JP2009260706A - Accuracy improving method by post-processing time correction in packet measurement, correcting system, and program of same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve, with the accuracy higher than that in the prior art, a problem resulting from low accuracy of a clock for measurement with an ordinary low-price personal computer in view of achieving higher accuracy of time stamp. <P>SOLUTION: A general purpose computer 4 receives first a notifying packet from a network time synchronous protocol (hereinafter, referred to as NTP) server 2 and presets the setting for asynchronization with a built-in clock. The computer 4 also periodically executes the particular command for issuing an inquiry to the NTP server 2 and acquiring time information from a returning packet. In addition, the computer 4 periodically monitors deviation of the time by the packets from the NTP server 2 and statistically evaluates results of the plurality of inquiries started from the first inquiry in order to calculate amount of correction of the time error and correct, based on the amount of correction, a value of time stamp when the communication packets transmitted to a measuring object client terminal 3 from a measuring object server 5 are captured. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a method that can be utilized when performing quality measurement by capturing a communication packet in a packet communication network such as IP communication, that is, a network quality measurement technique using packet capture and its time stamp.

When performing network measurement by packet capture using a general-purpose computer (personal computer), indices such as delay and delay fluctuation are ITU-T Y. It is an index that is also defined in international standards such as 1540 Kokune and is an important measurement item.
In order to measure this delay and delay fluctuation, it is necessary to record the exact time captured at the time of packet capture, that is, to give a time stamp.
At this time, since the delay value and delay fluctuation value to be measured are typically in units of ms (milliseconds), the time stamp also needs to have an accuracy of at least about 1 ms, preferably about 0.1 ms.

When measuring with a personal computer, packet time stamping is performed with software, but if you use a general-purpose hardware computer that is not used for measurement, a clock with inaccurate accuracy is generally built in. Adversely affects measurement accuracy.
Conventionally, in order to solve this point, the following method has been used.
a. A method in which an expensive time supply source using GPS radio waves or CDMA radio waves is connected to a measurement personal computer, and the time of the measurement personal computer is synchronized with the time supply source.
b. A method of synchronizing the time between a time synchronization service (NTP server) on a network and a measurement personal computer.
c. A method of replacing the built-in clock of a measuring PC with a highly accurate clock element.

Ginkawa Kawaguchi, Katsunori Ori, “Time Calibration Method for Packet Capture Accuracy Evaluation” 2007 IEICE Communication Society Proceedings 2, B-7-46

The above-described conventional method has the following problems.
* A. And c. For that, expensive special equipment is required.
* A. In addition, the scope of application shall be restricted when it is difficult to reach the radio wave indoors.
* B. When using NTP (Network Time Synchronization Protocol), if it is set to always correct and synchronize, the time is corrected and corrected at a timing of once every few minutes. There is an influence such as the clock of the personal computer being shifted or the change is not stable, and the NTP itself is affected by the delay of the network and the accuracy of ms is not always obtained.

(the purpose)
The object of the present invention is to solve the problem of the conventional technique by solving the problem of the clock accuracy with a higher accuracy than in the past with respect to the measurement by a general inexpensive personal computer. An object of the present invention is to provide an accuracy improvement method and correction system by post-processing time correction in packet measurement that enables high accuracy, and a program thereof.

According to the method of improving accuracy by post-processing time correction in packet measurement according to the present invention, when the time when a packet is captured is measured by the internal clock of the PC including an error from the actual time, the internal clock of the PC is always set to NTP ( Network time synchronization protocol) Instead of synchronizing with a server, it is possible to make the time stamp highly accurate by grasping the error between the NTP server and the built-in clock and correcting the time stamp at the time of packet capture.
Further, the post-processing time correction system of the present invention copies the communication packet to the mirror port when passing the communication packet from the measurement target server to the measurement target client terminal at the time of measurement. A switch means for transferring the communication packet to the capture port of the connected general-purpose computer for measurement, an NTP server for synchronizing the time of the network, and a notification packet via the NTP communication port between the NTP server And a general-purpose computer for measurement that receives a response packet to the inquiry, periodically monitors the time lag due to the packet from the NTP server, and corrects the time stamp value at the time of capturing the communication packet with the calculated correction amount; Consists of.

  According to the present invention, it is possible to solve the problem caused by the low accuracy of the clock with a higher accuracy than before in the measurement by a general inexpensive personal computer, and to make the time stamp highly accurate.

