JP2010213239A - Packet loss frequency estimation system, packet loss frequency estimation method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a packet loss frequency estimation system for estimating the frequency of packet loss at reduced processing costs. <P>SOLUTION: In a packet loss frequency estimation system, based on information stored in a packet information storage region for storing information corresponding to the value of a field including at least an acknowledgement number inside a packet, an observation probability calculating means 95 calculates an observation probability that is a ratio for the number of packet losses to be reflected to a predetermined counting result, to be counted in the number of incurred packet losses in accordance with a mode for storing the information in the packet information storage region. An estimation means 96 estimates the number of actually incurred packet losses from the predetermined counting result counted based on the information stored in the packet information storage region and the observation probability. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a packet loss frequency estimation system, a packet loss frequency estimation method, and a packet loss frequency estimation program for estimating the frequency of packet loss (number of times packet loss has occurred) as the quality of a communication network.

  Non-Patent Document 1 describes a method for detecting packet loss in end-to-end communication. For example, the method described in Non-Patent Document 1 is applied to an apparatus that measures the quality of communication between terminals in a communication network in which a large number of terminals are connected to each other. In the method described in Non-Patent Document 1, a packet capture unit is provided in a path between terminals, and the capture unit fully captures a packet passing through the path. The capture unit holds the acknowledgment number of the passed packet, and detects a packet loss when a plurality of packets having the same acknowledgment number are generated (that is, when a duplicate ACK phenomenon occurs).

  FIG. 17 is a block diagram illustrating an example of a measuring instrument that detects packet loss by the method described in Non-Patent Document 1. As a configuration of the packet loss measuring device 211 to which the method described in Non-Patent Document 1 is applied, as shown in FIG. 17, a flow identification unit 2101, a database (hereinafter referred to as DB) 2105, and a counter / DB A configuration including a reading unit 2102, a number comparison unit 2103, a counter / DB writing unit 2104, and a result reading unit 2106 can be considered. The DB 2105 stores, for each flow, an acknowledgment number in a packet immediately before the same flow and a count value indicating the number of times that the acknowledgment numbers overlap. When the flow identifying unit 2101 reads each packet 91, the flow identifying unit 2101 identifies the flow of the packet. The packet flow is identified by an IP address for each transmission / reception, a port number for each transmission / reception, a protocol ID and the like.

  The counter / DB reading unit 2102 reads from the DB 2105 the confirmation response number of the immediately previous packet in the same flow as the new packet identified by the flow identification unit 2101 and the count value indicating the number of overlaps of the confirmation response number. The number comparison means 2103 compares the confirmation response number of the new packet identified by the flow identification means 2101 with the confirmation response number of the packet immediately before the same flow, and if they match, the read count value 1 is added to the counter, and the count value is not changed if they do not match. After this processing, the counter / DB writing unit 2104 causes the DB 2105 to store the confirmation number of the new packet and the count value after the processing of the number comparison unit 2103.

  The result reading unit 2106 reads and outputs the count result stored in the DB 2105 at regular intervals.

  Methods for estimating packet loss are also described in, for example, Patent Documents 1 and 2. Further, Patent Document 3 refers to a learning table that stores port numbers of previously received packets and a frame storage memory that stores port numbers of newly received packets. Describes a communication device for comparing port numbers of packets. Patent Document 4 describes an IP packet counting method in which packets are classified by port number and the number of packets is counted in a table.

Republished Patent International Publication Number WO2006 / 043624 (paragraphs 0025, 0047, 0052) JP 2008-219127 A (paragraph 0110-0114) JP 2004-320248 A (paragraphs 0086 and 0087) JP 11-205386 (paragraphs 0024-0026)

Tomohiko Ogishi, Akira Idegami, Satoshi Hasegawa, Yasuhiko Kato, “Design of Performance Monitor that Collects TCP Level Statistics from One-Way IP Traffic”, Proceedings of the 2000 IEICE General Conference, Electronics Information and Communication Society, p. 96, 2000

  In order to detect duplication of confirmation response numbers by the method described in Non-Patent Document 1 etc., it is necessary to confirm the confirmation response number by observing the packet received immediately before in the flow of the packet when receiving the packet. . If the confirmation response number matches between the received packet and the previous packet, it is determined that the confirmation response number is duplicated, and if the confirmation response number does not match, it is recognized that no overlap occurs. Since this operation is state processing, the cost (processing time and calculation amount) of quality measurement processing of the communication network increases. Note that state processing means processing that cannot be determined by referring to only one packet to be observed. The method described in Non-Patent Document 1 determines processing by referring not only to a newly received packet but also to a packet that was received immediately before, and thus costs such as processing time increase.

  Further, in the configuration illustrated in FIG. 17, after the counter / DB writing unit 2104 writes the confirmation response number of the previous packet in the same flow as the new packet in the DB 2105 in order to detect the overlap of the confirmation response number. Otherwise, even if a new packet arrives, the counter / DB reading means 2102 cannot start the process of reading the confirmation response number of the immediately preceding packet. For this reason, the upper limit of the processing speed for measuring the packet loss is limited to a series of operation speeds of the counter / DB reading unit 2102, the number comparison unit 2103, and the counter / DB writing unit 2104.

  The frequency of overlap of acknowledgment numbers is an indicator of packet loss, but duplication of acknowledgment numbers is observed by a plurality of packets. In the configuration shown in FIG. 17, when a new packet arrives, a comparison with the immediately preceding packet is performed, which increases the processing cost. The frame storage memory and the learning table described in Patent Document 3 store the port number. However, even if the confirmation response number is stored instead of the port number, the confirmation response number of the immediately preceding packet is stored in the learning table. Otherwise, comparison with a new packet cannot be performed, so that the processing cost increases as in the configuration shown in FIG. Further, it is not possible to determine how many confirmation response numbers are duplicated simply by comparing the frame storage memory and the learning table.

  Accordingly, an object of the present invention is to provide a packet loss frequency estimation system, a packet loss frequency estimation method, and a program for estimating the frequency of packet loss at a low processing cost.

  The packet loss frequency estimation system according to the present invention is based on information stored in a packet information storage area that stores information corresponding to the value of a field including at least an acknowledgment number in a packet among the number of packet losses that have occurred. An observation probability calculation means for calculating an observation probability, which is a ratio of the number of packet losses reflected in a predetermined counting result to be counted, according to a mode of storing information in the packet information storage area, and stored in the packet information storage area It is characterized by comprising estimation means for estimating the number of packet loss actually generated from a predetermined counting result counted based on the obtained information and the observation probability.

  Further, the packet loss frequency estimation method according to the present invention includes the information stored in the packet information storage area for storing information corresponding to the value of the field including at least the acknowledgment number in the packet among the number of generated packet losses. The observation probability, which is the ratio of the number of packet losses reflected in the predetermined counting result counted based on the information stored in the packet information storage area, is calculated according to the mode of storing information in the packet information storage area. The number of packet loss actually generated is estimated from a predetermined counting result counted based on the observation probability.

  The packet loss frequency estimation program according to the present invention is stored in a packet information storage area for storing information corresponding to the value of a field including at least an acknowledgment number in a packet, out of the number of packet losses that have occurred. An observation probability calculation process for calculating an observation probability, which is a ratio of the number of packet losses reflected in a predetermined count result counted based on the received information, according to a mode of storing information in the packet information storage area, and a packet An estimation process for estimating the number of packet losses actually generated from a predetermined count result counted based on information stored in the information storage area and an observation probability is executed.

  According to the present invention, the frequency of packet loss can be estimated at a low processing cost.

It is explanatory drawing which shows the example of arrangement | positioning of a packet loss frequency estimation system. It is a block diagram which shows 1st Embodiment of the packet loss frequency estimation system of this invention. It is explanatory drawing which shows the example of the bit string memorize | stored in each memory M1, M2. It is explanatory drawing which shows the example of a process of a common number calculation means. It is explanatory drawing which shows the example of duplication degree distribution. It is explanatory drawing which shows the example of the probability Aj. It is a flowchart which shows the example of the process progress of an information registration means. It is a flowchart which shows the example of the process progress of a total process means. It is a flowchart which shows the example of process progress of step B3. It is a block diagram which shows 2nd Embodiment of the packet loss frequency estimation system of this invention. It is explanatory drawing which shows the example of the change of the duplication degree distribution before and behind sampling. It is a flowchart which shows the example of the process progress of an information registration means. It is a flowchart which shows the example of the process progress of a total process means. It is a flowchart which shows the example of process progress of step B3 '. It is explanatory drawing which shows the example of a change of the estimation precision at the time of changing communication environment on the assumption that observation environment is constant. It is a block diagram which shows the minimum structure of this invention. It is a block diagram which shows the example of the measuring device which detects the loss of a packet with the method described in the nonpatent literature 1.

