and a program that can be easily specified.

In order to solve the above-mentioned problems, the present invention proposes as follows.
The invention according to claim 1 is a network including a plurality of Internet service providers connected to the Internet exchange and a plurality of terminals connected to the Internet service provider via a high-speed access network. Quality parameter measuring means for monitoring data transmitted to the terminal of the terminal and measuring quality parameters related to retransmission of TCP communication, statistical processing means for statistically processing the measurement result according to the occurrence interval and occurrence frequency, and the statistical processing Based on the result of the above, a congestion detection device is proposed which has an access network congestion detection means for detecting congestion of the transmission side access network or the reception side access network.

  According to a fifth aspect of the present invention, there is provided a network including a plurality of Internet service providers connected to the Internet exchange, and a plurality of terminals connected to the Internet service provider via a high-speed access network. A step of monitoring data transmitted to other terminals, measuring a quality parameter related to retransmission of TCP communication, a step of statistically processing the measured data according to an occurrence interval and an occurrence frequency, and a result of the statistical processing And a congestion detection method for TCP traffic, characterized in that it comprises a step of detecting congestion of a transmission side access network or a reception side access network.

  According to a ninth aspect of the present invention, there is provided a network including a plurality of Internet service providers connected to the Internet exchange and a plurality of terminals connected to the Internet service provider via a high-speed access network. A step of monitoring data transmitted to other terminals, measuring a quality parameter related to retransmission of TCP communication, a step of statistically processing the measured data according to an occurrence interval and an occurrence frequency, and a result of the statistical processing Based on this, a program for executing a step of detecting congestion of a transmission side access network or a reception side access network is proposed.

  According to these inventions, the transmission packet of the transmission side terminal is monitored, and the measurement result of the quality parameter related to the retransmission of the TCP communication is statistically processed according to the occurrence interval and the occurrence frequency. Alternatively, it is possible to detect which of the receiving access networks is congested.

  The invention according to claim 2 is the congestion detection apparatus according to claim 1, wherein the quality parameter related to retransmission of the TCP communication is at least one of the number of consecutive packet discards, the number of consecutive packets, the packet discard interval, and the packet retransmission interval. The congestion detection apparatus characterized by including two is proposed.

  The invention according to claim 6 is the TCP traffic congestion detection method according to claim 5, wherein the quality parameters related to retransmission of the TCP communication are the number of consecutive packet discards, the number of consecutive packets, the packet discard interval, and the packet retransmission interval. A TCP traffic congestion detection method characterized by including at least one of them is proposed.

  According to a tenth aspect of the present invention, in the program according to the ninth aspect, the quality parameter related to the retransmission of the TCP communication is at least one of a continuous packet discard number, a continuous packet number, a packet discard interval, and a packet retransmission interval A program characterized by inclusion is proposed.

  According to these inventions, at least one of the data regarding the number of consecutive packet discards, the number of consecutive packets, the packet discard interval, and the packet retransmission interval is preferable for the quality parameter related to retransmission of TCP communication to specify network congestion. Since it is included, network congestion can be easily identified. These data may be used alone, or a plurality of data may be used in combination as appropriate.

  According to a third aspect of the present invention, in the congestion detection apparatus according to the first aspect, a delay fluctuation detecting means for detecting a delay fluctuation of test packet data transmitted from the one terminal to another terminal, and packet data A congestion detection apparatus has been proposed which includes a throughput detection means for detecting the throughput of the network, and a backbone network congestion detection means for detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput.

  According to a seventh aspect of the present invention, there is provided the TCP traffic congestion detection method according to the fifth aspect, wherein a delay fluctuation of test packet data transmitted from the first terminal to another terminal is detected; A method for detecting congestion of TCP traffic, further comprising a step of detecting the throughput of the network, and a step of detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput. .

  According to an eleventh aspect of the invention, in the program according to the ninth aspect, a step of detecting a delay fluctuation of test packet data transmitted from the one terminal to another terminal and a throughput of the packet data are detected. There is proposed a program characterized by further comprising a step and a step of detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput.

  According to these inventions, since the delay fluctuation of the test packet data and the throughput of the packet data are detected, not only the congestion of the transmission / reception access network but also the congestion of the backbone network can be detected.

  According to a fourth aspect of the present invention, there is provided a congestion detection device according to the third aspect, wherein a transmission path detecting means for detecting a plurality of transmission paths based on the IP addresses of the one terminal and the other terminals, and the detection Based on the detected transmission path and the detection results of the access network congestion detection means and the backbone network congestion detection means, a congestion location specifying means for specifying the congestion location, and a notification means for notifying the network administrator of the specified congestion location Has been proposed.

