JP2010081534A - Packet analyzing apparatus, program and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To string packets input/output after start of communication from an input-side communication device to an output-side communication device when analyzing packets input to/output from a packet processor. <P>SOLUTION: A packet analyzing apparatus performs analysis relating to a packet input to/output from a packet processor that processes a packet sent from a first communication device to a second communication device. The packet analyzing apparatus includes: a means for holding an input/output data packet; a means for specifying a corresponding pair of input/output reference packets before and after processing due to the packet processor; and a means for specifying a corresponding pair of input/output data packets before and after processing due to the packet processor on the basis of timing in which an input reference packet is input and timing in which an output reference packet is output, the input reference packet and the output reference packet specifying the corresponding at least. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a packet analysis device, a program, and a method, and can be applied to, for example, calculation of an in-device delay time of a media conversion device.

  Conventionally, a real-time transport protocol (RTP) packet (refer to Non-Patent Documents 1 and 2) input to a media conversion device is output as an external packet as a delay time in the device until the RTP packet after media conversion is output As an analysis method using an analysis device, as shown in FIG. 8, a mirroring function of a switch (hereinafter referred to as “SW”) to which a media conversion device is connected (copies a packet and causes the packet analysis device to acquire it). Thus, the packet analysis device acquires (packet capture) the RTP packet input from the transmission side communication device to the media conversion device and the RTP packet sent from the media conversion device toward the reception side communication device, After that, the RTP packet held in the packet analyzer The RTP sequence number is used to associate the RTP packet on the input side and the output side in the media conversion device (hereinafter also referred to as “correlation”), and the timing at which the associated RTP packet is acquired, that is, In-device processing time in the media conversion device is calculated based on the timing input or output in the media conversion device. The RTP sequence number is a unique value assigned to each RTP packet.

In a normal media converter, when an input RTP packet is processed and output, the RTP sequence number is reassigned to a number of another system, so the RTP sequence number is set on the input side and the output side. It cannot be tied if it matches. Therefore, in the conventional packet analysis method, the packet analysis device starts capturing RTP packets input / output to / from the media conversion device before the RTP packet is first input to the media conversion device from the transmission side communication device. However, it is necessary to link the RTP packets that are input and output in order from the first one.
IETF RFC1889 IETF RFC3550

  However, in the conventional packet analysis method, the packet analysis device starts capturing RTP packets input / output to / from the media conversion device before the RTP packet is first input from the transmission side communication device to the media conversion device. Therefore, there is a problem that when the capture is started in the middle of communication, the RTP packet on the input side and the output side in the media conversion device cannot be linked.

  Therefore, in the packet analysis input / output to / from the packet processing device that processes the packet sent from the input side communication device to the output side communication device, after the start of communication from the input side communication device to the output side communication device, A packet analysis apparatus, program, and method that can link input and output packets are desired.

  The packet analysis device according to the first aspect of the present invention provides (1) packet processing for processing a packet sent from the first communication device to the second communication device and sending the packet to the second communication device. In the packet analysis device for performing analysis relating to a packet input / output to / from the device, (2) an input data packet into which data is inserted, which is input from the first communication device to the packet processing device, and the packet processing device A data packet holding means for holding an output data packet into which data is inserted, sent from the first communication device to the second communication device; and (3) input from the first communication device to the packet processing device. An input reference packet that is a predetermined type of packet, and an output reference that is a predetermined type of packet sent from the packet processing device to the second communication device Reference packet correspondence specifying means for specifying a pair corresponding to a packet before and after processing by the packet processing device; and (4) at least an input reference packet whose correspondence is specified by the reference packet correspondence specifying means. Based on the timing input to the packet processing device and the timing at which the output reference packet is output from the packet processing device, the input data packet and the output data packet held in the data packet holding means Data packet correspondence specifying means for specifying a pair corresponding to before and after processing by the processing device is provided.

  The packet analysis program according to the second aspect of the present invention provides (1) packet processing for processing a packet sent from the first communication device to the second communication device and sending the packet to the second communication device. (2) an input data packet into which data has been inserted, which is input from the first communication device to the packet processing device; A data packet holding means for holding an output data packet into which data is inserted, sent from the packet processing device to the second communication device; and (3) the packet processing from the first communication device. An input reference packet that is a predetermined type of packet input to the device, and a predetermined type that is transmitted from the packet processing device to the second communication device A reference packet correspondence specifying means for specifying a pair corresponding to an output reference packet that is a packet before and after processing by the packet processing device; and (4) at least correspondence is specified by the reference packet correspondence specifying means The input data packet and the output are held in the data packet holding unit based on the timing when the input reference packet is input to the packet processing device and the timing when the output reference packet is output from the packet processing device. The data packet is made to function as a data packet correspondence specifying means for specifying a pair corresponding to the data packet before and after processing by the packet processing device.