  Embodiments of the present invention will be described below with reference to the drawings.

Embodiment 1. FIG.
FIG. 1 is an explanatory diagram illustrating an arrangement example of the packet loss frequency estimation system. In the example illustrated in FIG. 1, the terminals 11 to 15 perform communication by transmitting and receiving packets. A packet loss frequency estimation system is arranged on a communication path between each terminal in the communication network. In the example illustrated in FIG. 1, each of the devices 21 to 25 corresponds to a packet loss frequency estimation system. Each device 21 to 25 estimates the frequency of packet loss. The packet loss frequency is the frequency (number of occurrences) of packet loss. In the example illustrated in FIG. 1, each device 21 to 25 outputs the estimated frequency of packet loss to the server 31. The server 31 manages the frequency of packet loss in each of the devices 21 to 25.

  Each device 21 to 25 estimates the frequency of occurrence of packet loss for each packet flow. For example, the device 25 shown in FIG. 1 is located on the communication path of the terminals 11 and 12, is also located on the communication path of the terminals 15 and 12, and is located on the communication path of the terminals 13 and 14. Accordingly, the terminal 25 transmits both a packet from the terminal 11 to the terminal 12 (hereinafter referred to as flow A) and a packet from the terminal 15 to the terminal 12 (hereinafter referred to as flow B). The packet of the flow to 14 (hereinafter referred to as flow C) is also passed. Then, the terminal 25 calculates the frequency of packet loss for each packet flow such as flows A, B, and C.

  The packet loss frequency estimation system according to the present invention also provides information (acknowledgment response number) for confirming how much data has arrived at the receiving terminal toward the data transmitting terminal. Intended for sending protocol. A typical example of such a protocol is TCP (Transmission Control Protocol), but the protocol to which the present invention is applicable is not limited to TCP. For example, the present invention may be applied to SCTP (Stream Control Transmission Protocol). In addition, even for UDP (User Datagram Protocol), the present invention is applied if a unique protocol for adding a sequence number indicating how much data has reached the receiving terminal to the payload is defined in the application layer. can do.

  The devices 21 to 25 shown in FIG. 1 may be nodes such as routers and switches existing in a communication network, or devices that perform analysis based on information input from a TAP or a mirror port of the device. There may be.

  FIG. 2 is a block diagram showing a first embodiment of the packet loss frequency estimation system of the present invention. Although FIG. 2 is illustrated as a block diagram of the device 21 corresponding to the packet loss frequency estimation system, the devices 21 to 25 in FIG. 1 have the same configuration. The packet loss frequency estimation system 21 of the present invention includes information registration means 71 and totalization processing means 72. The information registration unit 71 includes a flow identification unit 61, a memory writing unit 62, and a packet information holding unit 63. The aggregation processing unit 72 includes a memory reading unit 64, a common number calculation unit 65, a protocol characteristic holding unit 66, an observation probability calculation unit 67, and an E2E loss calculation unit 68.

  The information registration unit 71 classifies the received packet for each flow, and stores information corresponding to the value of the field including at least the acknowledgment number in the packet. Further, the aggregation processing unit 72 estimates the frequency of packet loss based on the information. The information registration unit 71 performs a process every time a packet is received, and the aggregation processing unit 72 performs a packet loss frequency estimation process regardless of the packet reception timing.

  The flow identification unit 61 receives the packet 51 that passes through the packet loss frequency estimation system, and identifies the flow of the packet 51. The flow identifying unit 61 classifies packets for each flow by regarding that the packet groups having the same specific field of the received packets are the same flow. For example, a set of one or more items of a transmission IP address, a reception IP address, a transmission port number, a reception port number, a transmission MAC address, a reception MAC address, and a protocol ID (protocol identification information) is determined in advance. If each item of the set is the same in a plurality of packets, the flow identifying means 61 considers the plurality of packets to be the same flow. Here, a transmission IP address, a reception IP address, a transmission port number, a reception port number, a transmission MAC address, a reception MAC address, and a protocol ID are exemplified, but in addition to this, the packet loss frequency estimation system / router input port number Etc. may be used as one of the items for specifying the packet flow. That is, the flow identification means 61 includes a transmission address, a reception address, a transmission port number, a reception port number, a protocol ID, an input port number of the packet loss frequency estimation system, and an output port number of the packet loss frequency estimation system in the packet. A set of at least some of the items is defined, and if the items of the set are the same for a plurality of packets, the plurality of packets may be classified as one group.

  In FIG. 2, each packet indicated by a solid line is the same flow, and each packet indicated by a broken line belongs to another flow.

  The packet information holding means 63 has a plurality of packet information storage areas Mi (i = 1, 2,..., N) for storing information corresponding to the value of the field including at least the acknowledgment number in the packet for each flow. A storage device. That is, n packet information storage areas M1 to Mn are provided for each flow. Here, a packet information storage area Mi (i = 1, 2,..., N) for storing information corresponding to a field value including at least an acknowledgment number in a packet is a bit string having a predetermined bit length. A case where the storage area is a storage area will be described as an example. The packet information storage area Mi (i = 1, 2,..., N) is referred to as a memory. Here, as an example, a value corresponding to an acknowledgment number in a packet received by the packet loss frequency estimation system is stored in the memory Mi (i = 1, 2,..., N).

  Here, the case where n = 2 and two memories M1 and M2 are used for one flow will be described as an example, but the number of memories (packet information storage areas) used for one flow is described. Is not limited to two, and may be plural.

  The memory writing unit 62 receives a packet from the flow identification unit 61 and classifies the packet for each flow, and then, a plurality of memories (in this example, two memories M1, M1) corresponding to the group into which the packet is classified. One memory of M2) is selected, and information corresponding to the acknowledgment number of the received packet is stored in the selected memory. In the present embodiment, M1 and M2 are storage areas for storing a bit string having a predetermined bit length. An example will be described in which the memory writing unit 62 stores 1 in the bit position corresponding to the acknowledgment number in the bit string having a predetermined bit length as the information corresponding to the acknowledgment number of the received packet. To do.

  The method in which the memory writing unit 62 selects one of the plurality of memories Mi may be, for example, a method of selecting a memory at random. When selecting a memory at random, a random number may be used. For example, a random number value may be assigned equally to each of the memories M1 and M2, a random number may be generated when the memory is selected, and a memory corresponding to the random number value may be selected. Further, the memory writing means 62 may select a memory by a round robin method in which each memory is selected in order. For example, in one flow, the memory may be selected in the order of M1, M2, M1, M2,... For each received packet. In addition, each memory may be preliminarily weighted with a probability to be selected, and the memory may be selected according to the probability. For example, P1 may be selected as a selection probability for selecting M1, and 1-P may be selected as a selection probability for selecting M2, and one of the memories may be selected according to the selection probability.

  The memory writing means 62 stores 1 in the bit position corresponding to the acknowledgment number in the bit string having a predetermined bit length in the selected memory.

  The method for determining the correspondence between the acknowledgment number and the bit position in the bit string may be, for example, a method of simply associating each acknowledgment number directly with the bit position in the bit string. That is, an acknowledgment number is directly assigned to each bit position in the bit string, and at the time of packet reception, the memory writing means 62 stores “1” in the bit position to which the acknowledgment number of the packet is assigned. Also good. Alternatively, a hash function may be determined in advance, and a hash value obtained using the hash function may be associated with a bit position in the bit string. In this case, each hash value obtained using the hash function is associated with each bit position in the bit string, and the memory writing means 62 converts the hash value of the acknowledgment number of the received packet into the hash function. It is also possible to calculate “1” and store “1” in the bit position corresponding to the hash value obtained by the calculation. As an algorithm for storing “1” in the position corresponding to the hash value of the confirmation response number calculated using the hash function, for example, a Bloom filter or a space code bloom filter (Space-Code Bloom) that is an application thereof. Filter) and Multi-Resolution Space-Code Bloom Filter. The memory writing means 62 may perform the process of storing 1 in the bit position corresponding to the acknowledgment number in the bit string in accordance with the Bloom filter, the space code bloom filter, or the multi-resolution space code bloom filter. It can be said that the hash value is a conversion result of the confirmation response number by the hash function.

  FIG. 3 shows an example of a bit string having a predetermined bit length stored in each of the memories M1 and M2. The memory writing means 62 calculates a hash value of the acknowledgment number of the received packet according to, for example, a Bloom filter. If the memory writing unit 62 selects M1, “1” is stored in the bit position corresponding to the hash value in the bit string of M1. If M2 is selected, “1” is stored in the bit position corresponding to the hash value in the bit string of M2.