  The invention according to claim 8 is the TCP traffic congestion detection method according to claim 7, wherein a plurality of transmission paths are detected based on the IP addresses of the first terminal and the other terminals, and the detection And a step of identifying a congestion location based on the detected transmission path and the detection results of the access network congestion and the backbone network congestion, and notifying the network administrator of the identified congestion location. A TCP traffic congestion detection method is proposed.

  According to a twelfth aspect of the present invention, in the program according to the eleventh aspect, a step of detecting a plurality of transmission paths based on IP addresses of the one terminal and the other terminals, and the detected transmission paths Proposing a program characterized by further comprising the step of identifying a congestion location based on the detection result of the access network congestion and the backbone network congestion, and notifying the network administrator of the identified congestion location doing.

  According to these inventions, since a plurality of transmission paths can be detected based on the IP address of the terminal, it can be used on the network by using together with the detection results of the access network congestion detection means and the backbone network congestion detection means. Can be easily identified. In addition, since the notification means is provided, information can be promptly notified to an appropriate network administrator according to the congestion location on the network.

According to the present invention, there is an effect that it is possible to easily realize the separation of the congestion location in the backbone network or the access network using the measurement result of the quality parameter related to the retransmission of the TCP communication in which the congestion location of the network is different.
In addition, according to the present invention, there is an effect that Internet quality comparison / deterioration of a deteriorated part can be performed in a scalable manner.

  Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS.

  As shown in FIG. 1, the network according to the present invention includes an Internet exchange (IX) 1 that connects Internet service providers (ISPs), a plurality of Internet service providers (ISPs) 2a, 2b, and 2c, and a plurality of Internet service providers. (ISP) 2a, 2b, 2c and optical access networks 3a, 3b, which are high-speed access networks for connecting clients, and clients (terminals) 4a, 4b. The high-speed access network is not limited to the optical access network, but may be another access network.

  As shown in FIG. 3, the congestion detection apparatus according to the present invention includes a traffic monitor 11, a quality parameter measurement unit 12, a statistical processing unit 13, a congestion network detection unit 14, a transmission path detection unit 15, and a congestion location. The detection unit 16, the notification unit 17, the fluctuation detection unit 21, the transmission packet detection unit 22, the reception packet detection unit 23, the throughput detection unit 24, and the congestion state determination unit 25 are configured.

  In FIG. 1, assuming that the traffic monitor 11 transmits a packet from the client (terminal) 4a to the client (terminal) 4b, the traffic monitor 11 sends a transmission packet on the client (terminal) 4a side or a received packet on the client (terminal) 4b side. Monitor. The quality parameter measurement unit 12 can measure at one point, such as the TCP sequence number (sequence number) monitored by the traffic monitor 11 and the arrival time of each TCP packet (which may simulate a normal traffic packet). Using this information, a file describing quality parameters related to the following retransmission is derived.

The file describing the quality parameters includes a continuous packet discard number list file, a continuous packet number list file, a discard interval list file, a retransmission interval list file, and the like. Among these, the continuous packet discard number and the retransmission interval are collected by the traffic monitor 11 on the reception side, and the continuous packet number and the discard interval are collected by the traffic monitor 11 on the transmission side. The continuous packet discard number list file outputs the number of consecutive discarded packets and the frequency of occurrence thereof as a result. The determination as to whether or not the discarded packets are continuous is based on the value Δt calculated from the average TCP throughput and the packet size in the measurement period as shown in the equation (1), and when the packet interval is estimated to be smaller than Δt. Judged to be continuous. Packet discard is determined by the continuity of the TCP sequence number, and the result is output separately for each set of transmission / reception IP addresses.
Δt = packet size (byte) / average TCP throughput (byte) (1)

  The continuous packet number list file outputs, as a result, the number of continuous packets of target traffic defined by a set of transmission / reception IP addresses and the frequency of occurrence thereof. The continuous determination method is the same as in the case of the continuous packet discard number list file. The discard interval list file outputs, as a result, the discard packet generation interval and the frequency of occurrence of the target communication defined by the set of transmission / reception IP addresses. The detection of the discarded packets is performed by the lack of the TCP sequence number, and the generation interval of the discarded packets is also obtained based on this sequence number. The retransmission interval list file outputs, as a result, the occurrence interval and occurrence frequency of TCP retransmission in the target communication defined by the set of transmission / reception IP addresses. The detection of TCP retransmission is performed by duplication of the TCP sequence number, and the retransmission interval is also performed based on this sequence number.

  The statistical processing unit 13 generates a histogram related to the occurrence interval and occurrence frequency as shown in FIG. 2 for the data for each quality parameter collected by the quality parameter measurement unit 12. The congestion network detection unit 14 determines whether the congested network is the transmission side access network or the reception side access network from the statistically processed quality parameter data. That is, congestion is detected and a congestion location is identified from one of the TCP parameters created by the statistical processing unit 13 or characteristics of a plurality of histogram profiles.

