JP2008228011A - Packet collecting apparatus, monitoring system, and packet collecting program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To collect a packet giving an accurate time in the case that the number of the packets to be collected is large and even in the case that a distance between packet collecting points is long. <P>SOLUTION: A PC time generator 201 generates time information to show a time in an apparatus. A packet collecting portion 203 collects the packet to transmit a network and adds the time information to the packet. A time acquiring portion 204 acquires the time information from the PC time generator 201 and acquires reference time information from a time generator 104. A storage portion 202 stores the time information and reference time information acquired by the time acquiring portion 204 correspondingly. A time correcting portion 205 calculates a correction formula to correct the time information added to the packet based on the time information and the reference time information stored by the storage portion 202. The time correcting portion 205 corrects the time information added to the packet based on the correction formula. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a packet collection device, a monitoring system, and a packet collection program that collect packets in order to check a communication state of a network.

  In recent years, use of a wireless line such as a wireless LAN or a cellular phone has become common as an access network to the Internet, and it is important to guarantee communication quality at an end-to-end including the wireless line. However, it is not easy to set control parameters for relay nodes such as end terminals and switches so as to ensure optimum communication quality due to delay variation and packet loss due to protocol processing unique to the wireless line. On the other hand, it is useful to conduct a communication test with an actual machine and analyze in detail the delay fluctuation and packet loss for each flow. Non-Patent Document 1 describes a packet loss / delay measurement system for communication test. This measurement system includes two or more packet collection devices, one analysis device, and a control network connecting them. The network to be analyzed is constructed from two or more nodes that perform communication and a network that connects them. The packet collection device of the measurement system is installed on a path through which two nodes of the analysis target network communicate and collects the communication packets. The analysis device collects the packets collected by the respective packet collection devices via the control network, and analyzes the packet delay and loss in the communication flow. In addition, importance is attached to the low cost of the system, and each device is constructed using a normal PC.

In order to analyze the packet delay, it is necessary to accurately record the time at which the packets are acquired by each packet collection device, and high-precision time synchronization is required between the packet collection devices. However, in a packet collection device using a PC, the accuracy of the time held inside the PC is insufficient, and the time when a packet is acquired cannot be recorded accurately. For this reason, a mechanism for accurately recording the packet collection time is required. In Non-Patent Document 1, paying attention to the fact that the PC time error varies linearly for a short time even though there is an individual difference depending on the PC, time synchronization is performed from the base PC using a high-quality control network. The packet collection device corrects the packet collection time based on the time of the received time synchronization packet. In addition, a method for transmitting a time synchronization packet using an analysis target network instead of a control network, and a system for performing time synchronization of the packet collection time of the packet collection device based on an external signal such as GPS are devised. ing.
Atsushi Tagami, Hiroyuki Shinbo, Akira Idegami, Satoshi Hasegawa, “Design of Packet Delay / Loss Measurement System for Communication Tests”, IEICE General Conference, B-6-93, March 2003.

  However, when measuring at a long distance by a method using a control network, it is difficult to construct a high-quality control network at a long distance. In the method using the network to be analyzed, it is difficult to flow a control packet for measurement when the network to be analyzed is a commercial network. In addition, when performing time synchronization of the packet collection device using an advanced time generation device using NTP or GPS, even if the signal input from the time generation device is highly accurate, the signal from the packet collection device The accuracy is reduced by reading delay and error. For example, when a general-purpose PC is used as a packet collection device, the standard provided in the PC is used as the I / O interface between the PC and the time generation device. However, the interfaces currently provided in the PC are serial port, parallel port, USB, Ethernet (registered trademark), IEEE 1394, etc., all of which have a delay when reading time from the time generation device, and the delay time is constant. do not do. Therefore, the time synchronization of the packet collection device cannot be accurately taken. In addition, when the time is read from the time generation device each time a packet is collected, it is conceivable that the processing may not be in time if there are many packets to collect.