  Further, a method of associating the remainder when the acknowledgment number is divided by a predetermined fixed value and the bit position in the bit string may be used. In this case, the remainder obtained by dividing the acknowledgment number by the fixed value is associated with each bit position in the bit string, and at the time of packet reception, the memory writing means 62 sets the acknowledgment number of the packet to the fixed value. The remainder may be obtained by dividing by 1, and “1” may be stored in the bit position corresponding to the remainder.

  The flow identifying unit 61 and the memory writing unit 62 perform the above processing every time an individual packet is received. That is, the flow identification unit 61 identifies the packet flow for each received packet. Further, for each received packet, the memory writing means 62 selects one memory from a plurality of memories corresponding to the packet flow, and stores information corresponding to the packet acknowledgment number in the memory. Do.

  On the other hand, the memory reading unit 64, the common number calculating unit 65, the observation probability calculating unit 67, and the E2E loss calculating unit 68 of the aggregation processing unit 72 described below do not need to be executed every time a packet is received. The memory reading means 64 executes a process of reading a bit string from each memory irrespective of the reception of the packet. Following the bit string reading process of the memory reading means 64, the common number calculating means 65, the observation probability calculating means 67, and E2E The loss calculation means 68 performs processing.

  The memory reading unit 64 reads bit strings stored in a plurality of memories corresponding to individual flows and passes them to the common number calculating unit 65. As described above, the memory reading unit 64 may perform this process regardless of the arrival of the packet. For example, the memory reading unit 64 may periodically read a bit string of the memory. Alternatively, the bit string may be read irregularly using a command from an external system or an event in the external system as a trigger.

  The common number calculation means 65 counts the number of pieces of information stored in common in a predetermined number or more of the plurality of memories Mi corresponding to one flow. Hereinafter, this “predetermined number” is referred to as a memory number threshold. Also, the memory number threshold is determined from a value that is 2 or more and n or less, where n is the number of memories corresponding to one flow. In the example shown in FIG. 3, there are two memories corresponding to one flow, and the memory number threshold is 2. Therefore, in this example, the common number calculation means 65 counts the number of information stored in common in the two memories. In this example, the information corresponding to the confirmation response information is stored as “1” in the bit position corresponding to the confirmation response information. Therefore, the information stored in common in each memory is “1” stored in the same bit position. Therefore, the common number calculation means 65 may perform AND (logical product) calculation of the bit string of M1 and M2, and count the number of “1” in the bit string obtained as a result. If the number of memories corresponding to one flow is 2 and the memory number threshold is also 2, the common number calculation means 65 performs AND (logical product) calculation of the bit strings of the two memories, and obtains the result. What is necessary is just to count the number of “1” in the bit string to be obtained.

  FIG. 4 is an explanatory diagram showing an example of processing of the common number calculation means 65. For example, it is assumed that the memory M1 stores the bit string 55 (see FIG. 4), the memory M2 stores the bit string 56, and the memory reading unit 64 reads the bit strings 55 and 56. The common number calculation means 65 performs an AND calculation of the bit strings 55 and 56 to obtain a bit string 57 shown in FIG. Then, the common number calculation means 65 counts the number of “1” in the bit string 57 obtained by AND calculation. In the example shown in FIG.

  The counting result of the number of pieces of information stored in common in memories equal to or larger than a predetermined number (memory number threshold value) is hereinafter referred to as a common number. The common number is represented by the symbol C. In the example shown in FIG. 4, the common number is 3.

  If packet loss does not occur, packets with the same acknowledgment number in the same flow will not be sent, so if you focus on one point where you estimate the frequency of packet loss, a packet with a certain acknowledgment number will only pass through that point once . As a result, the bit position “1” corresponding to the acknowledgment number is stored only in one of the two memories M1 and M2, and as a result of AND calculation of the bit string of M1 and M2, the bit position The value is 0. On the other hand, when a packet loss occurs, a plurality of packets having the same acknowledgment number are transmitted, and when each packet passes through the packet loss frequency estimation system, “1” is set at the same bit position in each of the memories M1 and M2. It will be stored. Therefore, the number of “1” s in the bit string obtained by AND calculation of the bit strings of the memories M1 and M2 is a value greatly influenced by the frequency of packet loss. There will be many times. Note that the number (common number) of “1” in the bit string obtained by the AND calculation can be said to be the number of pieces of information stored in common in memories equal to or larger than the memory number threshold.

  Here, the case where there are two memories per flow and the memory number threshold value is 2 has been described as an example. However, as already described, the number of memories per flow is plural. If there are two, it is not necessary. For example, the number of memories per flow may be 3, 4, or the like. Also, the memory number threshold is not limited to two. As the number of memories per flow increases, the number of packets that can be processed in parallel increases, and the processing for obtaining the frequency of packet loss can be easily accelerated.

  The E2E loss calculation means 68 estimates the frequency of packet loss (number of occurrences of packet loss) by dividing the common number C by the observation probability. The observation probability is the ratio of the number of packet loss that the information stored in the memory that is equal to or greater than the memory number threshold due to the packet loss is counted as the common number out of the actual number of packet loss occurrences. is there. For example, as shown in FIG. 4, when two memories M1 and M2 are used for one flow and the memory number threshold is 2, due to the packet loss out of the actual number of occurrences of packet loss. The ratio of the number of packet losses that are stored as “1” in the AND operation result (bit string 57) illustrated in FIG. 4 is the observation probability. In other words, the observation probability is a probability that, when a packet loss occurs, common information is stored in a memory having a memory number threshold value or more due to the packet loss. The observation probability is calculated by the observation probability calculation means 67. Further, the estimated frequency (number of times) of packet loss may be referred to as the number of E2E losses.

  In the present invention, the calculation of the E2E loss number by the E2E loss calculation unit 68 and the calculation of the observation probability by the observation probability calculation unit 67 are repeated until it is determined that the E2E loss number has converged. The sequentially calculated E2E loss number is Xi (i = 1, 2,..., H). I in Xi indicates the number of times of E2E loss calculated. The observation probability used when calculating Xi is denoted as Qi. The E2E loss calculation means 68 estimates the E2E loss number Xi (i = 1, 2,..., H) by dividing the common number C by the observation probability Qi. That is, the number of E2E losses is calculated by calculating the following equation (1).

Xi = C / Qi Formula (1)

  Further, the process is started with i = 1 from the stage where the observation probability has never been calculated, and the E2E loss calculation means 68 uses the temporary observation probability Q1 (initial value of the observation probability Qi) to The first E2E loss number X1 is obtained by calculating the equation (2) shown. Note that Q1 may be determined as an arbitrary value satisfying 0 <Q1 ≦ 1.

X1 = C / Q1 Formula (2)

  The E2E loss calculating means 68 calculates Xi, compares Xi with X (i-1), and determines that the number of E2E losses has converged if the difference is equal to or smaller than a certain value (threshold). Let Xi be the final definite value of the packet loss frequency. X (i-1) is the E2E loss number calculated last time. If the difference between Xi and X (i-1) is greater than a certain value, the E2E loss calculation means 68 passes the Xi to the observation probability calculation means 67 and calculates the observation probability Q (i + 1) to the observation probability calculation means 67. Let The E2E loss calculating means 68 calculates the equation (2) for the observation probability Q (i + 1) to obtain X (i + 1). This process is repeated until it is determined that the E2E loss number has converged.

  Here, the case where it is determined that the number of E2E losses has converged when the difference between Xi and X (i-1) is equal to or smaller than a certain value is shown. May be. For example, when Xi is calculated, the rate of change (X (i-1) / Xi) between Xi and Xi (i-1) is calculated, and when the rate of change falls within a predetermined range, E2E It may be determined that the number of losses has converged.

  The observation probability calculation means 67 calculates the observation probability Qi based on the observation environment of information stored in common in the memory. The observation environment is determined by a combination of one or more of the following four elements.

  The first element is the number of memories Mi (i = 1, 2,..., N) for each flow existing in the packet information holding unit 63. That is, the number of memories used for each flow.

  The second element is an algorithm by which the memory writing means 62 selects which memory is to be written from among a plurality of memories (a plurality of memories corresponding to one flow).

  The third element is a memory number threshold value. The memory number threshold is a common number when each piece of information stored in the memory by the memory writing means 62 is recorded in the memory in accordance with the value of the field including at least the acknowledgment number in the packet. The counting condition is whether the calculation means 65 is to be counted.

  The fourth element is a multiplicity distribution. The redundancy distribution is a distribution indicating how many probability / frequency the same acknowledgment numbers continue when packet loss occurs. The number of occurrences of the same confirmation response number is defined as the degree of duplication. The fourth element (redundancy distribution) depends on the type of communication protocol that defines the transmission specification of the acknowledgment number. For example, FIG. 5 shows the redundancy distribution when the TCP-Reno / NewReno packet loss rate is 1%. In the redundancy distribution illustrated in FIG. 5, for example, when a packet loss occurs once, the probability that eight identical ACK numbers (acknowledgment response numbers) continue, that is, the probability of redundancy 8 is about 10%.

