JP2008061139A - Network monitoring device, network monitoring method, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer program for improving precision in monitoring the controlling state of a route and providing a network monitoring device utilizing a computer. <P>SOLUTION: The network monitoring device is provided with: an LSA collection part 11 which collects the link-state advertisement message of a route control protocol from an IP network; an LSDB management part 13 for preparing a link-state data base having a state value for managing difference information of the collected link-state advertisement message; and an error/restoration judging part 14 judging an error using a criterion based on the arrival pattern of the link-state advertisement message corresponding to an assumed error by referring to the link-state data base. The error/restoration judging part 14 performs two-stage error judgment having a time difference considering the delay of arrival of the link-state advertisement message. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a network monitoring device, a network monitoring method, and a computer program.

  2. Description of the Related Art Conventionally, in a communication network using IP (Internet Protocol) (hereinafter referred to as “IP network”), a route control protocol controls (route control) which route a packet is transmitted through. By monitoring the path control status, we try to grasp the occurrence of a path failure in the IP network and its recovery as quickly as possible to ensure stable operation of the IP network.

  As a typical routing protocol used in an IP network, OSPF (Open Shortest Path First) is known. In OSPF, each router that configures an IP network uses its link state (communication link connection state, communication link cost, etc.) to indicate the entire IP network using a link-state advertisement (LSA). To publicize. The router receives LSAs transmitted from other routers and creates a link-state database (LSDB) from the received LSAs. Based on the LSDB, a path tree that minimizes the cost to the destination in the IP network (hereinafter referred to as “shortest path tree”) is created, and a route table of the router is created based on the path tree.

  In OSPF, in addition to periodically sending the link status of the router using LSA (Refresh LSA), when the link status of the router changes, for example, the router connects to the router. LSA is transmitted when it is detected that the communication link is broken. When the router receives an LSA with a message content different from the previously received LSA, the router rewrites the LSDB and regenerates the topology and route table. Therefore, if an LSA is collected and monitored in an IP network on which OSPF operates, a change in the route control state of the IP network can be detected.

For example, in the conventional network monitoring technique described in Patent Document 1, a monitoring terminal device connected to an IP network collects LSAs and creates an LSDB and a shortest path tree including all routers in the IP network. When the change of LSA is received, the LSDB and the shortest path tree are regenerated, the LSDB before the change and the LSDB after the change, or the shortest path tree before the change and the shortest path tree after the change are compared, and the changed part is displayed. Etc. are explicitly displayed.
JP 2006-140834 A

However, the above-described conventional network monitoring technology has the following problems.
When a failure occurs in the IP network, the router that detects the failure advertises the LSA whose link state has been changed to the entire IP network. At this time, if multiple routers detect one failure, all the routers that detected the failure will publicize the LSA whose link status has been changed to the entire network, but due to the detection time lag and LSA propagation delay, A plurality of LSAs related to a single failure may arrive at the monitoring terminal device with a time difference of several tens of seconds. Then, depending on each LSA, the LSDB and the shortest path tree change occur multiple times. Even if the changes are displayed multiple times, the network operation administrator can see these changes due to a single failure. I don't know if this is due to multiple failures.

  In addition, when the IP network is divided due to a failure, the LSA from the router that is farther from the location where the division occurs when viewed from the monitoring terminal device does not reach the monitoring terminal device. On the basis of this, even if the LSDB or path tree change point is detected, the exact failure status cannot be grasped.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a network monitoring apparatus and a network monitoring method capable of improving accuracy related to monitoring of a path control state.

  Another object of the present invention is to provide a computer program for realizing the network monitoring apparatus of the present invention using a computer.

  In order to solve the above problem, a network monitoring apparatus according to the present invention manages message collection means for collecting a link status advertisement message of a routing protocol from an IP network, and differential information of the collected link status advertisement message. A database management means for creating a link state database having a state value for performing failure determination using a criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure with reference to the link state database And determining means for performing a two-stage failure determination with a time difference in consideration of the arrival delay of the link state advertisement message.