  First, the accuracy of the built-in clock in general computers is poor because it cannot be maintained due to temperature changes, etc. If it is corrected appropriately, it is at a level sufficient for measurement in minutes to tens of minutes. It is known that it is stable (see the time correction method in Non-Patent Document 1 above). Here, the stability at a sufficient level means that “the deviation due to the watch itself is about 0.1 ms or less”.

B. The problems of correction by NTP are mainly the following two points.
1) Since ntp packets from the NTP server are transmitted over the network, the time accuracy is not stable.
2) By performing time correction based on the time information notified from the NTP server by the ntp packet to the internal clock of the local personal computer as needed, the following problems occur and the time stamped by the built-in clock is not stable. .
* Time jump at the moment of correction of the built-in clock * Difference in clock speed before and after correction (to apply a parameter to correct the self-running speed of the clock to the OS)

For the above 1), instead of evaluating each NTP packet from the NTP server individually, the difference between the time information of the periodic NTP time notification packet and the local internal clock is recorded over time and statistically recorded. Evaluation can improve accuracy.
The problem 2) can be avoided by setting "Do not dare to synchronize the built-in clock by NTP".
Regarding the time lag due to the lack of synchronization by NTP, since it is premised on correcting the time data in relation to the measure 1), there is no adverse effect on the measurement result.
The error evaluation / processing contents are substantially the same as the contents processed internally by the NTP time synchronization software (NTP daemon). Normally, when the NTP daemon processes the contents, the above 2 ) Cannot be compared with packet capture data processing. Therefore, a method for avoiding synchronization processing of the NTP daemon is effective when focusing on measurement purposes.

Hereinafter, specific embodiments will be described with reference to the drawings.
FIG. 1 is an explanatory diagram of a method of improving accuracy by post-processing time correction in packet measurement according to the present invention.
In FIG. 1, 1 is a switch for exchanging communication, 2 is an NTP server, 3 is a measurement target client terminal, 4 is a measurement PC (personal computer), 5 is a measurement target server, 11 is a mirror port in the switch 1, and 41 is measurement. An NTP communication port 42 of the PC for measurement 4 is also a capture port of the measurement PC 4.

Here, the following configuration will be described as an example.
* PC4 for measurement,
* NTP server 2,
* Measurement target packet stream (P): p1, p2, p3,...
* Measurement target packet capture time stamp (Θ); τ1, τ2, τ3, ...
* NTP server inquiry time (T): t1, t2, t3,.
* Time deviation response amount (D) in NTP server response: d1, d2, d3,...
From the PC
(1) It is possible to communicate with an NTP server through a network port (can exchange NTP packets)
(2) The capture target packet stream is visible from the PC network port,
These two points are assumed. It should be noted that (1) and (2) may be the same network port of the PC or may use different network ports, but neither of them affects the present invention.
Further, in order to make the capture target stream visible from the network port of the PC, it can be generally performed by setting the mirror port of the NW switch or the like, but the specific method is outside the scope of the claims of the present invention. .

At the time of measurement in FIG. 1, a communication packet from the measurement target server 5 to the measurement target client terminal 3 is copied to the mirror port 11 according to the setting of the connected switch 1, and the capture port 42 of the measurement PC 4 is set to the mirror port. 11 to capture and evaluate the communication packet.
In addition, the measurement PC 4 needs to communicate with the NTP server 2 separately, and performs NTP communication with the NTP server 2 using another NTP communication port 41 of the measurement PC 4.

The operation of the measurement PC 4 will be described.
Two types of processes are required to be operated simultaneously during measurement.
a. An implementation method for a general Linux OS for the “time acquisition / recording process” is shown below. In this example, an inquiry is repeatedly made to the NTP server 2 whose IP address is 192.168.0.123 every 10 seconds and recorded in the “ntpdate-query.log” file.