  Among the above four elements, the first element to the third element are elements that determine the probability of being counted as a common number when a phenomenon with a redundancy of j occurs. The fourth element is an element that determines the probability of occurrence of the multiplicity j. Here, the probability of being counted as a common number when the phenomenon of the multiplicity j occurs is denoted as Aj. Also, the probability that the degree of overlap j will occur is denoted as Bj. At this time, the observation probability Qi is expressed by the following equation (3), and the observation probability calculation means 67 calculates the observation probability Qi by calculating equation (3).

  Three examples of the probability Aj counted as the common number when the phenomenon of the redundancy j occurs are shown below. J shown below is a duplication degree.

  For example, assume that the value serving as the first element is Y, the second element is round robin, and the value serving as the first element is also Y. In this case, Aj = 0 when j <Y, and Aj = 1 when j ≧ Y.

  Further, for example, it is assumed that the first element and the third element are both 2, and the second element is a method of randomly selecting a memory with an equal probability. In this case, Aj = 0 when j <2, and Aj is calculated as shown in Expression (4) when j ≧ 2.

  For example, it is assumed that the first element and the third element are both 2. Assume that the second element is a scheme in which the probability of selecting M1 is 1/3 and the probability of selecting M2 is 2/3. In this case, Aj = 0 when j <2, and Aj is calculated as shown in Equation (5) when j ≧ 2.

  In addition, when the numerical value of the first element and the numerical value of the third element match and the second element is a method of selecting a memory at random with an equal probability, it is considered as a mathematical problem called a coupon collector problem. be able to. The probability Aj in that case is a value shown in FIG. In the graph shown in FIG. 6, N is a numerical value of the first element and the third element, and shows a case where N = 2 to 6. Furthermore, FIG. 6 shows only the case where the numerical value of the first element and the numerical value of the third element match, and the second element is a method of randomly selecting a memory with an equal probability. If viewed as a problem modification problem, it is also possible to obtain Aj when there is a bias in the memory selection probability in the second element, or when the numerical value of the first element and the numerical value of the third element do not match. .

The probability Bj of occurrence of the redundancy j varies depending on the type of communication protocol that defines the transmission specification of the acknowledgment number. In UDP (User Datagram Protocol), when a unique protocol for adding a sequence number indicating how much data has reached a receiving terminal to the payload is defined in the application layer, various definitions are possible. For example, B _{j = 10} = 1 and B _{j ≠ 10} = 0 in the case of a protocol that replies the same 10 acknowledgment signals once packet loss occurs. That is, if j = 10, Bj = 1, and if j ≠ 10, Bj = 0. Further, Bj can be generated according to a general distribution such as a normal distribution, a Poisson distribution, or an exponential distribution.

  In the case of TCP, Bj differs depending on the network status (packet loss rate) and the type of TCP protocol (Taho, Reno / NewReno, etc.). Here, when the packet loss rate is p and the traffic is TH, p = X / TH. If it is determined that TH is obtained from the difference of ACK numbers during the packet loss frequency estimation period, the network status (packet loss rate) can be easily obtained. In the case of Reno / NewReno, the probability Bj can be approximated by the following equation (6).

  In Expression (6), b is a parameter of TCP delayed ACK and is generally 2.

  When the network status (packet loss rate p) is required to obtain the packet loss rate p as in TCP, the observation probability calculation means 67 sets a temporary packet loss rate and calculates Bj, Further, Qi is calculated, and the E2E loss calculating means 68 calculates Xi from the Qi and the common number. Using the Xi obtained as a result, the observation probability calculation means 67 calculates p by calculating p = X / HT and calculates B (j + 1) again. If this iterative calculation is performed, Xi may converge even if an appropriate initial value of the packet loss rate is used (it will converge if Reno / NewReno), and the actual packet loss rate p or the number of packet losses X (= TH × p) can be obtained.

  In the present embodiment, it is assumed that the fourth element overlap distribution is stored in the protocol characteristic holding unit 66. For example, the protocol characteristic holding unit 66 is a storage device that stores Bj (p) in association with the condition p in the above-described example, and may be configured to obtain Bj (p) according to the condition p. In addition, the distribution of the degree of duplication may be obtained in advance by an experiment or the like according to the observation conditions of the communication network or the like, and information in which the group of elements and the degree of duplication are associated with each other may be stored in the protocol characteristic holding unit 66. Further, the protocol characteristic holding unit 66 may be configured to perform a calculation of a function such as Expression (6) and return a calculation result of the function according to a given condition.

  The observation probability Qi is obtained by calculating Aj and Bj until j becomes infinite and calculating equation (1). However, the observation probability calculation means 67 sets the upper limit of j to a certain large value, Even if Qi is obtained using Aj and Bj, there is no practical problem.

  Although it depends on the selection method from the first element to the third element, generally, Aj approaches 1 as j increases, so that the observation probability calculation means 67 uses the following equation (7). Qi may be calculated by such approximate calculation.

  The E2E loss calculation means 68 and the observation probability calculation means 67 repeat the calculation of the number of E2E losses and the observation probability, thereby making it possible to calculate the end-to-end packet loss frequency.

  In this embodiment, the flow identification unit 61, the memory writing unit 62, the memory reading unit 64, the common number calculation unit 65, the observation probability calculation unit 67, the protocol characteristic holding unit 66, and the E2E loss calculation unit 68 are, for example, a program This is realized by a CPU that operates according to the (packet loss frequency estimation program). A program is stored in a storage device included in the packet loss frequency estimation system, and the CPU of the packet loss frequency estimation system reads the program, and a flow identification unit 61, a memory writing unit 62, a memory reading unit 64, a common number calculating unit 65, What is necessary is just to operate | move as the observation probability calculation means 67, the protocol characteristic holding means 66, and the E2E loss calculation means 68. The protocol characteristic holding unit 66 may be a storage device that stores the value of Bj as a database. Each means may be realized as a dedicated circuit.

Next, the operation will be described.
FIG. 7 is a flowchart showing an example of processing progress of the information registration means 71. When receiving a packet transmitted / received between terminals, the packet loss frequency estimation system transfers the packet to the next node. Further, the following processing is executed for the received packet.

  First, the flow identification unit 61 identifies the flow of the received packet (step A1). For example, the flow identification unit 61 may specify a flow ID for identifying a flow from the transmission address, reception address, transmission port number, reception port number, and protocol ID in the header of the packet. The flow identifying means 61 also identifies the packet flow with reference to the port number of the packet loss frequency estimation system (the port number of the own device that received the packet and the number of the port that transmitted the packet toward the next node). May be.

  Next, the memory writing means 62 selects one memory from a plurality of memories corresponding to the received packet flow (step A2). Here, as shown in FIG. 3, a case where two memories M1 and M2 are used for each flow is taken as an example. The mode in which the memory writing means 62 selects the memory is not limited. For example, even if the memory is selected at random or the memory is selected by the round robin method, the memory is selected according to the selection probability determined for each memory. May be selected.

  Next, the memory writing means 62 stores information corresponding to the acknowledgment number of the received packet in the memory selected in step A2 (step A3). For example, when the M1 memory is selected in step A2, the memory writing unit 62 stores information corresponding to the acknowledgment number of the received packet in the M1 memory. When the M2 memory is selected in step A2, the memory writing unit 62 stores information corresponding to the acknowledgment number of the received packet in the M2 memory. In this example, in step A3, 1 is stored in the bit position corresponding to the confirmation response number in the bit string of the selected memory. As already described, an acknowledgment number and a bit position may be associated with each other. Further, the hash value of the confirmation response number may be associated with the bit position. The process of storing 1 in the bit position corresponding to the acknowledgment number in the bit string may be performed according to a Bloom filter, a space code bloom filter, or a multi-resolution space code bloom filter.

  FIG. 8 is a flowchart showing an example of processing progress of the aggregation processing means 72. Here, a case where the processing shown in FIG. 8 is periodically executed will be described as an example. Further, the memory reading unit 64, the common number calculating unit 65, the E2E loss calculating unit 68, and the observation probability calculating unit 67 perform the following processing for each flow.

  The memory reading means 64 reads information (bit strings in this example) stored in a plurality of memories corresponding to the flows for each flow. This memory read process is repeated until all the corresponding memory information is read (step B1). If the number of memories corresponding to the flow is n, information is read from M1 to Mn, information is read from the last memory, and the process proceeds to step B2.

  After step B1, the common number calculation means 65 counts the number of pieces of information stored in common in the memory with the memory number threshold value (2 in this example) (step B2). This count result is a common number. Here, it is only necessary to count the number of bit positions where “1” is stored in either of the two memories M1 and M2. In this example, the common number calculation unit 65 may perform an AND calculation of the two bit strings read by the memory reading unit 64 and count the number of “1” s in the bit string obtained as a result of the AND calculation.