  The packet analysis method according to the third aspect of the present invention includes (1) packet processing for processing a packet sent from the first communication device to the second communication device and sending the packet to the second communication device. In a packet analysis method for analyzing a packet input to and output from an apparatus, (2) a data packet holding unit, a reference packet correspondence specifying unit, and a data packet correspondence specifying unit are provided. (3) The data packet holding unit includes: An input data packet into which data is inserted, which is input from the first communication device to the packet processing device, and an output into which data is inserted, which is sent from the packet processing device to the second communication device. (4) the reference packet correspondence specifying means is a packet of a predetermined type inputted from the first communication device to the packet processing device. The input reference packet that is a packet and the output reference packet that is a predetermined type of packet that is sent from the packet processing device to the second communication device before and after the processing by the packet processing device (5) the data packet correspondence specifying means includes at least a timing at which an input reference packet is input to the packet processing apparatus, whose correspondence is specified by the reference packet correspondence specifying means, and an output reference; Based on the timing when the packet is output from the packet processing device, the input data packet and the output data packet held in the data packet holding unit are set corresponding to before and after processing by the packet processing device. It is characterized by specifying.

  According to the present invention, in packet analysis input / output to / from a packet processing device that processes a packet sent from an input-side communication device to an output-side communication device, after starting communication from the input-side communication device to the output-side communication device, Packets input / output to / from the packet processing device can be linked.

(A) Main Embodiment Hereinafter, an embodiment of a packet analysis device, a program, and a method according to the present invention will be described in detail with reference to the drawings.

(A-1) Configuration of Embodiment FIG. 2 is a block diagram showing a functional configuration of the entire communication system 1 according to this embodiment.

  In FIG. 2, the communication system 1 includes a packet analysis device 10, a media conversion device 20, SWs 31 and 32, two communication devices 41 and 42, and networks N1 and N2.

  The communication devices 41 and 42 are communication terminals connected to the network N1 and the network N2, respectively, as shown in FIG. 2, and use RTP, RTP Control Protocol (RTCP; see IETF RFC3605) via the media conversion device 20. Communication.

  The SW 31 is a switching hub that connects the media conversion device 20 to the network N1. The SW 32 is a switch for connecting the media conversion device 20 to the network N2. In FIG. 2, SWs 31 and 32 are set to transfer packets input / output in the media conversion device 20 to a port to which the packet analysis device 10 is connected, for example, by a port mirroring function. To do. In FIG. 2, packets input / output in the media conversion device 20 are transferred to the port connected to the packet analysis device 10 by the port mirroring function of the SWs 31 and 32, but directly to the media conversion device 20. Connection may be made, and the configuration for the packet analysis device 10 to acquire a packet input / output in the media conversion device 20 is not limited.

  The media conversion device 20 performs media conversion such as audio packets and video packets for interconnecting RTP and RTCP between the communication devices 41 and 42.

As described above, the packet analysis device 10 acquires (captures) packets input / output in the media conversion device 20 via the SWs 31 and 32, and calculates a time related to the in-device delay time in the media conversion device 20. It is. The in-device delay time in the media conversion device 20 is, for example, the time from when the media conversion device 20 acquires a packet from the communication device on the transmission side to the conversion and starts transmission of the packet to the communication device on the reception side. Say. Also, for example, when the data to be transmitted in the RTP packet is composed of a plurality of RTP packets such as video codecs, the media conversion device 20 receives the last RTP packet for one image. After the change, the time from the start of transmission until the first RTP packet starts to be transmitted may be used as the in-device delay time. FIG. 1 is a block diagram showing a functional configuration inside the packet analysis device 10.

  The packet analysis device 10 includes a filter unit 11, an input packet buffer unit 12, an output packet buffer unit 13, an RTP detection unit 14, a control processing unit 15, an RTCP detection unit 16, a database unit 17, an analysis target registration unit 18, and an output unit 19. have.

  The packet analysis device 10 includes a program execution configuration such as a CPU, ROM, RAM, EEPROM, and hard disk, and a device having an interface for communicating with other communication devices (not limited to one, but a plurality of devices are distributed) It is constructed by installing the packet analysis program of the embodiment, etc., and can be functionally shown as in FIG. 1 described above. .

  In the analysis target registration unit 18, it is assumed that the analysis target registration unit 18 registers a set of identification information of terminals related to communication for which the in-device delay time is calculated. In this embodiment, as an example, in the analysis target registration unit 18, the IP address (192.168.0.1) of the communication device 41 is registered as a communication device on the transmission side, and as the communication device on the reception side. It is assumed that a set of IP addresses (192.168.0.2) of the communication device 42 is registered. In other words, in the packet analysis device 10, a packet sent from the communication device 41 toward the communication device 42 becomes a target of analysis based on the registration contents of the analysis target registration unit 18. In order to simplify the description, in this embodiment, it is assumed that only one set of IP addresses is registered in the analysis target registration unit 18, but a plurality of sets may be registered. Further, the terminal identification information registered in the analysis target registration unit 18 is not limited to the IP address, but may be any information that can identify the terminal, such as a Mac address or a domain name.

  The filter unit 11 extracts a packet (hereinafter referred to as “target packet”) from which the in-device delay time is calculated from all the acquired packets. In this embodiment, the filter unit 11 uses the IP address registered in the analysis target registration unit 18 as a target packet as an RTP packet, or a packet related to sender report among RTCP packets. (Hereinafter referred to as “sender report packet”). That is, in FIG. 1, the filter unit 11 extracts the RTP packet and the sender report packet transmitted from the communication device 41 toward the communication device 42 as target packets. In the filter unit 11, the RTP or sender report packet is identified by referring to the header information of the acquired packet.

