JP2007243489A - Route variation determining device and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a route variation determining device for specifying an unstable route in Internet path control and quickly notify a source of the route for handling to contribute to stabilization of the Internet path control. <P>SOLUTION: The route variation determining device 30 identifies occurrence of route flap and its location, by extracting a message pattern characteristic to the route flap occurrence among BGP (border gateway protocol) route updating messages received from a plurality of BGP routers 40. Moreover, the device obtains the property of a receiving pattern of a BGP route updating message when the route flap occurs. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a path variation determination device and a computer program.

  As shown in FIG. 14, the Internet is a network configured by combining independent management units (AS100 to AS500) called autonomous systems (AS). Between ASs, network connectivity is maintained by exchanging route information using a route control protocol called BGP (Border Gateway Protocol). In BGP, the changed route information is notified to the adjacent BGP router by the BGP route update message only when the route information is changed. In BGP, when a destination (prefix) can be reached, or when a route attribute (such as an AS path) is changed, it is notified as an Announce message, and when the reachability to the prefix is lost, Withdraw It is notified as a message. Note that the change of the route information includes not only unstable route information generated due to a failure of the BGP router or the like, but also a notification of a normal route change caused by a setting change or the like.

  By the way, among unstable route information, there is a phenomenon called route fluctuation (route flap) that frequently repeats Announce and Withdraw of a route. When a route flap occurs, many BGP route update messages are propagated to each BGP router, which may cause an increase in the load on the BGP router and instability of route control of the entire Internet. Therefore, detecting route flaps is important for maintaining the stability of Internet routing.

  On the other hand, as a technique for suppressing an increase in BGP route update messages due to route flaps, there is a technique called route flap damping (see, for example, Non-Patent Document 1). Route flap dumping is implemented in a BGP router provided in each AS, and determines whether or not it is stable for each prefix route received by a BGP route update message from each BGP connection destination. In route flap damping, a prefix is penalized each time its route changes.

FIG. 15 is a graphical representation of the change in penalty in route flap damping. In FIG. 15, when the penalty reaches a predetermined suppression value, the route is suppressed and is not advertised to other BGP routers. Also, the penalty decreases exponentially, and when the value becomes smaller than the reuse value, the route is broadcast again. Also, route flap damping suppresses the publicity of prefixes that frequently undergo route fluctuations, and as a result, BGP route update messages also decrease.
RFC2439 “BGP Route Flap Damping”

  The route flap damping described above determines whether or not the route is flapped only by the reception frequency of the BGP route update message received from one BGP connection destination. However, even if the route is actually normal, the BGP route update message that is propagated depends on the BGP connection topology, the route policy set in the BGP router, or the reception or transmission timing of the BGP route update message. May increase in number. As a result, a certain BGP router receives a plurality of BGP route update messages for a certain prefix, and as a result, it is determined that the route is flapping, and the route may be suppressed.

  This phenomenon will be described with reference to FIG. FIG. 16 is a diagram showing how the number of BGP path change messages increases as the BGP path update message propagates between ASs. Note that the numbers in FIG. 16 indicate AS numbers, “W” indicates Withdraw, and the numbers in {} indicate AS paths of routes in Announce. In FIG. 16, for example, when the BGP router is restarted in AS1, the route advertised from the BGP router is once drawn and then announced again after the router is started. This one-time route change is broadcast to the adjacent AS2, AS3, and AS4 by the BGP route update message. In AS5, BGP route update messages are received from AS2 and AS3, but it is assumed that the route from AS3 is given priority according to the route policy of AS5. Assuming that AS5 receives Announce from AS2 first after receiving Withdraw and does not receive Announce from AS3, AS5 advertises the route from AS2 to adjacent AS9. If AS5 subsequently receives Announce from AS3, AS5 advertises the route from AS3 to AS9. As a result, in AS9, three BGP route change messages are received by one route change in AS1. Similarly, the AS 11 receives a BGP route change message from the AS 10, but the AS 11 receives four BGP route change messages according to the reception and transmission timing of the BGP route change message in the AS 10.

  As described above, even if the route changes normally once, a certain AS may receive a plurality of BGP route update messages. If route flap damping is performed there, the route is flapping. And the route is unnecessarily suppressed.