  In the network monitoring apparatus according to the present invention, the standby message recording means for recording the link state advertisement message expected to arrive late from the arrival pattern of the link state advertisement message collected at the time of the previous failure determination as the standby link state advertisement message. The determination means performs a subsequent failure determination when the recorded standby link state advertisement message is received.

  The network monitoring apparatus according to the present invention is characterized in that the determination unit performs failure determination according to a predetermined determination order for each type of failure that may occur.

  In the network monitoring apparatus according to the present invention, the determination unit adopts a failure determination result performed later when a failure determination result performed earlier and a failure determination result performed later are different. .

  The network monitoring device according to the present invention is characterized in that it includes a network partition determination unit that determines whether or not a network partition has occurred at the time of the failure determination.

  The network monitoring device according to the present invention is characterized by comprising failure recovery determination means for determining that the failure has been recovered when the link information deleted due to the occurrence of the failure is received again by the link status advertisement message. To do.

  The network monitoring method according to the present invention includes a process of collecting a link status advertisement message of a routing protocol from an IP network, and a link state database having a state value for managing difference information of the collected link state advertisement message. A process of making a failure determination using a determination criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure with reference to the link state database, and an arrival delay of the link state advertisement message And a step of performing the failure determination in two stages with a time difference taken into consideration.

The computer program according to the present invention creates a link state database having a function for collecting a link state advertisement message of a routing protocol from an IP network and a state value for managing difference information of the collected link state advertisement message. A function that performs a failure determination using a determination criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure, and a delay of arrival of the link state advertisement message. The computer is realized with the function of performing the failure determination in two steps with the time difference.
As a result, the network monitoring apparatus described above can be realized using a computer.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes easy to pinpoint a fault location and its condition easily, and it can aim at the precision improvement regarding monitoring of a path control state. Further, by performing the network division determination at the same time as the failure determination, it is possible to grasp the network division status together with the failure occurrence status. As a result, when network partitioning occurs, it is possible to know the possibility of an error in the failure determination result due to network partitioning, and network operation managers can determine the failure considering the effects of network partitioning. By using the result, it becomes possible to perform an efficient failure response.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating a network configuration example of a monitoring target according to an embodiment of the present invention. The network shown in FIG. 1 is an IP network. The network shown in FIG. 1 uses OSPF as a route control protocol.

  In FIG. 1, a network N0 is a local area network (LAN) such as a corporate LAN. The network N5 is an external network that does not belong to the network N0, for example, the Internet. The external network N5 is connected to the network N0 via the router R4.

  The network N0 includes ten routers R1 to R10, stub networks N1, N3, and N4, and a transit network N2. The routers R1 to R10 perform path control operations according to OSPF. The network N0 is divided into three areas 0, 1, and 2. Area 0 is a backbone area.

  Routers R1 to R4 belong to area 0. Routers R7 and R8 belong to area 1. Routers R9 and R10 belong to area 2. Router R5 belongs to both area 0 and area 1. Router R6 belongs to both area 0 and area 2.

  The stub network N1 is connected to the router R3. The transit network N2 is connected to routers R2, R4, and R6. The external network N5 is connected to the router R4. The router R4 is an AS (Autonomous System) border router that receives route information of the external network N5 and redistributes it within the network N0.

  In OSPF, in order to reduce the transfer amount of the route information message, when the network is large, the network is divided into a plurality of areas including a backbone area as shown in FIG. An LSA (link status advertisement message) transmitted from a router belonging to a certain area can be received by all routers belonging to the same area. Therefore, the router can acquire all the link states of the area to which the router belongs. However, since the area border routers (routers R5 and R6 in FIG. 1) located at the border of each area transmit only the summarized LSA between the areas, the routers belonging to one area have all the link states of other areas. It cannot be acquired. In FIG. 1, for example, router R5 sends an LSA summarizing the link status of area 0 to each router R7, R8 in area 1, and sends an LSA summarizing the status of area 1 to each router R1-R4 in area 0. To do.