  Also, the filter unit 11 provides the RTP packet data of the target packet to the input packet buffer unit 12 or the output packet buffer unit 13, and provides the RTCP packet data to the RTCP detection unit 16.

  The filter unit 11 gives the data related to the packet input to the media conversion device 20 among the target packets to the input packet buffer unit 12, and outputs the data related to the packet output from the media conversion device 20 to the output packet buffer unit. 13 As a method for identifying whether the target packet is a packet input or output by the media conversion device 20 in the filter unit 11, for example, according to the SW through which the packet analysis device 10 obtains the packet If the destination layer 2 (MAC) address of the packet is the address of the media conversion device 20, it is determined that the packet is input to the media conversion device 20, and conversely the transmission source The method of identifying whether the packet is input from the media conversion device 20 or the output packet is not limited, such as determining that the packet is output from the media conversion device 20.

  When the RTP packet is given to the input packet buffer unit 12 and the output packet buffer unit 13, the filter unit 11 gives the data of the application (layer 5: RTP) layer or higher and discards the data of the layer 4 or lower. good. Further, when providing the sender report packet to the RTCP detection unit 16, the filter unit 11 may provide data of the application (layer 5: RTCP) layer or higher and discard data of the layer 4 or lower.

  The input packet buffer unit 12 and the output packet buffer unit 13 each have a buffer function for holding the RTP packet given from the filter unit 11. In addition, when the RTP packet is given from the filter unit 11, the input packet buffer unit 12 and the output packet buffer unit 13 have the RTP packet data and the time when the RTP packet is given (hereinafter referred to as “acquisition time”). Information is stored as a set. The acquisition time may be, for example, the time from when the packet analysis device 10 is activated until the present time. The acquisition time may be the time when the filter unit 11 acquires each RTP packet, but the processing time in the filter unit 11 is within an error range that can be ignored in the analysis in the packet analysis device 10. Alternatively, as in this embodiment, the acquisition time may be the time when the RTP packet is given to the input packet buffer unit 12 and the output packet buffer unit 13. Further, the packet analysis apparatus 10 may perform the packet analysis by regarding the above acquisition time as the time when the media conversion apparatus 20 inputs or outputs the packet.

  Further, the input packet buffer unit 12 and the output packet buffer unit 13 discard the data of the held RTP packet in accordance with the control from the control processing unit 15.

  The RTP detection unit 14 extracts information necessary for packet analysis from the RTP packets held in the input packet buffer unit 12 and the output packet buffer unit 13 and supplies the information to the control processing unit 15. The information extracted from the RTP packet by the RTP detection unit 14 includes an acquisition time, detection of the RTP payload amount of each RTP packet, detection of an RTP sequence number, and a payload type (hereinafter referred to as “PT”) value in the RTP header. Information.

  When the RTCP packet is given from the filter unit 11, the RTCP detection unit 16 extracts information necessary for packet analysis from the RTCP packet and gives it to the control processing unit 15. Examples of information extracted from the RTCP packet by the RTCP detection unit 16 include a sender's packet count value (hereinafter referred to as “sender packet count value”) and an RTP timestamp value.

  The database unit 17 stores information related to the codec (media) supported by the media conversion device 20.

  FIG. 3 is an explanatory diagram showing an example of information registered in the database unit 17.

  As information stored in the database unit 17, for example, as shown in FIG. 4, the division period and payload length information and the PT value for each codec supported by the media conversion device 20 are registered. Also good.

  The output unit 19 is a unit that outputs a processing result or the like in the control processing unit 15. The output by the output unit 19 may be configured to be displayed on a display device such as a display, stored in a storage device such as a disk device, or printed on a printing device such as a printer. Is unquestionable.

  The control processing unit 15 has a function of controlling the entire packet analysis apparatus 10. For example, the control processing unit 15 sets the filter unit 11 and discards data in the input packet buffer unit 12 and the output packet buffer unit 13. Control.

  Further, the control processing unit 15 determines that the packet held in the output packet buffer unit 13 is based on the information given from the RTP detection unit 14 and the RTCP detection unit 16 and the information registered in the database unit 17. It is detected which of the packets held in the input packet buffer unit 12 can be linked. Packets that can be linked are packets that are corresponded before and after conversion by the media conversion device 20. The control processing unit 15 calculates the in-device delay time based on the acquisition time of the associated RTP packet. For example, for a linked RTP packet, a time obtained by subtracting the acquisition time of the RTP packet on the input side from the acquisition time of the RTP packet on the output side is the in-device delay time.

  Further, the control processing unit 15 determines whether the RTP packet held by the input packet buffer unit 12 and the output packet buffer unit 13 is a packet related to an audio codec or a packet related to a video codec. This is because the processing procedure for associating RTP packets differs depending on whether the packet is related to the audio codec or the video codec. As a means for determining whether the control processing unit 15 is a packet related to an audio codec or a packet related to a video codec, for example, a PT value may be acquired through the RTP detection unit 14 and determined. Good.