  The present invention has been made in consideration of such circumstances, and its purpose is to identify an unstable route in Internet route control, to quickly contact the source of the route and deal with it, and to An object of the present invention is to provide a path variation determination device that can contribute to stabilization of path control.

  Another object of the present invention is to provide a computer program for realizing the path fluctuation judging device of the present invention using a computer.

  In order to solve the above-described problems, the route fluctuation determination device according to the present invention generates a route flap for a specific prefix in a network system configured by combining AS (Autonomous System) as independent management units. A route change determination device for determining whether or not a message is obtained from a plurality of BGP (Border Gateway Protocol) routers adjacent to the AS at an observation point; A path variation determining unit that extracts a characteristic message pattern at the time of occurrence of a route flap from a plurality of BGP route update messages and determines whether or not a route flap has occurred with respect to the specific prefix; And

  In the route variation determination device according to the present invention, the route variation determination unit identifies a location where the route flap occurs when it is determined that a route flap has occurred in the specific prefix. .

  In the route variation determination apparatus according to the present invention, the message acquisition unit connects to the plurality of BGP routers and receives a BGP route update message from each BGP router.

  In the route variation determination apparatus according to the present invention, the message acquisition unit acquires a BGP route update message that is acquired in advance from the plurality of BGP routers and stored in a file.

  In the route fluctuation determination apparatus according to the present invention, the obtained BGP route update message is classified for each prefix, and at least information on time and route attributes is extracted and output to the route fluctuation determination unit, or A message processing unit is further provided for generating and storing one BGP route update message file having information on at least time and route attributes for each prefix.

  In the route variation determination device according to the present invention, when the route variation determination unit newly acquires the BGP route update message, the newly acquired BGP route is determined according to an interval from the previously acquired BGP route update message. It is determined whether or not the update message belongs to an event in which a group of messages satisfying a predetermined condition in time when the BGP route update messages received from the plurality of BGP routers are arranged in time series, When it is determined that it does not belong, it is determined as a related event when the interval with the BGP route update message acquired at the end of the event is equal to or smaller than a predetermined value. In the received BGP route update message, determine whether there is a route having the same attribute in the event, When not standing, and judging with the event is not an event with root flap.

  In the route variation determination device according to the present invention, the route variation determination unit, when there is a route having the same attribute in the event, the event that finally receives Withdraw from all connected BGP routers is the prefix It is determined that the event is caused by a route flap at the generation source.

  In the route variation determination apparatus according to the present invention, when a route having the same attribute exists in the event, the route variation determination unit determines whether an event that finally receives Withdraw from at least one connection destination BGP router is a route It is determined that the event is caused by a route flap on the way.

  In the route variation determination device according to the present invention, the route variation determination unit determines a characteristic message pattern when a route flap occurs from the related BGP route update message for the event determined to be an event due to a route flap. Is extracted, and the result is stored as a log.

The computer program according to the present invention is a path fluctuation determination that determines whether or not a route flap has occurred with respect to a specific prefix in a network system configured by combining AS (Autonomous System) as independent management units. A computer program for performing processing, comprising: a function of acquiring a BGP route update message from a plurality of BGP (Border Gateway Protocol) routers adjacent to the AS at an observation point; and a plurality of BGP route update messages acquired A characteristic message pattern at the time of occurrence of a route flap is extracted, and a function of determining whether or not a route flap has occurred with respect to the specific prefix is realized in a computer.
As a result, the above-described path variation determination apparatus can be realized using a computer.

  According to the present invention, by extracting a characteristic message pattern at the time of occurrence of a route flap from a BGP route update message received from a plurality of BGP routers, it is possible to specify the presence / absence and occurrence location of a route flap. Further, it is possible to grasp the characteristics of the reception pattern of the BGP route update message when the route flap occurs. Therefore, by specifying an unstable route in Internet route control, it is possible to quickly contact and deal with the origin of the route, and contribute to maintaining stable Internet route control.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

First, a BGP route update message transmission model when a route flap occurs will be described with reference to FIGS. 1 and 2.
A route flap related to a certain prefix P0 can be considered to occur in the origin of the prefix P0 or in the middle of the route. The cause of the former is an interface failure of the BGP router, and the latter is considered to be caused by a phenomenon called Route Oscillation described in RFC3345. An example of the former is shown in FIG. 1, and an example of the latter is shown in FIG.