  The present invention has been made in order to solve the above-described problems. Even when the number of packets to be collected is large or the distance between the packet collection points is long, the packet is assigned with an accurate time. It is an object of the present invention to provide a packet collection device, a monitoring system, and a packet collection program that can collect data.

  The present invention relates to an in-device time generating means for generating time information indicating the time in the apparatus, a packet collecting means for collecting packets transmitted over a network and adding the time information to the packets, and the in-device time generation. Time information acquisition means for acquiring the reference time information from a reference time generation device for acquiring the time information from a means and generating reference time information indicating a reference time; and the time information acquired by the time information acquisition means And information storage means for storing the reference time information in association with each other, and correcting the time information added to the packet based on the time information stored in the information storage means and the reference time information And a correction formula calculation means for calculating a correction formula for correcting the time information added to the packet based on the correction formula. , It means a packet collection device characterized by comprising a.

  According to the present invention, the correction formula calculating means includes an error between the time information and the reference time information stored in the information storage means, and the acquisition timing of the time information and the acquisition timing of the reference time information. The packet collection apparatus according to claim 1, wherein the correction formula is calculated based on

  The present invention also provides a packet collection device that collects packets transmitted over a network, a reference time generation device that generates a reference time, and communication between the packet collection devices based on the packets collected by the packet collection device. In a monitoring system comprising a packet analysis device for analyzing a state, the packet collection device collects a packet transmitted through a network, a device time generation means for generating time information indicating a time in the device, and the time A time at which the reference time information is acquired from a reference time generation device that generates the reference time information indicating the reference time while acquiring the time information from the packet collection means for adding information to the packet and the internal time generation means Information acquisition means, the time information acquired by the time information acquisition means and the reference time Information storing means for associating and storing information, and a correction formula for correcting the time information added to the packet based on the time information and the reference time information stored in the information storing means And a correction unit that corrects the time information added to the packet based on the correction formula, and the packet analysis device corrects the time information. Time correction packet collection means for collecting the packets from the packet collection device; and analysis means for analyzing a communication state between the packet collection devices based on the packets collected by the time correction packet collection means. It is a monitoring system characterized by

  The present invention also provides an in-device time generating means for generating time information indicating the time in the apparatus, a packet collecting means for collecting packets transmitted through a network, and adding the time information to the packets, The time information is acquired from the time generation means, and the time information acquisition means for acquiring the reference time information from a reference time generation device that generates reference time information indicating a reference time, and the time information acquisition means Information storage means for associating and storing time information and the reference time information; and the time information added to the packet based on the time information stored in the information storage means and the reference time information. A correction formula calculating means for calculating a correction formula for correcting, and correcting the time information added to the packet based on the correction formula A correction unit that is a packet collection program for causing a computer to function as a.

  According to the present invention, even when the number of packets to be collected is large or the distance between the packet collection points is long, it is possible to collect packets with an accurate time.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram showing a configuration of a monitoring system according to an embodiment of the present invention. The communication node 101 is a node that communicates packets to be analyzed. Each monitoring device 102 is independent and includes a packet collection device 103 and a time generation device 104. The packet collection device 103 uses a PC as a general-purpose device. The monitoring device 102 is connected to the analysis target network 106 and monitors packets communicated between the communication nodes 101. The packet analysis device 105 collects the packets acquired by the monitoring device 102 and analyzes the delay state on the network. Although there are three monitoring devices 102 in FIG. 1, there may be more or fewer monitoring devices 102 than this.

  A case where packets are collected by the monitoring apparatus 102 will be described with reference to FIG. FIG. 2 is a block diagram of the monitoring apparatus 102 according to an embodiment of the present invention. The time generating device 104 generates a reference time signal using GPS, NTP, rubidium, or cesium transmitter. The PC time generation unit 201 generates a time to be used in the PC. The storage unit 202 stores the collected packet information, the acquired PC time, and the acquired reference time. The packet collection unit 203 collects packets transmitted through the analysis target network 106, acquires the PC time from the PC time generation unit 201, adds the PC time to the collected packets, and stores the collected time in the storage unit 202. The time acquisition unit 204 acquires the reference time from the time generation device 104, acquires the time of the PC from the PC time generation unit 201, and stores both in the storage unit 202 in association with each other. The time correction unit 205 corrects the PC time added to the packet stored in the storage unit 202 based on the reference time stored in the storage unit 202 and the PC time, and the time is corrected. The packet is stored in the storage unit 202.