  In addition, when the target packet is a packet related to the voice codec, the control processing unit 15 controls the RTP detection unit 14 as processing necessary for associating the sender report packet and the RTP packet, For any RTP packet held by the input packet buffer unit 12 and the output packet buffer unit 13, information related to the format of each RTP packet is acquired, and the packet division period on the input side in the media conversion device 20 and the output Analyzes the correspondence between the packet division periods on the side.

  As a method for the control processing unit 15 to analyze the packet division period, for example, the RTP detection unit 14 is controlled and any RTP packet held by the input packet buffer unit 12 and the output packet buffer unit 13 is controlled. If the PT value and payload length in each header match, it is determined that the packet division period is the same, that is, one RTP packet on the output side corresponds to one RTP packet on the input side. May be.

In addition, as a method for the control processing unit 15 to analyze the packet division period, for example, the information on the payload amount and the PT value of the RTP packet is acquired via the RTP detection unit 14, and the codec corresponding to the acquired information is obtained. The packet division period is searched from the information held in the database unit 17, and the packet division period on the input side and the least common multiple of the packet division period on the output side are obtained. The correspondence relationship between the period and the packet division period on the output side may be analyzed. For example, when the PT value of the RTP packet held by the output packet buffer unit 13 is 18 and the payload length is 160 bytes, it can be determined that the packet division period is 20 msec. For example, when the PT value of the RTP packet held by the input packet buffer unit 12 is 8 and the payload length is 40 bytes, the packet division period can be determined to be 40 msec. In this example, the packet division cycle on the input side in the media conversion device 20 is 20 msec and the packet division cycle on the output side is 40 msec. Therefore, the least common multiple is the output side packet division cycle 1 with respect to the packet division cycle 1 on the input side. Since the packet division period is 2, the control processing unit 15 can determine that two packets of the output RTP packet correspond to one RTP packet on the input side. The control processing unit 15 includes: When it is determined that the RTP packet held by the output packet buffer unit 13 is a packet related to a voice codec, the input side and the output side further specify what is associated with the sender report packet. , This associated sender report packet is referred to as a reference packet (hereinafter referred to as “reference packet”). ), RTP packets acquired on the input side and the output side are linked thereafter or before (details will be described in the description of the operation described later).

  If the RTP packet input / output to / from the media conversion device 20 is a video codec, decoding / encoding is performed in the media conversion device 20, so the number of RTP packets to be input / output is the same for the codec, etc. Are not necessarily consistent. In the case of a video codec, one frame is formed by a plurality of RTP packets. Therefore, it is necessary to specify the first packet and the last packet forming one frame. In one frame, the first RTP packet has a start bit flag indicating a predetermined bit (in this embodiment, “0001”) in the media header portion of the payload portion, and the last RTP packet Is a protocol in which the marker bit flag in the RTP header is “1”. Therefore, in this embodiment, when the control processing unit 15 determines that the RTP packets held by the input packet buffer unit 12 and the output packet buffer unit 13 are packets related to the video codec, RTP detection is performed. The control unit 14 is controlled to acquire information related to detection of the start bit / mark bit for the target packet and link the RTP packet using the information as well (details will be described in the description of the operation described later) To do).

  When the target packet is a packet related to a video codec, a reference packet other than the sender report packet may be used as the reference packet, as in the case of the audio codec described above. good.

  For example, when MPEG is used as a video codec, a video frame is an I-frame (Intra-coded Frame) that has been encoded within one video frame, or a P-frame that predicts motion from a temporally previous frame. (Predicted Frame) is a B-frame (Bi-directional Predicted Frame) for predicting motion using temporally forward and backward frames. A set of frames between an I frame and the next I frame is regarded as one set, and this is called GOP (Group Of Pictures). I frames are usually inserted at intervals of 15 to 30 frames, depending on the application and product. In this embodiment, it is assumed that RTP packets constituting this I frame, not the sender report packet, are used as reference packets, and RTP packets before or after the I frame are linked on the input side and output side. explain.

  In the media converter 20, even if a system other than MPEG is used as the video codec, a reference frame that is completely encoded in one video frame corresponding to the I frame, and the frame In the case of a method in which a group similar to the GOP is formed by a plurality of frames having reference difference data, a packet related to a reference frame may be applied as a reference packet.

  As a method for identifying the type of each frame, the data inserted in each RTP packet may be referred to by referring to information for identifying the type of frame, or determined according to the data amount of each frame. You may do it. Since the data amount of the P frame and the B frame is smaller than that of the I frame, the I frame can be detected from the data amount of each RTP packet. Note that the data amount of each frame may be obtained, for example, by summing up the payload lengths of the RTP packets constituting each frame.

  For each frame, as means for detecting an I frame according to the data amount, for example, a threshold value may be provided, and a frame having a data amount larger than the threshold value may be specified as an I frame. For example, when the data amount of the B or P frame is 1000 to 2000 bytes and the I frame is 6000 to 7000 bytes, a frame of 5000 bytes or more may be specified as the I frame.

  Further, for example, the data amount of the first frame is compared with the data amount of the second frame generated immediately before or after the first frame, and the first frame is determined as I according to the ratio or the difference. It may be determined whether or not it is a frame. For example, when the data amount of the first frame is three times or more (the number of times to be set is not limited) of the data amount of the second frame, the first frame is specified as the I frame. May be. Also, for example, when the data amount of the first frame is 3000 bytes or more larger than the second frame (how much difference is not limited), the first frame is identified as an I frame. You may do it.