  The counting result (common number) in step B2 is highly correlated with the packet loss frequency of each flow. That is, the larger the value of the common number C obtained in step B2, the higher the possibility that the number of packet loss occurrences will be greater. However, since there is a possibility that the packet loss value itself does not exist, the number of packet losses is estimated by correcting numerical values by the subsequent processing.

  After step B2, the observation probability calculation means 67 calculates the observation probability Qi based on the observation environment (step B3). As already described, the first element that defines the observation environment is the number of memories Mi (i = 1, 2,..., N) for each flow existing in the packet information holding unit 63. The second element is an algorithm for selecting which memory the memory writing means 26 performs writing from among a plurality of memories corresponding to one flow. The third element is a memory number threshold value. The fourth element is a multiplicity distribution. The observation probability calculation means 67 calculates the observation probability Qi according to each element from the first to the fourth. The observation probability calculation means 67 obtains Aj (probability counted as a common number when the phenomenon of multiplicity j occurs) by the first element to the third element, and Bj (multiplicity j occurs by the fourth element). Probability). Then, the observation probability calculation means 67 calculates the observation probability Qi by calculating the equation (3). The operation of step B3 will be described later with reference to FIG. Further, if iterative calculation is required by the fourth element, Q1 may be set such that Q1 = 1 when the process first proceeds to step B3. The value of Q1 is arbitrary if 0 <Q1 ≦ 1.

  Next, the E2E loss calculation means 68 estimates the packet loss frequency Xi by dividing the common number C by the observation probability Qi calculated by the observation probability calculation means 67 (step B4). Subsequently, the E2E loss calculation means 68 determines whether or not Xi has converged (step B5). For example, the E2E loss number Xi calculated in the previous step B4 and the E2E loss number X (i-1) calculated in the previous step B4 are compared. If the difference is larger than the threshold value, it is determined that convergence has not occurred. If Xi has not converged (No in Step B5), the processes after Step B3 are repeated. If Xi has converged (Yes in step B5), the process is terminated.

  If the packet loss frequency is determined in step B5, the packet loss frequency estimation system may transmit the packet loss frequency (Xi at the time of convergence) to, for example, the server 31 illustrated in FIG. The server 31 may store the packet loss frequency received from each packet loss frequency estimation system.

  FIG. 9 is a flowchart showing an example of the processing progress of step B3 by the observation probability calculation means 67. First, the observation probability calculation means 67 reads the number of memories that are the first element of the observation environment (step C1). For example, the number of memories as the first element may be specified with reference to the packet information holding unit 63.

  The observation probability calculation means 67 reads a memory selection algorithm as the second element (step C2). For example, the memory writing means 62 may store the memory selection algorithm type, and the observation probability calculating means 67 may read the memory selection algorithm type from the memory writing means 62.

  Further, the observation probability calculation means 67 reads the memory number threshold value which is the third element (step C3). For example, the common number calculation unit 65 may store the memory number threshold value, and the observation probability calculation unit 67 may read the memory number threshold value from the common number calculation unit 65.

  Next, the observation probability calculation means 67 calculates the probability Aj counted as a common number when the phenomenon of the multiplicity j occurs based on the first element to the third element (step C4). For example, the observation probability calculation means 67 holds a plurality of calculation formulas for Aj according to the memory selection algorithm, selects a calculation formula according to the second element from among them, and includes the first element and the third Aj may be calculated by substituting element values. Alternatively, Aj may be obtained by other methods.

  Next, the observation probability calculation means 67 acquires the redundancy distribution that matches the flow protocol from the protocol characteristic holding means 66, and specifies the probability Bj that the redundancy j occurs (step C5). Subsequently, the observation probability calculation means 67 calculates the observation probability Qi by calculating, for example, the equation (3) using the calculated Aj and Bj (step C6). At this time, Qi may be calculated using an approximate expression such as Expression (7).

  According to the present invention, the memory writing means 62 selects one from a plurality of memories Mi (packet information storage area), and stores information corresponding to the packet acknowledgment number in the memory Mi. And the information memorize | stored in each memory is read, and the number of the information memorize | stored in the memory more than a memory number threshold value is counted. In such a configuration, when a packet is received, the memory writing means 62 only has to select the memory and write to the memory, and compare the previously received packet with the newly received packet. There is no need to do. Therefore, the processing at the time of packet reception is stateless processing, and processing costs such as processing time and calculation amount can be reduced. In addition, counting can be performed with reference to the value of each memory Mi regardless of the packet reception timing. Therefore, when the common number calculating unit 65 performs counting, it is not necessary to wait for the processing of the memory writing unit 62 to be completed, and the processing speed of the common number calculating unit 65 is not limited to the memory writing unit 62. Further, since there are a plurality of memories Mi, even if one packet is received and another packet belonging to the same flow is received when writing to the selected memory (step A3) is executed, Processing for the packet can be executed. Therefore, the processing can be speeded up. Further, since the probability correction is performed on the common number obtained by the common number calculation means 65 based on the observation probability, even if the correlation between the common number and the packet loss frequency does not match 1, the packet loss The frequency estimation accuracy can be improved.

  Hereinafter, various modifications of the present embodiment will be shown.

  In the above embodiment, the packet information storage area (each memory Mi) is a storage area for storing a bit string having a predetermined bit length, and stores “1” at a position corresponding to the acknowledgment number of the received packet. The case where it is made has been described as an example. Information according to the acknowledgment number of the received packet may be stored in the packet information storage area Mi in another manner. The memory writing means 62 selects one of the plurality of packet information storage areas, and then puts the information itself (for example, the confirmation response number itself) corresponding to the confirmation response number in the selected packet information storage area. May be stored. However, if the information to be stored is already stored in the selected packet information storage area, the information need not be stored. In this case, the memory reading unit 64 may read the array stored in each packet information storage area for each flow. Moreover, the common number calculation means 65 should just count the number of the information memorize | stored in the packet information storage area more than a memory number threshold value for every flow.

  In the above embodiment, the case where information corresponding to the acknowledgment number of the received packet is stored in the packet information storage area has been described as an example. However, information corresponding to a combination of the acknowledgment number and other information is described. May be stored in the packet information storage area. For example, when estimating the packet loss frequency of a TCP packet, information corresponding to a combination of an acknowledgment number, an advertisement window size, and an ACK flag included in the packet header may be stored in the packet information storage area . For example, a correspondence relationship between a set of an acknowledgment number, an advertisement window size and an ACK flag and a bit position in a bit string is determined in advance, and the value of the acknowledgment number of the received packet is S and the value of the advertisement window size is T If the value of the ACK flag is U, “1” may be stored in the bit position corresponding to the combination of S, T, and U. Alternatively, a hash value of a combination of S, T, and U may be obtained using a hash function, and “1” may be stored in a bit position corresponding to the hash value. At this time, a Bloom filter, a space code bloom filter, or a multi-resolution space code bloom filter may be applied. Alternatively, a set of an acknowledgment number, an advertisement window size, and an ACK flag for each received packet may be stored as an array.

  In this case, even if the acknowledgment numbers match between packets, if other information (advertisement window size, ACK flag in the above example) does not match, it is stored in a plurality of packet information storage areas in common. Will not be.

  Similarly, the memory writing means 62 uses a combination of one or more of an advertisement window size, an ACK flag, a transmission address, a reception address, a transmission port number, a reception port number, and a protocol ID and an acknowledgment number. The corresponding information may be stored in the selected packet information storage area.

  In the above embodiment, the case where a plurality of packet information storage areas are used for each flow has been described. However, a plurality of packet information storage areas may be used for each port or each terminal. In this case, the frequency is obtained in the packet loss in the entire flow group that has passed through the port or in the entire flow group of packets transmitted and received by the terminal. However, in this case, even if the flows are different, the packet acknowledgment numbers may match, and information corresponding to the combination of the packet acknowledgment number and the information indicating the flow is stored in the selected packet information storage area. Remember me.

  For example, when the communication quality is measured for each combination of the transmission terminal and the reception terminal, a plurality of packet information storage areas are prepared for each combination of the address of the terminal serving as the transmission terminal and the address of the terminal serving as the reception terminal. Then, for example, the memory writing unit 62 stores information corresponding to a set of an acknowledgment number, an advertisement window size, flag information, a transmission port number, a reception port number, and a protocol ID in the packet in the packet information storage area. Further, for example, when measuring communication quality for each transmitting terminal, a plurality of packet information storage areas are prepared for each address of a terminal serving as a transmitting terminal. Then, the memory writing means 62, for example, stores information corresponding to the set of the acknowledgment number, advertisement window size, flag information, transmission port number, reception port number, protocol ID, and reception address in the packet information storage area. Remember. For example, when measuring communication quality for each port, a plurality of packet information storage areas are prepared for each combination of transmission port number and reception port number. Then, the memory writing means 62, for example, stores information corresponding to the set of the acknowledgment number, advertisement window size, flag information, transmission port number, reception port number, transmission address, reception address in the packet information storage area. Remember.