% Touch ntpdate-query. log
% While true; don tpdate -q 192.168.0.123 >> ntpdate-query. log; sleep 10; done (continues time acquisition until forced termination by the above command)
Thus, the following data is recorded in the “ntpdate-query.log” file.

server 192.168.0.123, stratum 1, offset-0.000276, delay 0.02618
19Mar 14:13:47 ntpdate [69715]: adjust time server 192.168.0.123 offset-0.000276 sec
server 192.168.0.123, stratum 1, offset-0.000252, delay 0.02617
19 Mar 14:13:57 ntpdate [69717]: adjust time server 192.168.0.123 offset-0.000252 sec
server 192.168.0.0.123, stratum 1, offset-0.000326, delay 0.02620
19 Mar 14:14:07 ntpdate [69719]: adjust time server 192.168.0.123 offset-0.000326 sec
server 192.168.0.123, stratum 1, offset-0.0264, delay 0.02620
19 Mar 14:14:17 ntpdate [67921]: adjust time server 192.168.0.123 offset-0.000264 sec ...

Here, in the line starting with “server”, the next value of “offset” indicates a time lag with the NTP-server at each time point (when the local time is delayed, it indicates a positive value). ).
In the above example, for example, the deviation at the time of 19 Mar 14:14:17 is −0.000264 seconds (indicating that the internal clock has advanced 0.000264 seconds from the time reported by NTP-server).

The error of the clock tends to increase the deviation with a substantially constant width. Therefore, if the above error (Δτ) is used as a function of time T and statistically regressed every fixed time (for example, every 60 minutes), the correction amount at each time can be calculated (fixed time). This is because the first and higher order error factors due to temperature changes cannot be ignored in the longer term).
That is, the error estimation amount (Δτ) can be expressed as a function f (T) at time T,
Δτ = f (T): (T is the current time indicated by the local PC built-in clock)
Therefore, the estimated value of the true time is T + f (T).

B. Regarding the “capture process” for capturing a packet to be measured, a command example in a general Linux PC is shown again as follows:% tcpdump −I eth0 −w packet-capture. pcap
Here, for convenience of explanation, the following uses temporary names:
eth0: I / F name of the network I / F for capture on the capture PC packet-capture. pcap: File name for saving captured data

  This capture data (packet-capture.pcap) is given a time stamp by the local PC built-in clock before time correction, and is recorded with an incorrect time. In addition, an accurate time stamp can be estimated by performing time correction by f (T) (reading the time stamp t given to each packet by t + f (t)).

(Example of error evaluation method)
The time of inquiry to the NTP server is t (as the time on the local PC clock), and the amount of deviation reported in the response from the NTP server is d:
* NTP inquiry time (T): t1, t2, t3, ...
* Error amount (D): d1, d2, d3, ...
That is, in the stage before statistical evaluation, the time indicated by the internal clock of the PC as t1 is actually estimated as (t1-d1). Note that this estimated value is not very accurate because it includes errors in each NTP inquiry.

Here, since there is usually a substantially linear correlation between the sequence T and the sequence D, for example, when evaluation is performed by a general least square regression method, parameters (a, b) of the following linear regression equations And the estimated error d at any time t can be evaluated as a function f (t):
d = f (t)
= A * t + b
When measuring over several hours or more, even if it is statistically evaluated, it is affected not only by a linear change (the effect of the coefficient a) but also by a temperature change. As a result, the speed of the built-in clock itself changes, and it is necessary to evaluate the second and higher order errors. This can be dealt with by evaluating the broken line by dividing it in an appropriate time unit such as one hour.
As a specific evaluation method at this time, the [time correction method] of Non-Patent Document 1 may be used as it is.

The measurement target stream is captured by executing the tpdump command if the unix system os is performed simultaneously with the periodic time check described above, and by using the window. exe is possible.
The time stamp given by the PS of the personal computer to the captured packet is inaccurate as it is.

Therefore, the captured data is converted into an estimated value of the true time using the result of the error evaluation described above.
* Capture packet (p): p1, p2, p3, ...
* Capture time stamp (Θ): τ1, τ2, τ3, ...

After conversion, the estimated capture time is obtained as follows:
* Estimated true time of capture: f (τ1), f (τ2), f (τ3), ...
= (1-a) * τ1-b, (1-a) * τ2-b, (1-a) * τ3-b,...
As described above, the present method need not be limited to the linear regression equation, and can be applied as it is if a more accurate regression equation / statistical evaluation method is used.