  In addition, the control processing unit 15 calculates the in-device delay time in the media conversion device 20 and causes the output unit 19 to output the calculation result. When the control processing unit 15 calculates the in-device delay time for each RTP packet, the control processing unit 15 further calculates the maximum value of the in-device delay time (hereinafter referred to as “maximum in-device delay time”) and the average value of the in-device delay time ( (Hereinafter referred to as “average device delay time”) may be output. Note that a method for calculating the in-device delay time will be described in detail in the operation description to be described later.

(A-2) Operation | movement of embodiment Next, the operation | movement (packet analysis method of embodiment) of the packet analysis in the communication system 1 of this embodiment which has the above structures is demonstrated.

(A-2-1) Overall Operation of Packet Analysis Device First, the overall operation of the packet analysis device 10 will be described.

  First, in the packet analysis device 10, the packets input / output to / from the media conversion device 20 are acquired by the mirroring function of the SWs 31 and 32, and further target packets are extracted from the acquired packets. Among the extracted target packets, the RTP packet is given to the input packet buffer unit 12 or the output packet buffer unit 13, and the sender report packet is given to the RTCP detection unit 16 (S101).

  Then, the RTCP detection unit 16 extracts information necessary for packet analysis from the given sender report packet, gives it to the control processing unit 15, and the reference input to the media conversion device 20 in the control processing unit 15. A process of associating a packet (for example, a sender report packet, an RTP packet related to an I frame) and an output reference packet with a corresponding one is performed (S102).

  In step S102, it is determined whether the target packet is an RTP packet related to an audio codec or an RTP packet related to a video codec. If it is determined that the target packet is an RTP packet related to an audio codec, When the associating process is performed, the correspondence relationship between the input side packet division period and the output side packet division period in the media conversion device 20 is also analyzed.

  Then, the RTP detection unit 14 extracts information necessary for packet analysis from the given RTP packet and provides it to the control processing unit 15. Then, in the control processing unit 15, the RTP packet held in the output packet buffer unit 13 is selected from the RTP packets held in the input packet buffer unit 12 by using the result of the association in step S <b> 102 described above. It is detected which RTP packet can be linked (S103).

  Then, based on the acquisition time of the associated RTP packet, the in-device delay time is calculated and output by the output unit 19, and the data relating to the RTP packet for which the calculation has been completed is input packet buffer unit 12, output packet buffer It is discarded from the unit 13 (S104) and starts again from step S103 described above.

(A-2-2) RTP packet linking and intra-device delay time calculation (a) When the packet division period is the same before and after conversion First, in the media conversion of the media conversion device 20, the target packet is This relates to an audio codec, and when the packet division period before and after conversion is the same, that is, the period of the packet input from the communication apparatus 41 to the media conversion apparatus 20 and the packet output from the media conversion apparatus 20 Details of the processing in steps S102 to S104 described above when the period is the same will be described. The correspondence relationship between the input side packet division period and the output side packet division period in the media conversion device 20 is analyzed in step S102 described above.

  FIG. 5 is a timing chart showing an example of calculation of the in-device delay time in the packet analysis device 10 when the media conversion of the media conversion device 20 has the same packet division period before conversion and after conversion.

  In FIG. 5, P111 to P113 indicate acquisition timings of the RTP packets held in the input packet buffer unit 12 and contents related to the respective RTP packets. P121 to P123 indicate the acquisition timing of the RTP packet held in the output packet buffer unit 13 and the contents related to each RTP packet. P131 indicates the timing at which the sender report packet input to the media conversion device 20 is acquired and the contents related to the sender report packet. P141 indicates the timing at which the sender report packet output from the media converter 20 is acquired, and the contents related to the sender report packet.

  In the case of FIG. 5, it is determined that P131 and P141 having the same sender packet count value are linked as the link of the sender report packet by the control processing unit 15 in step S102 described above. In FIG. 5, since the time stamp value of P131 is 2567, it may be determined that the time stamp value is acquired at a timing between P111 having a time stamp value of 2500 and P112 having a time stamp value of 2600. good.

  Next, the association between the packet held in the output packet buffer unit 13 and the RTP packet held in the input packet buffer unit 12 in step S103 in the case of FIG. 5 will be described.

  As described above, since it has been determined that P131 and P141 can be linked as a sender report packet, the control processing unit 15 links RTP packets acquired at subsequent timings based on P131 and P141. It is determined that it can be done. That is, it is determined that P112 (sequence number: 2346) acquired at the timing immediately after P131 and P123 acquired at the timing immediately after P141 (sequence number: 1236) can be linked. Therefore, thereafter, the RTP packets held in the input packet buffer unit 12 and the output packet buffer unit 13 are sequentially associated. For example, it can be determined that the RTP packet having the sequence number 2347 in the input packet buffer unit 12 and the RTP packet having the sequence number 1237 in the output packet buffer unit 13 can be associated. In the above example, the RTP packets acquired at the timing after the reference sender report packet are linked, but the RTP packets acquired at the previous timing may be linked.