  For this reason, in order to collect LSA of the entire network and acquire all link states, a network monitoring device is installed for each area. In FIG. 1, in the area 0, the network monitoring device 10 is connected to the router R2. In area 1, the network monitoring device 10 is connected to the router R8. In area 2, the network monitoring device 10 is connected to the router R10. The network monitoring apparatus 10 collects LSA from the router to which it is connected according to OSPF. Then, an LSDB is generated from the collected LSA, and failure determination and failure recovery determination are performed.

  FIG. 2 is a block diagram showing the configuration of the network monitoring apparatus 10 according to an embodiment of the present invention. In FIG. 2, the network monitoring apparatus 10 includes an LSA collection unit 11, an LSA management unit 12, an LSDB management unit 13, a failure / recovery determination unit 14, a failure management table 15, a determination result storage unit 16, and a network division determination unit 17. .

  The LSA collection unit 11 receives the LSA transmitted from the router to which the own network monitoring device 10 is connected. The LSA management unit 12 records the LSA received by the LSA collection unit 11. The LSDB management unit 13 creates and holds an LSDB (link state database) from the LSA recorded by the LSA management unit 12.

  FIG. 3 is a configuration example of the LSDB held by the LSDB management unit 13 shown in FIG. The example of FIG. 3 is for the network monitoring apparatus 10 arranged in the area 0 shown in FIG. As shown in FIG. 3, the LSDB manages router and network connection relationships in a matrix format. If there is a connection relationship between two points (from to in FIG. 3), the data 30 including the LS type, link type, link cost, LS age, and state value is held. In the example of FIG. 3, there is a connection relationship between the router R3 and the router R5, and the data 30 is illustrated. In the data 30, the “state value” has four types of values “Del”, “Alive”, “NG”, and “NC”, and is information for managing LSA difference information. . “Del” represents deletion of a connection relationship. “Alive” represents restoration of the connection relationship. “NG” represents an element that has already been referred to in a failure determination process described later. “NC” indicates no change.

  The failure / recovery determination unit 14 performs determination processing when an LSA other than “Refresh LSA” is received. As the determination process, a failure determination is performed by referring to the LSDB held by the LSDB management unit 13 to identify the failure location. Also, failure recovery determination is performed with reference to the LSDB held by the LSDB management unit 13 to identify the failure recovery location. The failure / recovery determination unit 14 registers the determination result in the failure management table 15. Further, the failure / recovery determination unit 14 outputs the determination result to the determination result storage unit 16.

  The network division determination unit 17 refers to the LSDB held by the LSDB management unit 13 and determines whether network division has occurred. The network division determination unit 17 outputs the determination result to the determination result storage unit 15.

  The failure management table 15 stores the failure location and the failure recovery location identified by the failure / recovery determination unit 14. The determination result storage unit 15 stores the failure location and the failure recovery location specified by the failure / recovery determination unit 14. In addition, the determination result storage unit 15 stores a determination result related to network division by the network division determination unit 17.

  Next, the operation of the network monitoring apparatus 10 shown in FIG. 2 will be described.

  First, the network monitoring device 10 operates the OSPF function to establish an adjacency relationship with a router to be connected, and receives an LSA from the router that has established the adjacency relationship. The LSA management unit 12 holds the received LSA. The LSA management unit 12 compares the newly received LSA with the already held LSA and checks whether the link state has changed. As a result, when there is a change in the link state, difference link information indicating the change point of the link state is created and held for a certain period. For example, when the link A that has already existed in the already held LSA is deleted in the newly received LSA, differential link information indicating “delete link A” is created and held for a certain period. When the same LSA (Refresh LSA) is not received for a certain period with respect to the held LSA, the LSA management unit 12 deletes the LSA.