  In the above embodiment, the flow identification unit 61, the memory writing unit 62, the packet information holding unit 63, the memory reading unit 64, the common number calculation unit 65, the E2E loss calculation unit 68, and the observation probability Although the case where the calculating unit 67 and the protocol characteristic holding unit 66 are provided in one device has been shown, each unit may not be provided in the same device. For example, a part that executes processing every time a packet is received and a part that reads information stored in a plurality of packet information storage areas and executes counting processing may be realized by different devices.

  1 is provided with a flow identification means 61. The server 31 shown in FIG. 1 includes a memory writing means 62, a packet information holding means 63, a memory reading means 64, and a common number calculation. A configuration in which means 65, E2E loss calculating means 68, observation probability calculating means 67, and protocol characteristic holding means 66 may be provided. In this case, after identifying the flow of the received packet, the flow identification unit 61 of each device 21 to 25 transmits the packet to the server 31.

  The packet information holding unit 63 may be configured as a distributed database in the communication network. Individual computers in the communication network may serve as individual memories Mi corresponding to one flow.

  The observation probability Q may be calculated using either the probability Aj that is counted as a common number when the phenomenon of the multiplicity j occurs or the probability Bj that the multiplicity j occurs. Also, the probability Aj and the probability Bj are calculated by elements other than the first element (the number of memories Mi), the second element (memory selection algorithm), the third element (memory number threshold), and the fourth element (redundancy distribution). May be. For example, the size distribution of the TCP congestion window or the inversion degree distribution described in the following reference may be used as the probability Bj of occurrence of the overlapping degree j.

[References]
Yasuhiro Yamazaki, Hideyuki Shimonishi, Tsutomu Murase, “A Bidirectional Packet Loss Rate Estimation Method from Unidirectional Sampling Packets”, IEICE Technical Report (CQ2006-47), September 2006

  In the above embodiment, when the memory writing unit 62 registers data in the packet information holding unit 63, one of the memories of the packet information holding unit 63 is selected. The same information may be stored in the selected memory. In that case, when determining Aj, it is only necessary to consider factors such as how many memories are selected to store the same data, factors such as algorithm types for selecting a plurality of memories, and the like.

  Variations of each element will be described. The first element (the number of memories Mi (i = 1, 2,..., N) for each flow) is arbitrary as long as it is a number of 2 or more.

  The second element (algorithm for selecting a memory) may be a method of selecting at random according to the probability assigned to each memory. Alternatively, the memory reference number may be selected by round robin based on some unit such as a flow unit or a device unit. In addition, a general algorithm such as a LRU (Least Recently Used) method, a FIFO (First In First Out) method, or a LIFO (Last In First Out) method may be applied to the selection algorithm.

  The third element (memory number threshold value) is arbitrary as long as it is a number of 2 or more and the value of the first element or less.

  The fourth element is the redundancy, and the present invention can be applied to any kind of TCP as long as the overlap distribution of the acknowledgment signal is known. The communication protocol to which the present invention is applied may be SCTP, a new protocol implemented on UDP, or “TCP over TCP”. Further, the overlap distribution need not be given by an expression like Expression (6), and may be a distribution obtained experimentally by experiment.

  In the above description, the case where the observation probability Q and the probabilities Aj and Bj are explicitly shown by mathematical expressions has been described. However, Q, Aj, and Bj do not necessarily have to be obtained by mathematical expressions. For example, Aj corresponding to the combination from the first element to the third element is experimentally obtained, and the correspondence between the combination from the first element to the third element and Aj is stored in the storage means as a database. May be. Then, the observation probability calculation means 67 may search for Aj by designating the first element to the third element. Similarly, the redundancy distribution may be obtained experimentally and Bj may be stored as a database. Then, the database may be searched using the fourth element as an input value, and the return value may be used as Bj.

  Further, the observation probability Q may be similarly made into a database. For example, the observation probability Q corresponding to the combination of the elements from the first element to the fourth element is obtained in advance and stored in the storage means as a database, and the observation probability calculation means 67 The observation probability Q may be searched by designating each element. Further, the observation probability Q corresponding to the combination of Aj and Bj is obtained in advance and stored in the storage means as a database, and the observation probability calculation means 67 may search for the observation probability Q by specifying Aj and Bj. . As a parameter for searching the exemplified database, a parameter on which the observation probability Q depends may be used, and values other than elements from the first element to the fourth element may be included in the parameter. Further, not all elements from the first to the fourth may be included in the search parameter.

Embodiment 2. FIG.
FIG. 10 is a block diagram showing a second embodiment of the packet loss frequency estimation system of the present invention. 10 is illustrated as a block diagram of the device 21 illustrated in FIG. 1, the devices 21 to 25 in FIG. 1 have the same configuration. Constituent elements similar to those in the first embodiment are denoted by the same reference numerals as those in FIG.

  The packet loss frequency estimation system of this embodiment includes information registration means 71a and totalization processing means 72a. The information registration unit 71 a includes a flow identification unit 61, a memory writing unit 62, a packet information holding unit 63, and a packet sampling unit 81. The aggregation processing unit 72a includes a memory reading unit 64, a common number calculation unit 65, a protocol characteristic holding unit 66, an observation probability calculation unit 67a, and an E2E loss calculation unit 68. The flow identification means 61, the memory writing means 62, the packet information holding means 63, the memory reading means 64, the common number calculating means 65, the protocol characteristic holding means 66, and the E2E loss calculating means 68 are the same as in the first embodiment. The description is omitted.

  The packet sampling unit 81 reduces the number of packets to be processed (the number of packets to be observed) for storing information in the packet information holding unit 63 by sampling. That is, the packet sampling means 81 extracts some packets from the packet group received by the packet loss frequency estimation system. The processing of the present invention is performed on the packet extracted by the sampling processing.

  For example, the packet sampling unit 81 generates a random number for each input of the packet, and compares the sampling probability with a predetermined sampling probability. If the sampling probability is equal to or greater than the random number, the packet sampling unit 81 observes the packet. In other words, it is sufficient not to observe the packet. This sampling method is referred to as random sampling. The sampling probability is greater than 0 and less than or equal to 1, and random numbers may be generated within this range. In addition, a general sampling method such as a sampling method for acquiring packets as observation targets at a ratio of M to N, or a systematic sampling method for acquiring packets as observation targets for every N packets may be applied.

  For example, the packet sampling unit 81 samples a packet from a packet group received from another device, passes the packet to the flow identification unit 61, and executes processing after the flow determination. However, packet sampling may be executed at other timing. For example, the packet sampling unit 81 may perform packet sampling after the processing by the flow identification unit 61 or immediately before the memory writing unit 62 records the packet information in the packet information holding unit 63. At any timing, it is possible to greatly reduce the number of packets to be observed and reduce the processing cost.

  In the total processing means 72, the common number calculation means 65 obtains the common number C. Then, the E2E loss calculation means 68 estimates the E2E loss number Xi (i = 1, 2,..., H) by dividing the common number C by the observation probability Qi calculated by the observation probability calculation means 67a. . This operation is the same as in the first embodiment.

  The observation probability calculation means 67a calculates the observation probability Qi based on the observation environment. However, since packet sampling is performed in the second embodiment, the observation environment is determined by each element from the first to the sixth.

  The first element, the second element, and the third element in the second embodiment are the same as those in the first embodiment, and a description thereof is omitted.

  The fourth element is a multiplicity distribution. The redundancy distribution is a distribution indicating how many probability / frequency the same acknowledgment numbers continue when packet loss occurs. The number of occurrences of the same confirmation response number is defined as the degree of duplication. This overlap distribution is an overlap distribution when sampling is not performed, and is the same as in the first embodiment.

  The fifth element is a packet sampling pattern (sampling method) in the packet sampling means 81. For example, as the fifth element (sampling pattern), a sampling rule used in a general sampling measurement technique such as random sampling or systematic sampling can be applied.

  The sixth element is the sampling probability in the packet sampling means 81. If the sampling probability is s, values in the range of 0 <s ≦ 1 are allowed.

  Among these six elements, the first element to the third element are elements that determine how much probability is counted as a common number when a phenomenon having a multiplicity of j occurs. The fourth to sixth elements are elements that determine the probability of occurrence of the redundancy j. As in the first embodiment, the probability of counting as a common number when the phenomenon of the multiplicity j occurs is denoted as Aj, and the probability of occurrence of the multiplicity j is denoted as Bj. The observation probability Qi is calculated by the equation (3) shown in the first embodiment.