  As shown in FIG. 1, when a route flap occurs at a prefix generation source, an AS serving as an observation point repeatedly receives Announce (A) and Withdraw (W) regarding the prefix P0. Here, it is assumed that a BGP router that performs route flap damping exists on the route, and when the penalty of the prefix P0 reaches the suppression value at the route flap damping execution router, after a Withdraw is transmitted for the prefix P0, a certain period of time is transmitted. The BGP route update message for the prefix P0 is suppressed. As a result, at the observation point, after receiving Withdraw regarding the prefix P0 from all BGP connection destinations with different paths, the BGP path update message regarding the prefix P0 is not received for a certain period.

  On the other hand, as shown in FIG. 2, when a route flap occurs in the middle of a route, even if a route flap damping execution router exists on the route, the observation point is stable and does not pass the route flap occurrence point with respect to the prefix P0. There is a possibility that the route (AS5 → AS4) is received by an Announce (A) message.

FIG. 3 is a block diagram showing a configuration of the path variation determination apparatus 30 according to an embodiment of the present invention.
In FIG. 3, the path variation determination device 30 includes a message acquisition unit A (31), a message acquisition unit B (32), a message processing unit 33, a file storage unit 34, a path variation determination unit 35, and a file output. Part 36.

  The message acquisition unit A (31) connects to the adjacent BGP routers 40 (1-n), receives the BGP route update messages from the respective BGP routers 40 (1-n), and receives the received BGP route update messages. The data is converted into a standard format and output to the message processing unit 33.

  The message acquisition unit B (32) acquires the BGP route update message converted into the standard format from the BGP route update message dump file 41, and outputs it to the message processing unit 33. In the BGP route update message dump file 41, a BGP route update message acquired from the BGP router 40 (1 to n) is converted into a standard format and stored in advance.

  The message processing unit 33 classifies the messages acquired by the message acquisition unit A (31) and the message acquisition unit B (32) for each prefix, and extracts at least time and route attribute information to the route determination unit 35. For each prefix, one BGP route update message file having at least information about time and route attributes is generated and stored in the file storage unit 34.

  As will be described later, the route fluctuation determination unit 35 extracts a characteristic message pattern at the time of occurrence of a route flap from a plurality of acquired BGP route update messages, and determines whether or not a route flap has occurred for a specific prefix. When it is determined and it is determined that a route flap has occurred in a specific prefix, a function for estimating the location where the route flap is generated and outputting it to the file output unit 36 is provided.

  The route fluctuation determination unit 35 also has a function of extracting a characteristic message pattern when a route flap occurs from a related BGP route update message and storing the result as a BGP route fluctuation log 42 by the file output unit 36. Have both.

Hereinafter, the operation of the route variation determination apparatus 30 according to the present embodiment illustrated in FIG. 3 will be described.
Here, it is assumed that BGP route update messages can be collected according to any of the methods described below. One is a method of performing BGP connection with a plurality of BGP routers 40 (1 to n) at the observation points shown in FIGS. 1 and 2 and receiving a BGP route update message from each BGP router 40 (1 to n). is there. In this case, the message acquisition unit A (31) converts the received BGP route update message into a standard format called an MRT format and stores it. The other is a method of inputting a dump file 41 of a BGP route update message collected in advance. In the BGP route update message dump file 41, BGP route update messages received from a plurality of BGP routers 40 (1 to n) routers are converted into an MRT format and stored.

  FIG. 4 shows an example of a BGP route update message written in the MRT format. As shown in FIG. 4, the message expressed in the MRT format includes a message reception time (TIME), a message transmission source (FROM), an AS path (ASPATH), a MED value (MULTI_EXIT_DISC), a community value (COMMUNITY). ), Prefixes to be publicized (ANNOUNCE), prefixes to be canceled (WITHDRAW), and so on.

  The BGP route update messages collected by the above method are classified for each prefix by the message processing unit 33, and necessary information is extracted. Thereafter, when the path variation determination is performed in real time, the message processing unit 33 outputs the processed message to the path variation determination unit 35. On the other hand, when the path variation determination is performed in non-real time, for each prefix. Are edited as one BGP route update message file and stored in the file storage unit 34 as a message file. An example of this message file is shown in FIG.