FIG. 4 is a flowchart showing a procedure of overall processing according to the failure determination of the present embodiment. With reference to FIG. 4, an operation related to the failure determination will be described.
In step S <b> 1, the LSA management unit 12 monitors whether or not the LSA received by the LSA collection unit 11 is “Refresh LSA”. In step S2, the LSA management unit 12 activates a timer (timeout time “X seconds”) when a changed LSA that is not “Refresh LSA” is received as a result of the monitoring. The timeout time “X seconds” is a value determined by the scale of the network to be monitored, etc., but it may be set to about several seconds normally.

  In step S3, the LSA management unit 12 confirms whether another changed LSA is received before the timeout (within X seconds). In step S4, if another changed LSA is received as a result of the confirmation, the LSA management unit 12 resets the timer and returns to step S3, and another changed LSA is again received within X seconds. Monitor whether it is received or not. On the other hand, if a timeout has occurred, the process proceeds to step S5.

  In step S5, that is, if the LSA changed within X seconds is not received, the LSDB management unit 13 initializes the LSDB and regenerates the LSDB from the LSA held in the LSA management unit 12. In step S6, the failure / recovery determination unit 14 performs a failure determination process based on the regenerated LSDB.

  FIG. 5 is a flowchart showing the procedure of the failure determination process (step S6) shown in FIG. In the failure determination process (step S6), failure determination is performed for each type of failure according to the procedure shown in FIG. Hereinafter, criteria for each failure type in each step will be described. This failure criterion is based on the LSA pattern.

  Step S21: In the case of an autonomous router failure, the router that becomes the failure transmits an LSA that deletes all link information that the router has before the failure. When the network monitoring apparatus 10 receives the LSA, it determines that an autonomous router failure has occurred in the corresponding router. An example of an autonomous router failure is a router restart.

  Step S22: In the case of a router failure, the faulty router itself does not send any LSA, but the router connected to the faulty router detects the fault and deletes the link link information to the faulty router. Send. When the network monitoring apparatus 10 receives an LSA from which connection link information to a failed router has been deleted from all the connected routers, it determines that a router failure has occurred in that router. An example of a router failure is a sudden power interruption of the router.

  Step S23: In the transit network failure, the representative router of the transit network transmits an LSA for deleting the failed network. In addition, the router connected to the faulty transit network transmits an LSA for deleting connection link information to the faulty network. When the network monitoring apparatus 10 receives the LSA, it determines that a transit network failure has occurred. An example of a transit network failure is a network layer 2 switch failure.

  Step S24: In a PtoP link (inter-router link) failure, the router connected to both ends of the failed link transmits an LSA for deleting the link information. The network monitoring device 10 determines that a PtoP link failure has occurred when one of the LSAs is received.

  Step S25: The transit network link failure is a failure of the link connecting the router to the transit network. When the router is a representative router of the transit network, an LSA that deletes connection link information to the transit network is transmitted, and an LSA that deletes the transit network is transmitted. The network monitoring device 10 determines that a transit network link failure has occurred when these LSAs are received. On the other hand, when the router is not the representative router of the transit network, the router transmits an LSA that deletes connection link information to the transit network, and the representative router transmits the LSA that the router has been deleted from the transit network. The network monitoring device 10 determines that a transit network link failure has occurred when these LSAs are received.

  Step S26: The stub network failure is a failure of the connection link to the stub network in the router, and the router transmits an LSA for deleting the connection link information to the stub network. When the network monitoring apparatus 10 receives the LSA, it determines that a stub network failure has occurred.

  Step S27: The out-of-area network failure is a failure detected by the area border router, and the area border router transmits an LSA for deleting a network outside the area. When the network monitoring apparatus 10 receives the LSA, it determines that an out-of-area network failure has occurred.

  Step S28: The external network failure is a failure detected by the AS boundary router, and the AS boundary router transmits an LSA for deleting a certain external network. When the network monitoring apparatus 10 receives the LSA, it determines that an external network failure has occurred.