  Next, a method for calculating the in-device delay time in the above-described step S104 in the case of FIG. 5 will be described.

  In the control processing unit 15, the in-device delay time is calculated for the RTP packet linked in step S103 described above. For example, since P112 and P123 are linked as described above, the in-device delay time in this case is 1.18-1.16 = 0.02 sec.

(B) When the packet division period is different before and after conversion Next, in the media conversion of the media conversion apparatus 20, when the target packet is related to the voice codec, and the packet division period after conversion is different from that before conversion Details of the processing in steps S102 to S104 will be described. The correspondence relationship between the input side packet division period and the output side packet division period in the media conversion device 20 is analyzed in step S102 described above.

  FIG. 6 is a timing chart illustrating an example of calculation of the in-device delay time in the packet analysis device 10 when the media conversion of the media conversion device 20 is different between the pre-conversion and post-conversion packet division periods. In FIG. 6, it is assumed that the packet division cycle on the input side of the media conversion device 20 is 20 msec and the packet division cycle on the output side is 40 msec. That is, two RTP packets on the output side correspond to one RTP packet on the input side.

  In FIG. 6, P211 to P213 indicate the timing at which the RTP packets held in the input packet buffer unit 12 are acquired and the contents relating to the respective RTP packets. P221 and P222 indicate the acquisition timing of the RTP packet held in the output packet buffer unit 13 and the contents related to each RTP packet. P231 indicates the timing at which the sender report packet input to the media conversion device 20 is acquired and the contents related to the sender report packet. P241 indicates the timing at which the sender report packet output from the media converter 20 is acquired, and the contents related to the sender report packet.

  In the case of FIG. 6, since the sender report packet is linked by the control processing unit 15 in step S102 described above, the sender packet count value of P231 is 4, and the packet count value of P241 is 2. Since it is in a 2-to-1 relationship and matches the ratio of the least common multiple of the packet division period, it is determined that P231 and P241 are linked. In FIG. 6, since the time stamp value of P231 is 2488, it may be determined that the time stamp value is acquired at a timing before P211 which is 2500. Since the time stamp value of P241 is 3768, it may be determined that the time stamp value is acquired at a timing between P221 having a time stamp value of 3600 and P222 having a time stamp value of 3800.

  Next, the association of the packet held in the output packet buffer unit 13 and the RTP packet held in the input packet buffer unit 12 in the above-described step S103 in the case of FIG. 6 will be described.

  As described above, since it is determined that P231 and P241 can be linked as a sender report packet, the control processing unit 15 links RTP packets acquired at subsequent timings with P231 and P241 as a reference. It is determined that it can be done. That is, two P211 (sequence number: 2345) and P212 (sequence number: 2346) acquired at the timing immediately after P231 can be linked to P222 (sequence number 1236) acquired at the timing immediately after P241. It is determined. Therefore, thereafter, the RTP packets held in the input packet buffer unit 12 and the output packet buffer unit 13 are sequentially associated. For example, although illustration is omitted, if two RTP packets with sequence numbers 2347 and 2348 in the input packet buffer unit 12 and an RTP packet with sequence number 1237 in the output packet buffer unit 13 can be associated with each other Can be judged. In the above example, the RTP packets acquired at the timing after the reference sender report packet are linked, but the RTP packets acquired at the previous timing may be linked.

  Next, a method for calculating the in-device delay time in the above-described step S104 in the case of FIG. 6 will be described.

  In the control processing unit 15, the in-device delay time is calculated for the RTP packet linked in step S103 described above. For example, since P211, P212 and P222 are linked as described above, the in-device delay time in this case is compared with the acquisition time of P212 and the acquisition time of P222. = 0.01 sec.

(C) In the case of a video codec Next, when the target packet relates to a video codec, details of the processing in steps S102 to S104 described above will be described. Note that whether or not the RTP packet input / output to / from the media conversion device 20 relates to the video codec is analyzed in the above-described step S102. In FIG. 7, P 311 to P 315 indicate the acquisition timing of the RTP packet held in the input packet buffer unit 12 and the contents related to each RTP packet. P321 to P326 indicate the acquisition timing of the RTP packet held in the output packet buffer unit 13 and the contents related to each RTP packet.

  In FIG. 7, the media conversion device 20 performs media conversion in units of frames and outputs the result. That is, when an RTP packet for one frame is input, the media conversion device 20 performs media conversion on the frame and outputs an RTP packet related to the converted frame.

In the case of FIG. 7, as the association of the reference packet (the RTP packet related to the I frame) by the control processing unit 15 in step S <b> 102 described above, first, in the control processing unit 15, via the RTP detection unit 14, Information (start flag, marker flag, etc.) related to the RTP packets held in the input packet buffer unit 12 and the output packet buffer unit 13 is acquired, and each RTP packet is grouped in units of frames. Whether it is an I frame is detected. As a result, P311 and P312 are RTP packets constituting an I frame on the input side, and P323 and P324 are RTP packets constituting an I frame on the output side. In addition, on the input side, it is recognized that P313 and P314 constitute one frame, and P325 and P326 also constitute one frame.