  In FIG. 5, each entry constituting the file represents one BGP route update message. Information includes the date and time of message reception, message type (Announce or Withdraw), connection destination, MED value (here, med), An AS path (here aspath) and a community value (here community) are included. If the message is Withdraw, the information to be recorded is only the message reception date and connection destination.

6 and 7 are flowcharts showing the flow of the route flap determination process by the route fluctuation determination unit 35.
Hereinafter, the route flap determination process performed by the route variation determination unit 35 will be described in detail with reference to the flowcharts of FIGS. 6 and 7.

  First, the route fluctuation determination unit 35 determines whether a new BGP route update message acquired via the message acquisition unit A (31) or the message acquisition unit B (32) has arrived (step in FIG. 6). S601). Here, when a new BGP route update message has arrived, the route fluctuation determination processing unit 35 refers to the interval with the previously arrived BGP route update message (step S602). Here, when the interval is larger than a certain threshold value Is (step S602 “YES”), it is determined that the newly arrived BGP route update message belongs to a new event (step S603). (Step S602 “NO”), it is determined that the newly arrived BGP route update message belongs to the same event as the previous BGP route update message (Step S608).

  Note that the threshold Is is set to about 30 to 50 seconds from the transmission interval of the BGP route update message in the BGP router. The “event” is constant in time when the route variation determination apparatus 30 according to the present embodiment arranges BGP route update messages received from a plurality of BGP routers 40 (1 to n) in time series. It is assumed that a group of messages satisfying the condition is grouped.

Here, when a new event occurs, it is determined whether or not the previous event is an event caused by a route flap.
First, the interval between the previous event and the last BGP route update message is referred to (step S604). If it is less than or equal to a certain threshold value Rs (step S604 “NO”), it is estimated that the new event is a related event with the previous event (step S609), and no route flap determination is performed here. Here, the threshold value Rs is set to about 10 to 30 minutes in consideration of the time during which the route suppressed by route flap damping at the BGP router is re-advertised.

On the other hand, when the interval between the previous event and the last BGP route update message is larger than Rs (step S604 “YES”), in the BGP route update message received from a certain connection destination, the same AS path in the event, It is determined whether or not there is a route having an attribute (step S605 in FIG. 7). The intention of this determination will be described below.
In the case of normal route fluctuation, it is considered that the same route does not appear repeatedly in the event. However, when a route flap occurs, for example, in FIG. 8, when AS 3 receives a BGP route update message from AS 1 and AS 2, an observation is made depending on the reception timing of the BGP route update message and the message transmission timing to the observation point. It can be considered that the same route is observed in the same event at a point. Here, the same route refers to a message having the same information (AS path, MED value, Community value) included in the BGP route update message. FIG. 8 is a conceptual diagram quoted for explaining the same route in the event.

  The description returns to the flowcharts of FIGS. If there is no route having the same AS path and attribute in the event in the process of step 605 (step S605 “NO”), it is determined that the previous event is not an event due to a route flap, and the determination process is terminated (step S605). S614).

  On the other hand, if a route having the same AS path and attribute exists in the event (step S605 “YES”), it is next determined whether or not Withdraw has been received last from all connection destinations (step S605). S606). As described above, when a route flap occurs at the prefix generation source, if the route flap damping is executed on the route, the last message of the event from the connection destination is Withdraw. Also, for example, when no message is received from the connection destination in a certain event as in connection # 2 shown in FIG. 9, the last received message in the immediately preceding event is referred to, and if it is Withdraw It is considered that this condition is satisfied. FIG. 9 is a conceptual diagram quoted for explaining message intervals and event intervals.

  From this, the path variation determination unit 35 determines whether or not Withdraw is received last from all the connection destinations (step S606). Here, in the case of YES, the event is the route at the prefix generation source. It is determined that the event is due to a flap (step S612). Further, the route fluctuation determination unit 35 determines whether or not Withdraw is received last from at least one connection destination (step S607). Here, in the case of YES, the event is due to a route flap in the middle of the route. It is determined that the event is an event (step S613). On the other hand, if Announce is finally received from all connection destinations ("NO" in step S607), it is determined that the event is not a route flap event (step S614).