  Returning to FIG. In the failure determination process in step S6, the “changed LSA” collected so far (steps S1 to S3) is investigated, and the type of failure corresponding to the collected LSA is determined to determine the failure. The result is recorded in the failure management table 15 and recorded as a log in the determination result storage unit 16.

  Here, all the LSAs transmitted in relation to a certain failure do not always arrive at the network monitoring device 10 almost simultaneously. Each LSA relays through a plurality of different routers and arrives at the network monitoring device 10. For example, when there is a router with a high load on the way and the relay processing at that router is delayed, it is related to a certain failure. It is considered that the LSA arrives at the network monitoring apparatus 10 with a certain time difference. Further, when there is a router whose failure detection is delayed, the router transmits the LSA later than the other routers. In this case, too, the LSA related to a certain failure has a certain time difference in the network monitoring device 10. Expected to arrive. Therefore, in step S7, the failure / recovery determination unit 14 determines the LSA expected to arrive late as a standby LSA from the LSA arrival patterns collected by the network monitoring device 10 at the time of failure determination, and determines the standby LSA as the standby LSA. Record in the failure management table 15. If it is determined that there is no standby LSA, the process in FIG. 4 ends.

  In step S8, that is, when there is a standby LSA, the LSA management unit 12 collects the changed LSA for another Y seconds. The LSDB management unit 13 updates the LSDB by reflecting the collection result on the LSDB. In step S9, it is determined whether or not a standby LSA is received in the Y seconds. If the standby LSA is received as a result of the determination, the process proceeds to step S10. If the standby LSA is not received, the process of FIG. 4 ends.

  In step S10, the same failure determination process as in step S6 is performed again (determination after failure). In step S10, if a failure determination is made including the standby LSA that arrived late, and a determination result different from the previous (step S6) is obtained, a log for canceling the previous failure is recorded in the determination result storage unit 16. In addition, the failure determination result in the post-determination is recorded in the determination result storage unit 16 as a log. The waiting time “Y seconds” of the standby LSA needs to be set in consideration of failure detection delay time, LSA propagation delay, and processing delay, but it is usually set to about several tens of seconds.

  Here, the failure determination processing according to the present embodiment will be described with a specific example.

[Specific example 1: Autonomous router failure]
In the network shown in FIG. 6, the routers are all connected by PtoP links. The network monitoring device 10 is connected to the router R5. In the network of FIG. 6, it is assumed that an autonomous router failure has occurred in the router R2.

  First, since an autonomous router failure has occurred, the router R2 transmits an LSA that deletes all link information that the router R2 has. Along with this, the routers R1, R3, and R5 connected to the router R2 detect that the connection with the router R2 is disconnected, and transmit an LSA for deleting link information to the router R2. Here, a case is considered where all the LSAs related to the failure are collected by the network monitoring apparatus 10 almost simultaneously.

  As a result, the link status from R2 (from) to R1, R3, R5 (to) has been deleted (Del) in the LSDB of the network monitoring device 10, and R1, R3, R5 (from) to R2 ( It is registered that the link state to (to) has been deleted (Del). As a result, the LSDB of the network monitoring device 10 becomes the LSDB before failure determination shown in FIG. Note that FIG. 7 shows only “state value” information in the LSDB.

  Next, in the failure determination process, first, whether an autonomous router failure has occurred is investigated with reference to the LSDB (FIG. 5, step S21). Here, as shown in FIG. 7, since the link states from R2 are all “Del”, it is determined that an autonomous router failure has occurred in R2. Next, the link state related to R2 that is “Del” is rewritten to “NG”. “NG” represents an element already referenced in the failure determination process. Thereby, the LSDB of the network monitoring device 10 becomes the LSDB after the failure determination shown in FIG. Note that FIG. 8 shows only “state value” information in the LSDB.