  In the following description, it is assumed that the media conversion apparatus 20 converts and outputs an I-frame RTP packet before the next I-frame RTP packet is input. Then, after the I frame composed of P311 and P312 is acquired on the input side, and before the next RTP packet of the I frame is acquired on the input side, the I composed of P323 and P324 is acquired on the output side. Since the frames are acquired, the RTP packets related to these I frames can be linked.

Next, the association between the packet held in the output packet buffer unit 13 and the RTP packet held in the input packet buffer unit 12 in the above-described step S103 in the case of FIG. 7 will be described.

  As described above, since it has been determined that the I frame composed of P311 and P312 and the I frame composed of P323 and P324 can be linked, the control processing unit 15 transmits the RTP packets related to these I frames. As a reference, it is determined that RTP packets related to frames acquired at subsequent timings can also be linked.

  For example, in FIG. 7, on the input side, a pair of P313 and P314 which are RTP packets related to a frame acquired at a timing immediately after P312 constituting the I frame, and immediately after P324 constituting the I frame on the output side A pair of P325 and P326, which are RTP packets related to the frame acquired at the timing, is linked. In the above example, the RTP packets related to the frame acquired at the later timing of the RTP packet related to the reference I frame are linked, but the RTP packets related to the frame acquired at the previous timing are linked together. It may be.

  Next, a method for calculating the in-device delay time in the above-described step S104 in the case of FIG. 7 will be described.

  In the control processing unit 15, the in-device delay time is calculated for the RTP packet linked in step S103 described above. For example, as described above, the P311 and P312 on the input side and the P323 and P324 on the output side are linked, so the delay time in the device in this case is a comparison between the acquisition time of P312 and the acquisition time of P323. 1.16-1.15 = 0.01 sec.

(A-3) Effects of Embodiment According to this embodiment, the following effects can be achieved.

  In the packet analysis device 10 of this embodiment, first, the reference packet is linked (see step S102 in FIG. 4 described above), and the RTP packet is linked using the reference packet as a mark (described above in FIG. 4). (See step S103). Thereby, even after the communication from the communication device 41 is started, the RTP packet input / output to / from the media conversion device 20 can be linked, and the in-device delay time can be calculated.

  In the packet analysis device 10, the RTP detection unit 14 analyzes the contents of the RTP packet input / output to / from the media conversion device 20 and specifies the packet division period of the RTP packet input / output to / from the media conversion device 20. Yes. Then, the RTP packet input / output to / from the media conversion device 20 is linked using the specified packet division period (see FIG. 6 described above). Thereby, in the RTP packet input / output to / from the media conversion device 20, even when the packet division period is different between the input side and the output side, the RTP packet is linked, and the delay time in the device is calculated. be able to.

  Further, in the packet analysis device 10, the RTP detection unit 14 analyzes the contents of the RTP packet input / output to / from the media conversion device 20, and when it is determined that the RTP packet is a video codec, the start in each RTP packet Bits and marker bits are detected, which RTP packets are combined to form one frame, and a set of RTP packets forming one frame is determined on the input side and output side with reference to the I frame. They are tied (see FIG. 7 above). As a result, even when the content of the RTP packet is a video codec, the RTP packet can be linked and the in-device delay time can be calculated.

(B) Other Embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments as exemplified below.

(B-1) In the above embodiment, the packet analysis device 10 has been described as linking RTP packets input / output to / from the media conversion device 20 and calculating the in-device delay time. Instead of calculating the time, only the association of RTP packets may be analyzed, and the analysis result may be output to the output unit 19. Using the analysis result of the RTP packet linking, for example, before and after processing of the RTP packet by the media conversion device 20 is compared, whether the media conversion by the media conversion device 20 is correctly performed, etc. It can be used to analyze the operation of

(B-2) In the above embodiment, the packet analysis apparatus 10 associates RTCP packets (see step S102 in FIG. 4 above), and associates RTP packets using the RTCP packet as a mark ( The above-described protocol (see step S103 in FIG. 4) is described, but the protocol for packet analysis is not limited to the combination of RTCP and RTP. For example, a communication control packet in which communication control information other than RTCP is inserted is transmitted from the transmission side communication device (communication device 41) to the reception side communication device (communication device 42) at regular or irregular intervals. In this case, the communication control packet is linked, and data other than RTP that is sent from the transmission side communication device (communication device 41) to the reception side communication device (communication device 42) is inserted as a mark. It is also possible to associate the data packets that are made on the input side and the output side.

(B-3) In the above embodiment, the packet analysis device 10 analyzes the packet input / output in the media conversion device 20, but the target to be analyzed is input / output to / from the media conversion device 20. It is not limited to a packet, for example, a packet encryption device, a proxy server, or the like such as a packet sent from a transmission side communication device (communication device 41) is subjected to some processing and directed to a reception side communication device (communication device 42). You may apply to the other apparatus (henceforth a "packet processing apparatus") to send out.

(B-4) In the above embodiment, the control processing unit 15 holds the data of the sender report packet detected by the RTCP detection unit 16 on both the input side and the output side. Only the data related to the sender report packet may be held, and when the sender report packet that can be linked is generated on the output side, the timing of the sender report packet on the input side and the output side may be detected.