  An operation example of this embodiment will be described. First, the packet collection unit 203 collects packets from packet collection points on the analysis target network 106. Subsequently, the packet collection unit 203 adds the collected time to the collected packet. Each time a packet is collected, the time is read from the time generation device 104, and if the read time is added to the collected packet, the process will not be in time, so the collected packet is generated by the PC time generation unit 201 that can be acquired at high speed. The time of the PC is temporarily added and stored in the storage unit 202. In parallel with this, the time acquisition unit 204 periodically acquires the reference time from the time generation device 104, simultaneously acquires the PC time from the PC time generation unit 201, and associates the reference time with the PC time. The data is stored in the storage unit 202.

  However, since the time of the PC time generation unit 201 is not accurate, the time of the PC time generation unit 201 deviates as time passes. This time lag is known to change linearly in the short term. Therefore, the correction time of the time t of a certain PC time generation unit 201 can be obtained by linear interpolation from the correspondence between the time of the PC time generation unit 201 and the time of the time generation device 104 recorded before and after t. However, a normal PC cannot acquire the times of the time generation device 104 and the PC time generation unit 201 at exactly the same timing. For this reason, the times of the time generation device 104 and the PC time generation unit 201 are sequentially read, and a read delay occurs. Also, this delay is not constant and an error occurs. FIG. 3 shows the timing at which the time of the time generator 104 and the PC time generator 201 is read by the monitoring device 102. The horizontal axis in FIG. 3 is time. Fge is a time acquisition function for the time acquisition unit 204 to acquire the time of the time generation device 104. Fpc is a time acquisition function for the time acquisition unit 204 to acquire the time of the PC time generation unit 201. Since Fge and Fpc cannot be executed at the same time, the flow of processing performed by the time acquisition unit 204 is “Fge call”, “Obtain the time of the time generation device 104”, “Fge returns”, “Fpc call”, “ The PC time generation unit 201 obtains the time and “Fpc returns”. Therefore, the delay in acquiring the values of Fge and Fpc is the time during which the time acquisition unit 204 acquires the time of the PC time generation unit 201 from the time when the time of the time generation device 104 is acquired. In order to reduce this read delay error, the time correction unit 205 performs time correction calculation.

  FIG. 4 is a diagram illustrating a correspondence between the time generated by the PC time generation unit 201 and the time generated by the time generation device 104 and a correction straight line. The horizontal axis (x axis) is the time of the PC time generation unit 201, and the vertical axis (y axis) is the time of the time generation device 104. In order to reduce the error, the correction is not based on the linear correction between the two points but on the multi-point regression line. However, this only obtains the average value of the delay, and the delay error does not become small. In the flow of processing performed by the time acquisition unit 204, the time of the time generation device 104 is acquired compared with the time of the PC time generation unit 201 in order to acquire the time of the PC time generation unit 201 after acquiring the time of the time generation device 104. The acquisition timing of is earlier. For this reason, the regression line is shifted in the negative y-axis direction by the average read delay as compared with an ideal correction line when there is no read delay. Therefore, the regression line is brought close to this ideal correction line. Since the delay time does not become negative, each plotted point is located in the negative y-axis direction from the ideal straight line. In order to bring the regression line closer to the ideal line, it is preferable to pass through the point with the smallest readout delay while maintaining the slope. This passes through the point with the smallest readout delay when the y-axis intercept is largest. The time of the PC time generation unit 201 is corrected using the delay and the straight line that reduces the influence of the delay error as a correction formula.