  Next, it is investigated whether another failure has occurred. Here, if “Del” remains in the LSDB, it is considered that another failure has occurred. However, in the example of the LSDB in FIG. 8, “Del” does not remain and there is no standby LSA. Exit.

[Specific example 2: Simultaneous occurrence of router failure and PtoP link failure]
In the network shown in FIG. 9, the routers are all connected by PtoP links. The network monitoring device 10 is connected to the router R6. In the network of FIG. 9, it is assumed that a router failure has occurred in the router R2, and a PtoP link failure has occurred in the link between the router R3 and the router R4.

  First, the network monitoring apparatus 10 collects LSAs, and as a result, the LSDB of the network monitoring apparatus 10 becomes the LSDB before failure determination shown in FIG. FIG. 10 shows only “state value” information in the LSDB. In FIG. 10, since R2 does not transmit LSA, the link state from R2 is not changed by “NC”. “NC” indicates no change.

  Also, after detecting that the connection to R2 has been lost, the router connected to R2 transmits an LSA that deletes link information to R2. However, at this time, the LSAs from R3 and R6 have arrived at the network monitoring device 10, but the LSA from R1 has not yet arrived. Therefore, in FIG. 10, it is registered that the link state from R3, R6 (from) to R2 (to) is deleted (Del), but the link state from R1 (from) to R2 (to) Is not changed by "NC".

  In addition, an LSA that deletes link information to R4 from R3 arrives at the network monitoring device 10, and an LSA that deletes link information to R3 from R4 has arrived at the network monitoring device 10. As a result, in FIG. 10, the link state from R3 (from) to R4 (to) has been deleted (Del), and the link state from R4 (from) to R3 (to) has been deleted (Del). Is registered.

  Next, in the failure determination process, the occurrence of the failure is investigated in the order shown in FIG. 5 with reference to the LSDB. First, it is investigated whether an autonomous router failure has occurred (FIG. 5, step S21). Here, since there is no router in which all link states from a certain router are “Del”, it is determined that no autonomous router failure has occurred.

  Next, it is investigated whether a router failure has occurred (FIG. 5, step S22). Referring to each row of the LSDB, if there is a router whose link state is all “Del”, it is determined that a router failure has occurred in that router. However, since there is no such router in the LSDB of FIG. 10, it is determined that no router failure has occurred at this point.

  Next, since there is no transit network in the network of FIG. 9, it is investigated whether a PtoP link failure has occurred (FIG. 5, step S24). First, since the link status from R3 to R4 and the link status from R4 to R3 are "Del", it is determined that a PtoP link failure between R3 and R4 has occurred, and the link status is set to "NG" Rewrite to Next, since the link status from R3 to R2 and the link status from R6 to R2 are “Del”, there is a PtoP link failure between R3 and R2 and a PtoP link failure between R6 and R2. It is determined that it has occurred, and the link state is rewritten to “NG”.

  Considering the LSA arrival delay here, there is a possibility of LSA delay when LSA from R2 is delayed and when R2 is faulty and LSA from R1 connected to R2 is delayed. Is considered. Therefore, here, as standby LSA, (1) LSA for deleting link state from R2 to R1, (2) LSA for deleting link state from R2 to R3, (3) LSA for deleting link state from R2 to R6, (4) The four LSAs for deleting the link state from R1 to R2 are registered in the failure management table 15.

  As a result of the previous failure determination process, the LSDB of the network monitoring device 10 becomes the LSDB after the failure determination shown in FIG. FIG. 11 shows only the information of “state value” in the LSDB. As shown in FIG. 11, since “Del” does not remain in the LSDB, the failure determination process is temporarily terminated, but since there is a standby LSA, the changed LSA is collected again (FIG. 4, step). S8). Here, it is assumed that the link state deletion LSA from R1 to R2 arrives at the network monitoring apparatus 10 with a delay. Since this LSA is a standby LSA, a post-failure determination process is performed (FIG. 4, step S10). The LSDB at this time is in the state of FIG. 12, and it is registered that the link state from R1 (from) to R2 (to) has been deleted (Del).