(B-5) In the above embodiment, the packet analysis device 10 describes that the RTP packet corresponds to both the video codec and the audio codec. However, the packet analysis device 10 supports only one of them. Also good. When the packet analysis device 10 supports only the video codec, the database unit 17, the RTCP detection unit 16, and other configurations for performing processing related to the RTCP packet may be omitted.

(B-6) In the above embodiment, the timing at which the sender report packet is acquired is detected by comparing the RTP timestamp value of the sender report packet with the timestamp value of the RTP packet. (See FIGS. 5 and 6 above), the sender report packet may also be detected by measuring the acquisition time and comparing it with the acquisition time of the RTP packet.

It is the block diagram shown about the functional structure inside the packet analysis apparatus which concerns on embodiment. 1 is a block diagram illustrating an overall configuration of a communication system according to an embodiment. It is explanatory drawing shown about the example of the information registered into the database part which concerns on embodiment. It is the timing chart shown about the operation | movement (when a packet division | segmentation period is the same) of the packet analysis apparatus which concerns on embodiment. It is the timing chart shown about the operation | movement (when a packet division | segmentation period differs) of the packet analysis apparatus which concerns on embodiment. 6 is a timing chart showing an operation (in the case of a video codec) of the packet analysis apparatus according to the embodiment. 5 is a timing chart illustrating the operation of the packet analysis apparatus according to the embodiment. It is explanatory drawing shown about the conventional packet analysis method.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Communication system, 10 ... Packet analysis apparatus, 11 ... Filter part, 12 ... Input packet buffer part, 13 ... Output packet buffer part, 14 ... RTP detection part, 15 ... Control processing part, 16 ... RTCP detection part, 17 ... Database unit, 18 ... analysis target registration unit, 19 ... output unit, 20 ... media conversion device, 31, 32 ... SW, N1, N2 ... network, 41, 42 ... communication device.

Claims (6)

Packet analysis for processing packets sent from the first communication device to the second communication device and performing analysis on packets input to and output from the packet processing device sent to the second communication device In the device
An input data packet into which data is inserted, which is input from the first communication device to the packet processing device, and an output into which data is inserted, which is sent from the packet processing device to the second communication device. Data packet holding means for holding data packets;
An input reference packet that is a predetermined type of packet input from the first communication device to the packet processing device, and a predetermined type of packet that is transmitted from the packet processing device toward the second communication device. A reference packet correspondence specifying means for specifying a pair corresponding to an output reference packet that is a packet before and after processing by the packet processing device;
Based on at least the timing at which the input reference packet is input to the packet processing device and the timing at which the output reference packet is output from the packet processing device. Packet analysis comprising: data packet correspondence specifying means for specifying a pair corresponding to the input data packet and the output data packet held by the data packet holding means before and after processing by the packet processing device. apparatus.   Based on at least the timing at which the input data packet is input to the packet processing device and the timing at which the output data packet is output from the packet processing device. 2. The packet analysis device according to claim 1, further comprising delay time calculating means for calculating an in-device delay time in the data processing device.     The packet analysis apparatus according to claim 1 or 2, wherein the input reference packet and the output reference packet are packets into which communication control data is inserted. The packet processing apparatus processes a video packet for each video frame,
3. The packet analysis device according to claim 1, wherein the input reference packet and the output reference packet are packets into which data relating to a predetermined type of video frame is inserted. Packet analysis for processing packets sent from the first communication device to the second communication device and performing analysis on packets input to and output from the packet processing device sent to the second communication device The computer installed in the device
An input data packet into which data is inserted, which is input from the first communication device to the packet processing device, and an output into which data is inserted, which is sent from the packet processing device to the second communication device. Data packet holding means for holding data packets;
An input reference packet that is a predetermined type of packet input from the first communication device to the packet processing device, and a predetermined type of packet that is transmitted from the packet processing device toward the second communication device. A reference packet correspondence specifying means for specifying a pair corresponding to an output reference packet that is a packet before and after processing by the packet processing device;
Based on at least the timing at which the input reference packet is input to the packet processing device and the timing at which the output reference packet is output from the packet processing device. It is made to function as a data packet correspondence specifying means for specifying a pair corresponding to an input data packet and an output data packet held in the data packet holding means before and after processing by the packet processing device. Packet analysis program. Packet analysis for processing packets sent from the first communication device to the second communication device and performing analysis on packets input to and output from the packet processing device sent to the second communication device In the method
Data packet holding means, reference packet correspondence specifying means, data packet correspondence specifying means,
The data packet holding means is input from the first communication device to the packet processing device, the input data packet into which data is inserted, and sent from the packet processing device to the second communication device. Hold the output data packet with the data inserted,
The reference packet correspondence specifying unit is configured to input a reference packet that is a predetermined type of packet input from the first communication device to the packet processing device, and from the packet processing device to the second communication device. For the output reference packet, which is a predetermined type of packet that has been sent out, identify a pair corresponding to before and after processing by the packet processing device,
The data packet correspondence specifying means includes at least the timing at which the input reference packet is input to the packet processing apparatus, the output of which is specified by the reference packet correspondence specifying means, and the output reference packet is output from the packet processing apparatus. A packet analysis unit for identifying a pair corresponding to the input data packet and the output data packet held by the data packet holding unit before and after the processing by the packet processing device based on the received timing Method.

Images