FIG. 2 is a flowchart showing a procedure of post-processing time correction according to the present invention.
First, at the time of measurement, a communication packet from the measurement target server 5 to the measurement target client terminal 3 is copied to the mirror port 11 according to the setting of the connected switch 1, and the capture port 42 of the measurement PC 4 is changed to the mirror port 11. Connect to confirm that the communication packet has been captured (step 101).
Next, the measurement PC 4 performs NTP communication with the NTP server 2 by using another NTP communication port 41 in the same time zone as when capturing from the mirror port, and the NTP server every fixed period. An inquiry command is transmitted to 2 to confirm whether time correction data from the NTP server has been collected (step 102). For example, the inquiry is repeated to the NTP server 2 every 10 seconds, and the time difference between the packet received from the NTP server 2 and the internal clock is recorded. Since the error of the clock tends to increase the deviation with a substantially constant width, for example, the correction amount at each time can be calculated by statistically regressing every 60 minutes. That is, the correction amount is calculated at each time when the packet is received (step 104).
By correcting with the correction amount, an accurate time stamp at the time of capturing the communication packet is obtained (step 105).

  By programming the steps of the flowchart shown in FIG. 2 and recording the program on a recording medium such as a CD-ROM, the program is installed on the PC 4 and executed by mounting the recording medium on the PC 4 for calculation. Then, the present invention can be easily realized. Further, the program can be generalized by repeatedly downloading the program from the PC 4 to another PC via the Internet.

It is a block diagram of the post-processing time correction system by this invention. 5 is a flowchart according to a method for improving accuracy by post-processing time correction according to the present invention.

Explanation of symbols

1 switch 2 NTP server 3 client terminal to be measured 4 PC for measurement
5 Measurement target server 11 Mirror port 41 NTP communication port 42 Capture port

Claims (4)

A method of accurately calibrating the packet capture time given by the general-purpose computer when performing network quality measurement by packet capture using the network interface of the general-purpose computer,
The general purpose computer first receives a notification packet from a network time synchronization protocol (hereinafter referred to as NTP) server, and is set not to synchronize with the internal clock.
The general-purpose computer makes an inquiry to the NTP server by periodically executing a specific command, acquires time information from a return packet,
The general-purpose computer periodically monitors a time lag due to a packet from an NTP server, and statistically evaluates a query result from one to a plurality of times, thereby calculating a correction amount of a time error,
A method for improving accuracy by correcting post-processing time in packet measurement, wherein a time stamp value at the time of packet capture is corrected by the correction amount. A method of accurately calibrating the packet capture time given by the general-purpose computer when performing network quality measurement by packet capture using the network interface of the general-purpose computer,
First, during measurement, the communication packet from the measurement target server to the measurement target client terminal is copied to the mirror port of the connected switch, and the communication packet is captured via the capture port of the general-purpose computer for measurement. ,
The general-purpose computer performs NTP communication with an NTP server using another NTP communication port in the same time zone as capturing from the mirror port, and sends an inquiry command to the NTP server at regular intervals. To collect time correction data from the NTP server,
The general purpose computer records a time shift between the packet received from the NTP server and the internal clock,
Calculate the correction amount at each point of packet reception,
An accuracy improvement method by post-processing time correction in packet measurement, wherein an accurate time stamp value at the time of capture is obtained by correcting the time of the built-in clock by the correction amount. When performing network quality measurement by packet capture using a network interface of a general-purpose computer, a system for accurately calibrating the packet capture time given by the general-purpose computer,
At the time of measurement, when passing a communication packet from the measurement target server to the measurement target client terminal, the communication packet is copied to the mirror port, and the capture port of the general-purpose computer for measurement connected via the mirror port Switch means for forwarding the communication packet to
An NTP server that performs network time synchronization;
A notification packet and a response packet to the inquiry are received via the NTP communication port with the NTP server, and a time shift due to the packet from the NTP server is periodically monitored, and the above correction amount is used to calculate the above A post-processing time correction system in packet measurement, comprising: a measurement general-purpose computer that corrects a time stamp value at the time of capturing a communication packet. A post-processing time correction program for packet measurement,
Procedure for capturing communication packets from the measurement target server to the measurement target client terminal to the general purpose computer from the capture port via the mirror port of the connected switch, the same as capturing from the mirror port NTP communication is performed with an NTP server using another NTP communication port during a time period, an inquiry command is transmitted to the NTP server at regular intervals, and time correction data from the NTP server is collected. A procedure for recording a time difference between the packet received from the NTP server and the internal clock, a procedure for calculating a correction amount at each received time, and correcting the time stamp value at the time of capturing the communication packet by the correction amount Program for post-processing time correction in packet measurement to execute each procedure

Images