  Next, in the post-failure determination process, it is investigated whether a router failure has occurred. Referring to each row of LSDB, all link states to R2 are “Del” or “NG”, and it is considered that all link states to R2 have been deleted. From this, it is determined that a router failure has occurred in R2. Here, it is considered that the PtoP link failure between R3 and R2 and the PtoP link failure between R6 and R2 determined earlier are determined to be due to the router failure of R2, and there is no problem. Therefore, the determination result is changed from the two PtoP link failures, which are the previous determination results, to one router failure. Then, the link state from R1 to R2 is rewritten to “NG”. As a result, the LSDB of the network monitoring device 10 becomes the LSDB after the failure determination shown in FIG.

  Based on the results of the post-failure judgment processing so far, the judgment results are stored as a log that clears the PtoP link fault between R3 and R2 and the PtoP link fault between R6 and R2, and a log that a router fault has occurred in R2. Part 16 is recorded.

The above is the description of the operation related to the failure determination.
In the recovery determination process performed by the failure / recovery determination unit 14, the link information deleted due to the failure is transmitted again as link information by the LSA, and when the LSA is received by the network monitoring device 10, the failure is recovered. Judge that

Next, with reference to FIG. 14, the operation | movement which concerns on the network parting determination by the network parting determination part 17 is demonstrated. FIG. 14 is a flowchart illustrating a procedure of network partitioning determination processing according to the present embodiment.
The network division determination unit 17 refers to the LSDB when determining a failure and determines whether or not a network division has occurred. By referring to the LSDB, it is possible to check whether there is a route from any router in the area to all other routers in the same area.

  In FIG. 14, in step S41, it is monitored whether the failure determination process has been performed. If the failure determination process has been performed, the process proceeds to step S42. In step S42, with reference to the LSDB, a path tree connecting all the routers in the area when the router to which the own network monitoring apparatus 10 is connected as a starting point is calculated. In step S43, it is determined whether or not all the routers in the area are included in the calculated path tree.

  As a result of the determination, if all the routers in the area are included, the process proceeds to step S44, and it is determined that the network is not divided. On the other hand, if all the routers in the area are not included, the process proceeds to step S45.

  In step S45, it is determined that the network has been divided, and in step S46, it is recorded in the determination result storage unit 16 together with the failure determination result.

  According to the above-described embodiment, the failure determination is performed using the determination criterion based on the LSA arrival pattern corresponding to the assumed failure. Further, a two-stage failure determination with a time difference taking into account the LSA arrival delay is performed. As a result, it becomes easy to accurately identify the location of failure and its situation, and the accuracy of monitoring the path control state can be improved. As a result, it is possible to reduce the time required to identify the location and cause of the failure, and the network operation manager or the like can efficiently handle the failure.

  Further, by performing the network division determination at the same time as the failure determination, it is possible to grasp the network division status together with the failure occurrence status. Thereby, when the network is divided, it is possible to know the possibility of an error in the failure determination result due to the network division. As a result, network operation managers can use the failure determination result in consideration of the effects of network partitioning, so that the failure can be efficiently dealt with and the failure handling time can be shortened. .

  Note that the network monitoring apparatus 10 according to the present embodiment may be realized by dedicated hardware, or configured by a computer system such as a personal computer, and each of the network monitoring apparatuses 10 shown in FIG. The function may be realized by executing a program for realizing the function.

Also, a program for realizing each step shown in FIGS. 4, 5, and 14 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. Thus, network monitoring processing may be performed. Here, the “computer system” may include an OS and hardware such as peripheral devices.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a CD-ROM, a hard disk built in a computer system, etc. This is a storage device.