  A specific determination example will be described with reference to FIG. FIG. 2 shows the correspondence between the profile characteristics of the retransmission interval list file measured by the quality parameter measurement unit and the congestion location corresponding to the characteristics. FIG. 2 (1) shows the characteristics of the transmission side access network. 2 (2) indicates the characteristics of the receiving side access network. According to this, when two characteristic peaks occur due to bursty retransmission of adjacent segments and the interval between the bursty retransmission and the next bursty retransmission, it is estimated that congestion has occurred in the transmission side access network. Is done. In addition, when TCP packets are retransmitted but there is no such feature and TCP segment retransmissions occur more frequently than usual (see Fig. 2 (2)), the receiving side It is estimated that congestion occurred in the access network.

  The transmission route detection unit 15 detects a plurality of routes set between transmission / reception IP addresses by a method such as Traceroute, for example. The congestion point detection unit 16 inputs detection results from the congestion network detection unit 14 and the communication path detection unit 15 and identifies the congestion point. The identified congestion location is output to the notification unit 17, and the notification unit 17 notifies the administrator of this information according to the identified location.

  The transmission packet transmission unit 22 monitors packets transmitted at a constant interval T1, and the reception packet detection unit monitors received packets. The fluctuation detection unit 21 sets Tmin as the minimum value of the time series Tseq (i) of T1-T2 values from the reception interval T2 and transmission interval T1 of the packets received by the reception packet detection unit 25, and Tseq (i) -Tmin. Calculate the variance of the values of. The throughput detector 24 detects the network throughput from the transmitted and received packets.

  Based on the results of the fluctuation detection unit 21 and the throughput detection unit 24, the congestion state determination unit 25 has a dispersion result larger than the normal value and a low TCP throughput (the time transition of the TCP packet sequence number is slow). ), It is estimated that congestion occurs in the backbone network. In the case of the backbone network, this method is used because TCP packets are queued in the transmission buffer in the backbone node, so that the absolute number of TCP retransmission segments is reduced, and the congestion detection method in the transmission / reception access network is used. This is because they cannot.

Next, a processing procedure will be described with reference to FIG.
When the measurement is started, the traffic monitor 11 and the quality parameter measurement unit perform the TCP retransmission control related parameters (for example, the number of consecutive packet discards, the number of continuous packets) for the TCP traffic flowing from the transmission side to the reception side specified by the source and destination IP addresses. The number of packets, discard interval, retransmission interval, etc.) are constantly monitored and measured (step 101).

  The fluctuation detection unit 21 and the throughput detection unit 24 measure the reception side arrival interval T2 of the TCP test packet transmitted at a constant time interval T1 from the transmission side to the reception side (step 102). At this time, the transmission path detector 15 is activated to detect the transmission path.

  At this time, if there is a deterioration in the increase of the TCP sequence number (sequence number) within a certain time (step 103), a histogram of TCP retransmission control related parameters measured by the statistical processing unit 13 within the same certain time is created (step 103). Step 104). On the other hand, when there is no deterioration in the increase of the TCP sequence number (sequence number) within a predetermined time, the process returns to step 101 to monitor and measure the parameters related to TCP retransmission control.

  When the congestion network detection unit 14 determines that the created histogram matches the profile at the time of congestion on the transmission side access network, this information is derived from the result of the transmission path detecting the node list corresponding to the transmission side access network. Is presented to the network administrator through the notification unit 17, and the process returns to Step 101 (Step 109).

  On the other hand, when the congestion network detection unit 14 determines that the created histogram does not match the profile at the time of congestion on the transmission side access network, it is determined whether the created histogram matches the profile at the time of congestion on the reception side access network. The network detection unit 14 determines (step 106). As a result, when it is determined that they match, the node list corresponding to the access network on the receiving side is derived from the result of the detected transmission path, this information is presented to the network administrator through the notification unit 17, and the process returns to step 101. (Step 110).

  On the other hand, when the congestion network detection unit 14 determines that the created histogram does not match the profile at the time of congestion on the receiving side access network, the fluctuation detection unit 21 next performs delay fluctuation from T2 measured within the same fixed time. The value is calculated and quantified based on the variance of T1-T2 and the standard deviation (step 107).

  Next, it is determined whether or not the delay fluctuation value is greatly increased as compared with the normal time, and when it is determined that the delay fluctuation value is greatly increased, the result of the transmission path detecting the node list corresponding to the backbone network is determined. Derived, and presents this information to the network manager through the notification unit 17 and returns to step 101 (step 111).