  For reference, FIG. 10 shows a pattern example of a BGP route update message in the event of a route flap at the prefix generation source, and FIG. 11 shows a BGP route in the event of a route flap in the middle of the route. FIG. 12 shows a pattern example of an update message, and FIG. 12 shows a pattern example of a BGP route update message when it is not a route flap event. In the example shown in FIGS. 10, 11, and 12, BGP connection is made with four connection destinations (IP addresses are 10.0.0.1, 10.0.0.2, 10.0.0.3, 10.0.0.4), and a BGP route update message is received. It shows the case.

  The description returns to the flowcharts shown in FIGS. When a new BGP route update message does not arrive (step S601 “NO” in FIG. 6), the interval between the previous event and the last BGP route update message is referred to (step S611), which is equal to or less than the threshold value Rs. In this case (step S611 “NO”), the route flap determination is not performed here. On the other hand, if it is larger than the threshold value Rs (step S611 “YES”), it is determined whether there is a route having the same AS path and attribute in the event in the BGP route update message received from a certain connection destination. (Step S605). Since the subsequent processing is the same as described above, the description thereof is omitted.

  Finally, the route fluctuation determination unit 35 outputs a BGP route update message group, which is an event determined as a route flap, to the file output unit 36. The file output unit 36 extracts information necessary for the event determined to be the route flap and stores it as the BGP route fluctuation log 42. Here, as shown in FIG. 13, information extracted and held includes a prefix, a location where a route flap occurs, an event start time, an end time, a duration, the number of messages included in the event, and the like.

As described above, according to the present embodiment, by extracting a characteristic message pattern at the time of occurrence of a route flap from a BGP route update message received from a plurality of BGP routers instead of from a single BGP router, The presence or absence and occurrence location of the route flap are specified, and the reception pattern of the BGP route update message when the route flap occurs is extracted and stored.
This makes it possible to specify whether or not a route flap has occurred, and to determine the location of the occurrence, and to understand the characteristics of the reception pattern of the BGP route update message when the route flap occurs. Therefore, by specifying an unstable route in Internet route control, it is possible to quickly contact and deal with the origin of the route, and contribute to maintaining stable Internet route control.

  In the present embodiment, the functions that the path variation determination unit 35 refers to, determines, and specifies are all executed by the arithmetic unit that the path variation determination apparatus 30 has as hardware, and is stored in a file. The file generated by the unit 34, the BGP route update message dump file 41, and the BGP route fluctuation log 42 are all assigned to and stored in a storage device. Here, both the arithmetic unit and the storage device are not shown.

Further, by recording a program for realizing the function of the path variation determination device 30 shown in FIG. 3 on a computer-readable recording medium, causing the computer system to read and execute the program recorded on the recording medium. The route variation determination process may be performed. Here, the “computer system” may include an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a CD-ROM, a hard disk built in a computer system, etc. This is a storage device.

Further, the “computer-readable recording medium” means a volatile memory (for example, DRAM (Dynamic DRAM) in a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Random Access Memory)), etc., which hold programs for a certain period of time.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like within a scope not departing from the gist of the present invention.

It is the figure quoted in order to demonstrate the transmission model of a BGP path | route update message when a route flap generate | occur | produces. It is the figure quoted in order to demonstrate the transmission model of a BGP path | route update message when a route flap generate | occur | produces. It is a block diagram which shows the structure of the path | route fluctuation | variation determination apparatus 30 by one Embodiment of this invention. It is a figure which shows an example of the BGP path | route update message represented with a MRT format. It is a figure which shows an example of the message file produced | generated by the path | route fluctuation | variation determination apparatus 30 shown in FIG. It is a flowchart which shows the flow of the route fluctuation | variation determination process which concerns on one Embodiment of this invention. It is a flowchart which shows the flow of the route fluctuation | variation determination process which concerns on one Embodiment of this invention. It is the figure quoted in order to demonstrate the path | route fluctuation | variation determination process which concerns on one Embodiment of this invention, and is the figure showing the same path | route in an event. It is the figure quoted in order to demonstrate the route fluctuation | variation determination process which concerns on one Embodiment of this invention, and is a figure showing the message interval and the event interval. It is a figure which shows an example of the pattern of the BGP path | route update message which concerns on one Embodiment of this invention. It is a figure which shows an example of the pattern of the BGP path | route update message which concerns on one Embodiment of this invention. It is a figure which shows an example of the pattern of the BGP path | route update message which concerns on one Embodiment of this invention. It is a figure which shows an example of the data structure of the BGP path | route fluctuation log produced | generated by the path | route fluctuation | variation determination apparatus 30 shown in FIG. It is the figure which expressed the network configuration in AS unit. It is the figure quoted in order to demonstrate the change of the penalty in route flap damping. It is the figure quoted in order to demonstrate a mode that the number of messages increases as a BGP path | route update message propagates between AS.