Further, the “computer-readable recording medium” means a volatile memory (for example, DRAM (Dynamic DRAM) in a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Random Access Memory)), etc., which hold programs for a certain period of time.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like within a scope not departing from the gist of the present invention.
For example, in the above-described embodiment, the network monitoring device 10 is configured as a single device, but the network monitoring device 10 and the router may be integrated into one device. For example, the function of the network monitoring device 10 and the function of the router may be mounted on a personal computer.

It is the figure which showed the example of a network structure of the monitoring object which concerns on one Embodiment of this invention. It is a block diagram which shows the structure of the network monitoring apparatus 10 which concerns on one Embodiment of this invention. It is a structural example of LSDB hold | maintained by the LSDB management part 13 shown in FIG. It is a flowchart which shows the procedure of the whole process which concerns on the failure determination of one Embodiment of this invention. It is a flowchart which shows the procedure of the failure determination process (step S6) shown in FIG. It is explanatory drawing which shows the 1st specific example for demonstrating the failure determination process of one Embodiment of this invention. It is explanatory drawing for demonstrating the 1st state of LSDB in the specific example of FIG. It is explanatory drawing for demonstrating the 2nd state of LSDB in the specific example of FIG. It is explanatory drawing which shows the 2nd specific example for demonstrating the failure determination process of one Embodiment of this invention. It is explanatory drawing for demonstrating the 1st state of LSDB in the specific example of FIG. It is explanatory drawing for demonstrating the 2nd state of LSDB in the specific example of FIG. It is explanatory drawing for demonstrating the 3rd state of LSDB in the specific example of FIG. It is explanatory drawing for demonstrating the 4th state of LSDB in the specific example of FIG. It is a flowchart which shows the procedure of the network division | segmentation determination process which concerns on one Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Network monitoring apparatus, 11 ... LSA collection part, 12 ... LSA management part, 13 ... LSDB management part, 14 ... Failure / recovery determination part, 15 ... Failure management table, 16 ... Determination result storage part, 17 ... Network division | segmentation determination Part

Claims (8)

A message collection means for collecting a routing protocol link status advertisement message from the IP network;
Database management means for creating a link state database having state values for managing the difference information of the collected link state advertisement messages;
A determination unit that refers to the link state database and performs a failure determination using a determination criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure; and
The determination means performs a two-stage failure determination with a time difference considering the arrival delay of the link state advertisement message.
A network monitoring device. A standby message recording means for recording a link status advertisement message that is expected to arrive late from the arrival pattern of the link status advertisement message collected at the time of the previous failure determination, as a standby link status advertisement message,
The determination means performs a later failure determination when the recorded standby link state advertisement message is received.
The network monitoring apparatus according to claim 1.   The network monitoring apparatus according to claim 1, wherein the determination unit performs a failure determination according to a predetermined determination order for each type of failure that may occur.   4. The method according to claim 1, wherein the determination unit adopts a failure determination result performed later when a failure determination result performed earlier and a failure determination result performed later are different. 5. The network monitoring device according to the section.   5. The network monitoring device according to claim 1, further comprising a network partitioning determination unit configured to determine whether network partitioning has occurred at the time of the failure determination.   6. The failure recovery determination means for determining that the failure has been recovered when the link information deleted due to the failure is received again by the link status advertisement message. The network monitoring device according to any of the above sections. Collecting routing protocol link status advertisement messages from the IP network;
Creating a link state database having state values for managing the difference information of the collected link state advertisement messages;
Referring to the link state database and performing a failure determination using a determination criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure;
A process of performing the failure determination in two steps with a time difference considering the arrival delay of the link state advertisement message;
A network monitoring method comprising: The ability to collect routing protocol link status advertisement messages from the IP network;
A function of creating a link state database having a state value for managing difference information of the collected link state advertisement message;
A function of referring to the link state database and performing a failure determination using a determination criterion based on an arrival pattern of a link state advertisement message corresponding to an assumed failure;
A function of performing the failure determination in two stages with a time difference considering the arrival delay of the link state advertisement message;
A computer program for causing a computer to realize the above.

Images