  Since the probability Aj is the same as that in the first embodiment, the description thereof is omitted. The probability Bj is determined by the fourth element, the fifth element, and the sixth element. The observation probability calculating unit 67a may acquire the fourth element from the protocol characteristic holding unit 66. Further, the packet sampling means 81 holds the fifth element (sampling pattern type) and the sixth element (sampling probability), and the observation probability calculation means 67a obtains the fifth element and the sixth element from the packet sampling means 81. Get it.

  When packet sampling is not performed, or when the sampling probability is 1, the redundancy distribution obtained by the fourth element can be applied. However, when packet sampling is performed, the redundancy distribution changes. The observation probability calculating means 67a uses the fifth element and the sixth element to predict the redundancy distribution that has changed due to the sampling, and obtains the probability Bj. An example of Bj derivation is shown.

  For example, as a fourth element, it is assumed that a protocol is defined in which ten identical acknowledgment signals are returned once a packet loss occurs in UDP. Further, it is assumed that the fifth element is a random sampling method and the sixth element is a sampling probability s. In this case, the probability that the degree of overlap j occurs is expressed as in Expression (8).

^{_{Bj = 10 C j × s j}} × (1-s) (10-j) (8)

  However, Expression (8) is satisfied when j ≦ 10, and when j> 11, Bj = 0.

Further, for example, as a fourth element, it is assumed that a protocol is defined in which 10 identical acknowledgment signals are returned once a packet loss occurs in UDP. It is assumed that systematic sampling for each flow (method of extracting packets for each predetermined flow in each flow) is defined as the fifth element, and sampling probability “1/8” is defined as the sixth element. In this case, B _{j = 1} = 1 and B _{j ≠ 1} = 0. That is, if j = 1, Bj = 1, and if j ≠ 1, Bj = 0.

  As a fourth example, TCP Reno / NewReno is defined as the fourth element as the fourth example, the fifth element is a random sampling method, and the sixth element is the sampling probability s. In this case, the probability Bj can be approximated by the following equation (9).

  In Expression (9), b is a parameter of TCP delayed ACK and is generally 2. FIG. 11 shows an example of change in the degree of overlap distribution before and after sampling in this case. FIG. 11 shows a redundancy distribution with a sampling probability of 1 and a redundancy distribution with a sampling probability of 0.25 when the packet loss rate is 1%.

  In this equation (9), the network status (packet loss rate p) is required to obtain the packet loss rate p, but the intermediate calculation process may be performed in the same manner as in the first embodiment. That is, the observation probability calculation means 67a sets a temporary packet loss rate, calculates Bj, further calculates Qi, and the E2E loss calculation means 68 calculates Xi from the Qi and the common number. Using the Xi obtained as a result, the observation probability calculation means 67 calculates p by calculating p = X / HT and calculates B (j + 1) again. This iterative calculation may be performed.

  By calculating in this way, even if the fourth element occurs according to the general distribution such as normal distribution, Poisson distribution, exponential distribution, etc., the duplicate ACK distribution after sampling is taken into account by taking the fifth element and the sixth element into consideration. Can be obtained.

  Here, the description has been made assuming that the protocol characteristic holding unit 66 stores data of the redundancy distribution (fourth element) when packet sampling is not performed, but the redundancy distribution itself changed by the packet sampling is entered. It may be. In this case, the sampling pattern and the sampling probability information are transmitted from the packet sampling means 81 to the protocol characteristic holding means 66, and the redundancy distribution returned by the protocol characteristic holding means 66 to the observation probability calculating means 67a according to the information is obtained. The structure to change may be sufficient. Further, when the observation probability calculation means 67a makes an inquiry to the protocol characteristic holding means 66 for the fourth element, the sampling pattern and the sampling probability are included in the input information, and the protocol characteristic holding means 66 sets the overlap distribution that matches the condition. The structure which answers may be sufficient.

  After obtaining Aj and Bj, the observation probability calculating means 67a may calculate the observation probability Qi using the Aj and Bj as in the first embodiment.

  The E2E loss calculation means 68 and the observation probability calculation means 67a repeat the calculation of the number of E2E losses and the observation probability, thereby making it possible to calculate the end-to-end packet loss frequency.

  In this embodiment, packet sampling means 81, flow identification means 61, memory writing means 62, memory reading means 64, common number calculating means 65, observation probability calculating means 67a, protocol characteristic holding means 66, and E2E loss calculating means 68 Is realized by a CPU that operates according to a program (packet loss frequency estimation program), for example. A program is stored in a storage device included in the packet loss frequency estimation system, and the CPU of the packet loss frequency estimation system reads the program, and packet sampling means 81, flow identification means 61, memory writing means 62, memory reading means 64, common The number calculation unit 65, the observation probability calculation unit 67a, the protocol characteristic holding unit 66, and the E2E loss calculation unit 68 may be operated. The protocol characteristic holding unit 66 may be a storage device that stores the value of Bj as a database. Each means may be realized as a dedicated circuit.

Next, the operation will be described.
FIG. 12 is a flowchart showing an example of processing progress of the information registration unit 71a. When receiving a packet transmitted / received between terminals, the packet loss frequency estimation system transfers the packet to the next node. Further, the following processing is executed for the received packet.

  The packet sampling unit 81 thins out packets received from an external device (another node). That is, packet sampling is performed and a packet to be observed is extracted (step A0). A general sampling method can be applied. Subsequently, for the sampled packet, the flow identifying unit 61 identifies the flow (step A1). Then, the memory writing means 62 selects one memory from the plurality of memories corresponding to the received packet flow (step A2), and stores information corresponding to the packet acknowledgment number in the memory. (Step A3). The processing in steps A1 to A3 is the same as that in the first embodiment.

  Although FIG. 12 shows the case where packet sampling (step A0) is performed before flow identification, packet sampling may be performed at other timings as long as it is before execution of step A3.

  FIG. 13 is a flowchart showing an example of processing progress of the totalization processing means 72a. Here, a case where the processing shown in FIG. 13 is periodically executed will be described as an example. The memory reading unit 64, the common number calculating unit 65, the E2E loss calculating unit 68, and the observation probability calculating unit 67a perform the following processing for each flow.

  Processing up to the calculation of the common number (steps B1 and B2) is the same as that in the first embodiment. After step B2, the observation probability calculation means 67a calculates the observation probability Qi based on the observation environment (step B3 '). In the second embodiment, the observation environment is determined by the first to sixth elements. The first element is the number of memories Mi (i = 1, 2,..., N) for each flow existing in the packet information holding unit 63. The second element is an algorithm for selecting which memory the memory writing means 26 performs writing from among a plurality of memories corresponding to one flow. The third element is a memory number threshold value. The fourth element is a multiplicity distribution. The fifth element is a sampling pattern. The sixth element is the sampling probability. The observation probability calculation means 67a obtains the probability Aj from the first element by the third element and obtains the probability Bj by the fourth element from the sixth element. Then, the observation probability Qi is calculated by calculating equation (3). The operation of step B3 'will be described later with reference to FIG. When iterative calculation is required from the fourth element to the sixth element, Q1 may be set such that Q1 = 1 or the like when the process first proceeds to step B3 '. The value of Q1 is arbitrary if 0 <Q1 ≦ 1.

  Steps B4 and B5 after step B3 'are the same as in the first embodiment. If the packet loss frequency is determined in step B5, the packet loss frequency estimation system may transmit the packet loss frequency (Xi at the time of convergence) to, for example, the server 31 illustrated in FIG. The server 31 may store the packet loss frequency received from each packet loss frequency estimation system.

  FIG. 14 is a flowchart showing an example of the processing progress of step B3 'by the observation probability calculating means 67a. The observation probability calculation means 67a reads the first element to the third element and calculates the probability Aj (steps C1 to C4). Steps C1 to C4 are the same as those in the first embodiment.

  Next, the observation probability calculating unit 67a acquires a redundancy distribution that matches the flow protocol from the protocol characteristic holding unit 66 (step C11). Further, the packet sampling pattern (fifth element) and the sampling probability (sixth element) are acquired from the packet sampling means 81 (steps C12 and C13). Then, the observation probability calculation means 67a calculates Bj (probability of occurrence of multiplicity j) corresponding to each element from the fourth to the sixth (step C14). Subsequently, the observation probability calculating means 67a calculates the observation probability Qi by calculating, for example, the equation (3) using the calculated Aj and Bj (step C6). At this time, Qi may be calculated using an approximate expression such as Expression (7). Step C6 is the same as that in the first embodiment.