Explanation of symbols

DESCRIPTION OF SYMBOLS 30 ... Path | route fluctuation | variation determination apparatus, 31 ... Message acquisition part A, 32 ... Message acquisition part B, 33 ... Message processing part, 34 ... File storage part, 35 ... Path | route fluctuation determination part, 36 ... File output part, 40 ... BGP router 41 ... BGP route update message dump file, 42 ... BGP route fluctuation log

Claims (10)

In a network system configured by combining ASs (Autonomous Systems) that are independent management units, a path variation determination device that determines whether or not a route flap has occurred with respect to a specific prefix,
A message acquisition unit for acquiring a BGP route update message from a plurality of BGP (Border Gateway Protocol) routers adjacent to the AS at the observation point;
A route fluctuation determining unit that extracts a characteristic message pattern at the time of occurrence of a route flap from the plurality of obtained BGP route update messages, and determines whether or not a route flap has occurred with respect to the specific prefix;
A path fluctuation judging device comprising: The route fluctuation determination unit
2. The route variation determination device according to claim 1, wherein when it is determined that a route flap has occurred in the specific prefix, the route flap generation location is specified. The message acquisition unit
2. The path variation determination device according to claim 1, wherein the apparatus is connected to the plurality of BGP routers and receives a BGP path update message from each of the BGP routers. The message acquisition unit
2. The route fluctuation determination device according to claim 1, wherein a BGP route update message obtained in advance from the plurality of BGP routers and stored in a file is obtained. The obtained BGP route update message is classified for each prefix, and at least information related to time and route attributes is extracted and output to the route variation determination unit, or information related to at least time and route attributes for each prefix. A message processing unit for generating and storing one BGP route update message file having
5. The path variation determination device according to claim 1, further comprising: The route fluctuation determination unit
When the BGP route update message is newly acquired, the newly acquired BGP route update message may receive the BGP route update message received from the plurality of BGP routers according to the interval with the previously acquired BGP route update message. Determine whether it belongs to the event that grouped the message group that satisfies the predetermined condition in time when arranged in the series,
When it is determined that it does not belong to the event, it is determined as a related event when the interval with the BGP route update message acquired at the end of the event is equal to or smaller than a predetermined value. In the BGP route update message received from the connection destination, it is determined whether or not a route having the same attribute exists in the event, and when the route does not exist, it is determined that the event is not an event due to a route flap. The path | route fluctuation | variation determination apparatus of Claim 1 or 2 to do. The route fluctuation determination unit
When there is a route having the same attribute in the event, it is determined that an event that finally receives Withdraw from all connection destination BGP routers is an event due to a route flap at a source of the prefix. The path | route fluctuation | variation determination apparatus of Claim 6. The route fluctuation determination unit
When a route having the same attribute exists in the event, it is determined that an event that finally receives Withdraw from at least one connected BGP router is an event due to a route flap in the middle of the route. Item 7. The path variation determination device according to Item 6. The route fluctuation determination unit
A characteristic message pattern at the time of occurrence of a route flap is extracted from the related BGP route update message for the event determined to be an event due to a route flap, and the result is stored as a log. The path fluctuation determination device according to 7 or 8. A computer program for performing path variation determination processing for determining whether or not a route flap has occurred with respect to a specific prefix in a network system configured by combining AS (Autonomous System) as independent management units There,
A function of acquiring a BGP route update message from a plurality of BGP (Border Gateway Protocol) routers adjacent to the AS at the observation point;
A function of extracting a characteristic message pattern at the time of occurrence of a route flap from the obtained plurality of BGP route update messages and determining whether or not a route flap has occurred with respect to the specific prefix;
A computer program for causing a computer to realize the above.

Images