  When correcting the time t of the PC time generation unit 201, the calculation is performed as follows. FIG. 5 is a diagram showing a processing procedure for obtaining a correction straight line. TO [i] is the time sequence of the PC time generation unit 201 and is arranged in ascending order. TM [i] is the time array of the time generation device 104 corresponding to TO [i]. t is the time of the PC time generation unit 201 to be corrected. t ′ is the corrected time of the PC time generation unit 201. a and b ′ are elements of the correction formula. First, the correspondence between the time TO of the PC time generation unit 201 stored in the storage unit 202 and the time TM of the time generation device 104 is plotted in a range centered on the time t. Subsequently, the partial array TO [i] of the time TO of the plotted PC time generation unit 201 is obtained (step S501). Subsequently, the partial array TM [i] of the time TM of the time generation device 104 corresponding to TO [i] is obtained (step S502). Subsequently, an average value AVGTO of TO [i] is obtained (step S503). Subsequently, an average value AVGTM of TM [i] is obtained (step S504). Subsequently, a regression line is determined by the least square method from the plotted points of the time TO [i] of the PC time generation unit 201 and the time TM [i] of the time generation device 104 (steps S505 and S506). Subsequently, the time of the plotted points is sequentially substituted with the slope a of the regression line fixed, and the value of the largest intercept b ′ among the straight lines passing through the plotted points is obtained. (Steps S507 to S511). The obtained equation t ′ = a × t + b ′ is a correction equation for correcting the time of the PC time generation unit 201 (step S512).

  Subsequently, the time correction unit 205 corrects the time of the PC time generation unit 201 added to the packet when the packet stored in the storage unit 202 is acquired based on the formula obtained in step S512.

 With the above procedure, packets can be collected even when the number of packets to be collected is large. It is also possible to set the time at which the packet was recorded when the packet was collected to a highly accurate time.

 Next, the case where the communication state is analyzed when communication is performed between the communication nodes 101 based on the packets collected by the monitoring apparatus 102 will be described with reference to FIG. 6 as appropriate. FIG. 6 is a block diagram of a monitoring system according to an embodiment of the present invention. The time correction packet collection unit 601 collects the time-corrected packets from the storage unit 202 of the monitoring apparatus 102 and stores them in the time correction packet storage unit 602. The analysis unit 603 analyzes the communication state when communication is performed between the communication nodes 101 based on the time-corrected packet stored in the time correction packet storage unit 602.

 First, a plurality of packet collection points are defined on the network for analyzing the communication state. For example, the points are determined so as to sandwich the device to be investigated such as a router. Subsequently, a plurality of monitoring devices 102 are installed at the packet collection point, and packets transmitted and received are collected. As a result, each packet is captured by the plurality of monitoring apparatuses 102 before reaching the destination node from the source. For example, when the monitoring devices 102 are installed at three locations, one packet is collected by the three monitoring devices 102 until reaching the transmission destination from the transmission source. Subsequently, the monitoring apparatus 102 assigns and stores a reference time to the packet. Subsequently, the time correction packet collection unit 601 of the packet analysis apparatus 105 collects the time-corrected packets stored in the storage unit 202 of the monitoring apparatus 102 and stores them in the time correction packet storage unit 602. As a method of collecting the packet after the time correction by the packet collection unit 601, a method of collecting via a network or a method of collecting via a medium (recording medium) such as a CD / DVD can be considered. Subsequently, the analysis unit 603 obtains a delay between the monitoring apparatuses 102 based on the time-corrected packet in the time correction packet storage unit 602. For example, the time comparison is performed between the adjacent monitoring devices 102. If the time difference between the packets after the time correction is 50 ms, it takes 50 ms to pass between the packet measurement points where the monitoring devices are installed. It was necessary. In addition, when this value takes an abnormal value such as extremely large, it can be determined that there is a problem with the device or network in between.

   The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration and program are not limited to this embodiment, and design and the like within the scope of the present invention are included. .