  On the other hand, when it is determined that there is no significant increase, it is presented to the network operator as TCP throughput deterioration of unknown cause, and the process returns to step 101 (step 112). The series of operations described above are continuously executed, but the measurement is terminated when there is an asynchronous termination command from the network operator.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to these embodiments, and includes design changes and the like without departing from the gist of the present invention. .

1 is a network configuration diagram according to the present invention. FIG. It is a distribution map of the TCP retransmission segment generation interval. It is a block diagram of the congestion detection apparatus which concerns on this invention. It is the flowchart which showed the processing procedure of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Internet exchange (IX), 2a, 2b, 2c ... Internet service provider (ISP), 3a, 3b ... Optical access NW (network), 4a, 4b ... Client (terminal), 11 ... Traffic monitor, 12 ... Quality parameter measurement unit, 13 ... Statistical processing unit, 14 ... Congestion network detection unit, 15 ... Transmission path detection unit, 16 ... Congestion location detection unit, 17 ... notification unit, 21 ... fluctuation detection unit, 22 ... transmission packet detection unit, 23 ... reception packet detection unit, 24 ... throughput detection unit, 25 ... congestion state determination unit,

Claims (12)

In a network composed of a plurality of Internet service providers connected to the Internet exchange and a plurality of terminals connected to the Internet service provider via a high-speed access network,
Quality parameter measuring means for monitoring data transmitted from one terminal to another terminal and measuring quality parameters related to retransmission of TCP communication;
A statistical processing means for statistically processing the measurement result according to an occurrence interval and an occurrence frequency;
An access network congestion detection means for detecting congestion of a transmission side access network or a reception side access network based on a result of the statistical processing, and a congestion detection device. The congestion detection apparatus according to claim 1, wherein the quality parameter related to retransmission of the TCP communication includes at least one of a continuous packet discard number, a continuous packet number, a packet discard interval, and a packet retransmission interval. Delay fluctuation detecting means for detecting delay fluctuation of test packet data transmitted from the one terminal to another terminal;
Throughput detection means for detecting the throughput of packet data;
2. The congestion detection apparatus according to claim 1, further comprising backbone network congestion detection means for detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput. Transmission path detection means for detecting a plurality of transmission paths based on the IP addresses of the one terminal and the other terminals;
Based on the detected transmission path and the detection results of the access network congestion detection means and the backbone network congestion detection means, a congestion location specifying means for specifying a congestion location;
The congestion detection apparatus according to claim 3, further comprising notification means for notifying a network administrator of the identified congestion location. In a network composed of a plurality of Internet service providers connected to the Internet exchange and a plurality of terminals connected to the Internet service provider via a high-speed access network,
Monitoring data transmitted from one terminal to another terminal and measuring quality parameters related to retransmission of TCP communication;
Statistically processing the measured data according to the occurrence interval and occurrence frequency;
A congestion detection method for TCP traffic, comprising: detecting congestion of a transmission side access network or a reception side access network based on a result of the statistical processing. 6. The congestion detection of TCP traffic according to claim 5, wherein the quality parameter related to retransmission of the TCP communication includes at least one of a continuous packet discard number, a continuous packet number, a packet discard interval, and a packet retransmission interval. Method. Detecting a delay fluctuation of test packet data transmitted from the one terminal to another terminal;
Detecting packet data throughput;
The TCP traffic congestion detection method according to claim 5, further comprising a step of detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput. Detecting a plurality of transmission paths based on the IP addresses of the one terminal and another terminal;
Identifying a congestion location based on the detected transmission path and the detection results of the access network congestion and the backbone network congestion;
The TCP traffic congestion detection method according to claim 7, further comprising a step of notifying the network administrator of the identified congestion location. In a network composed of a plurality of Internet service providers connected to the Internet exchange and a plurality of terminals connected to the Internet service provider via a high-speed access network,
Monitoring data transmitted from one terminal to another terminal and measuring quality parameters relating to retransmission of TCP communication;
Statistically processing the measured data according to the occurrence interval and occurrence frequency;
A program for executing a step of detecting congestion of a transmission side access network or a reception side access network based on a result of the statistical processing. The program according to claim 9, wherein the quality parameter related to retransmission of the TCP communication includes at least one of a continuous packet discard number, a continuous packet number, a packet discard interval, and a packet retransmission interval. Detecting a delay fluctuation of test packet data transmitted from the one terminal to another terminal;
Detecting packet data throughput;
10. The program according to claim 9, further comprising a step of detecting traffic congestion in the backbone network based on the detected delay fluctuation and throughput. Detecting a plurality of transmission paths based on the IP addresses of the one terminal and another terminal;
Identifying a congestion location based on the detected transmission path and the detection results of the access network congestion and the backbone network congestion;
12. The program according to claim 11, further comprising a step of notifying the network administrator of the identified congestion point.

Images