   Further, a program for realizing the functions of the packet collection device 103 and the packet analysis device 105 shown in FIG. 1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system. Monitoring and packet analysis may be performed by executing. Here, the “computer system” may include an OS and hardware such as peripheral devices.

   Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used. The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a CD-ROM, a hard disk built in a computer system, etc. This is a storage device.

   Further, the “computer-readable recording medium” means a volatile memory (for example, DRAM (Dynamic DRAM) in a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Random Access Memory)), etc., which hold programs for a certain period of time.

   The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is the block diagram which showed the structure of the monitoring system by one Embodiment of this invention. It is a block diagram of the monitoring apparatus by one Embodiment of this invention. It is the figure which showed the time-axis of the read delay in the packet collection apparatus by one Embodiment of this invention. It is the figure which showed the time correction graph by one Embodiment of this invention. It is the figure which showed the procedure which calculates | requires the correction | amendment straight line by one Embodiment of this invention. 1 is a block diagram of a monitoring system according to an embodiment of the present invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 101 ... Communication node, 102 ... Monitoring apparatus, 103 ... Packet collection apparatus, 104 ... Time generation apparatus, 105 ... Packet analysis apparatus, 106 ... Analysis object network, 201 ... PC time generation unit, 202 ... storage unit, 203 ... packet collection unit, 204 ... time acquisition unit, 205 ... time correction unit, 601 ... time correction packet collection unit, 602 ... Time correction packet storage unit, 603... Analysis unit

Claims (4)

In-device time generating means for generating time information indicating the time in the device;
A packet collecting means for collecting packets transmitted through a network and adding the time information to the packets;
Time information acquisition means for acquiring the reference time information from a reference time generation apparatus for acquiring the time information from the internal time generation means and generating reference time information indicating a reference time;
Information storage means for storing the time information acquired by the time information acquisition means and the reference time information in association with each other;
A correction formula calculation unit that calculates a correction formula for correcting the time information added to the packet based on the time information and the reference time information stored in the information storage unit;
Correction means for correcting the time information added to the packet based on the correction formula;
A packet collection device comprising:  The correction formula calculation means is configured to correct the correction based on the time information and the reference time information stored in the information storage means and an error between the acquisition timing of the time information and the acquisition timing of the reference time information. The packet collection device according to claim 1, wherein an equation is calculated. A packet collection device that collects packets transmitted through a network, a reference time generation device that generates a reference time, and a packet analysis that analyzes a communication state between the packet collection devices based on the packets collected by the packet collection device In a monitoring system comprising a device,
The packet collection device includes:
In-device time generating means for generating time information indicating the time in the device;
A packet collecting means for collecting packets transmitted through a network and adding the time information to the packets;
Time information acquisition means for acquiring the reference time information from a reference time generation apparatus for acquiring the time information from the internal time generation means and generating reference time information indicating a reference time;
Information storage means for storing the time information acquired by the time information acquisition means and the reference time information in association with each other;
A correction formula calculation unit that calculates a correction formula for correcting the time information added to the packet based on the time information and the reference time information stored in the information storage unit;
Correction means for correcting the time information added to the packet based on the correction formula;
The packet analysis device
Time correction packet collection means for collecting the packet with the time information corrected from the packet collection device;
An analysis unit that analyzes a communication state between the packet collection devices based on the packets collected by the time correction packet collection unit. In-device time generating means for generating time information indicating the time in the device;
A packet collecting means for collecting packets transmitted through a network and adding the time information to the packets;
Time information acquisition means for acquiring the reference time information from a reference time generation apparatus for acquiring the time information from the internal time generation means and generating reference time information indicating a reference time;
Information storage means for storing the time information acquired by the time information acquisition means and the reference time information in association with each other;
A correction formula calculation unit that calculates a correction formula for correcting the time information added to the packet based on the time information and the reference time information stored in the information storage unit;
Correction means for correcting the time information added to the packet based on the correction formula;
Packet collection program to make the computer function as a computer.

Images