  According to the present invention, since the probability correction is performed by the observation probability calculation unit 67a on the common number obtained by the common number calculation unit 65 based on the observation probability, the correlation between the common number and the packet loss frequency is Even when the number does not match 1, the estimation accuracy of the packet loss frequency can be improved. Further, since the probability correction is performed by the observation probability calculation unit 67a on the common number obtained by the common number calculation unit 65 based on the observation probability, even when the observation packet is thinned out by the packet sampling unit 81, the packet It is possible to maintain loss frequency estimation accuracy. In addition, since the observation packet can be thinned out by the packet sampling unit 81, the processing cost after the packet sampling process in the information registration unit 71a can be reduced. Further, the same effect as increasing the memory can be obtained. For example, the effect of doubling the number of memories per flow and the effect of performing packet sampling with a sampling probability of 0.5 are the same.

  Various modifications shown in the first embodiment may be applied to the second embodiment.

  In the first embodiment and the second embodiment, the packet loss frequency estimation system may calculate the packet loss rate from the estimated number of packet losses. For example, the packet loss frequency estimation system may include means for calculating a packet loss rate by calculating a throughput and dividing the throughput by the number of packet losses.

  In the second embodiment, a simulation result when a TCP transmission packet for 300 seconds is measured will be described as an example. 1% packet loss occurred between communication terminals. Further, as a result of measurement at the terminal at the end of communication, 112679 packets were transmitted and received, and 1154 packet losses occurred.

  Each element that determines the observation environment is as follows. The first element (number of memories) is 2, the second element is a selection algorithm that randomly selects each memory with equal probability, and the third element (memory number threshold) is 2. The fourth element is TCP Reno / NewReno, the fifth element is random sampling, and the sixth element (sampling probability) is 0.25. In this case, Aj can be calculated by equation (4), and Bj can be calculated by equation (9). Further, the following expression (10) is used as a condition for determining the convergence of the packet loss frequency X.

Y = Xi-X (i-1) <1 Formula (10)

  That is, when the difference between Xi newly calculated in step B4 (see FIG. 13) and X (i−1) calculated in the previous step B4 is less than 1, it is determined that Xi has converged, If the difference is 1 or more, the processes in steps B3 ′ to B5 are repeated.

  In this environment, the calculation process of estimating the packet loss of the target flow by the device 25 (see FIG. 1) in the middle of the network is shown. In the packet loss frequency estimation system, 11,677 packets are communicated as throughput, and the common number calculation means 65 can measure 625 as the common number C.

  When the observation probability calculation means 67a does not perform the estimation and the common number C itself is the packet loss frequency, the estimation accuracy can be achieved only about 0.5 (= 625/1154), and accurate. I can't know the value.

  When the observation probability calculation means 67a performs processing, the probability when N = 2 shown in FIG. 6 is used as Aj as the probability Aj counted as a common number when the phenomenon of the multiplicity j occurs. Further, the observation probability calculating means 67a obtains the probability Bj that the multiplicity j occurs by the calculation of Expression (9).

  When Q1 = 1, the E2E loss calculation unit 68 calculates X1 = 625/1 = 625 when the process first proceeds to step B4, and the observation probability calculation unit 67 converts this value into the packet loss rate p. . In this case, p = 625/112677 = 0.0055468 is obtained. The observation probability calculating means 67a calculates Q2 using the packet loss rate p as shown in the following equation (11).

  Next, when the process proceeds to step B4, the E2E loss calculating means 68 calculates X2 = 625 / 0.733 = 0852.954. At this time, Y = 227.954, and the calculation is continued. The observation probability calculation means 67 converts X2 into a packet loss rate p. In this case, p = 852.954 / 112677 = 0.0075698 is obtained. The observation probability calculating means 67a calculates Q3 as shown in the following formula (12) using the packet loss rate p.

  Next, when the process proceeds to step B4, the E2E loss calculating means 68 calculates X3 = 625 / 0.656 = 952.743. At this time, Y = 99.789, and the calculation is continued. The observation probability calculation means 67 converts X3 into a packet loss rate p. In this case, p = 952.743 / 112677 = 0.0084555 is obtained. The observation probability calculation means 67a calculates Q4 using the packet loss rate p as shown in the following formula (13).

  Next, when the process proceeds to step B4, the E2E loss calculation means 68 calculates X4 = 625 / 0.627 = 996.810. At this time, Y = 44.067, and the calculation is continued. The observation probability calculation means 67 converts X4 into a packet loss rate p. In this case, p = 996.810 / 112777 = 0.0088466 is obtained. The observation probability calculation means 67a calculates Q5 as shown in the following formula (14) using the packet loss rate p.

  Next, when the process proceeds to step B4, the E2E loss calculating unit 68 calculates X5 = 625 / 0.615 = 1016.260. At this time, Y = 19.45 and the calculation is continued. The observation probability calculation means 67 converts X5 into a packet loss rate p. In this case, p = 1016.260 / 112777 = 0.0090192 is obtained. The observation probability calculation means 67a calculates Q6 as shown in the following equation (15) using the packet loss rate p.

  Next, when the process proceeds to step B4, the E2E loss calculating means 68 calculates X6 = 625 / 0.610 = 1024.590. At this time, Y = 8.33 and the calculation is continued. The observation probability calculation means 67 converts X6 into a packet loss rate p. In this case, p = 1024.590 / 112677 = 0.0090931 is obtained. The observation probability calculation means 67a calculates Q7 using the packet loss rate p as shown in the following equation (16).

  Next, when the process proceeds to step B4, the E2E loss calculating means 68 calculates X7 = 625 / 0.608 = 10272760. At this time, Y = 3.37, and the calculation is continued. The observation probability calculation means 67 converts X7 into a packet loss rate p. In this case, p = 1027.960 / 112777 = 0.009123 is obtained. The observation probability calculation means 67a calculates Q8 using the packet loss rate p as shown in the following equation (17).

  Next, when the process proceeds to step B4, the E2E loss calculation means 68 calculates X8 = 625 / 0.607 = 1029.654. At this time, Y = 1.694, and the calculation is continued. The observation probability calculation means 67 converts X8 into a packet loss rate p. In this case, p = 1029.654 / 112677 = 0.009138 is obtained. The observation probability calculation means 67a calculates Q9 as shown in the following equation (18) using the packet loss rate p.

  Next, when the process proceeds to step B4, the E2E loss calculating means 68 calculates X9 = 625 / 0.607 = 1029.654. At this time, Y = 0, it is determined that the value of X has converged, and X9 is set as a definite value of X. The estimation accuracy of the packet loss frequency at this time is 1029/1154 = 0.9. Therefore, it is understood that the estimation accuracy (0.5) is improved when the observation probability calculation means 67a is not used.

  FIG. 15 shows the result of investigating the estimation accuracy obtained in this observation environment when a communication environment other than the above is set. The two-stage filter shown in FIG. 15 is a case where the common number C obtained by the common number calculating means 65 is assumed as the packet loss frequency as it is, and the two-stage filter + correction is the common number C obtained by the common number calculating means 65. This is a case where probability correction is performed by the observation probability calculation means 67a. It can be seen that the correct value can be estimated even if the communication environment changes.

  Next, the minimum configuration of the present invention will be described. FIG. 16 is a block diagram showing the minimum configuration of the present invention. The packet loss frequency estimation system of the present invention includes observation probability calculation means 95 and estimation means 96.

  The observation probability calculation means 95 (for example, the observation probability calculation means 67, 67a) is a packet information storage area for storing information corresponding to the value of the field including at least the acknowledgment number in the packet among the number of packet losses that have occurred ( For example, information is stored in the packet information storage area as an observation probability, which is a ratio of the number of packet losses reflected in a predetermined counting result (for example, the common number C) counted based on information stored in the memory Mi) (For example, the first element, the second element, the third element, the fourth element, etc.)

  The estimation unit 96 (for example, the E2E loss calculation unit 68) estimates the number of packet loss actually generated from a predetermined count result counted based on information stored in the packet information storage area and the observation probability.

  With such a configuration, the frequency of packet loss can be estimated at a low processing cost.

  In the above-described embodiment, the observation probability calculation means 95 counts the number of times of occurrence of duplication in the value of the field including at least the acknowledgment number in the packet among the number of generated packet losses (for example, the common number ) Discloses a configuration for calculating an observation probability which is a ratio of the number of packet losses reflected.

  Further, in the above embodiment, the observation probability calculation means 95 calculates the observation probability based on the probability distribution of the probability that the duplicate phenomenon of the field value including at least the acknowledgment number in the packet occurs when the packet loss occurs. The structure to perform is disclosed.

  In the above embodiment, the packet information storage means (for example, the packet information holding means 63) having a plurality of packet information storage areas for storing information corresponding to the value of the field including at least the acknowledgment number in the packet; A packet that, when receiving a packet, selects one or more of a plurality of packet information storage areas and stores in the selected packet information storage area information corresponding to a field value including at least an acknowledgment number in the received packet. Information registration means (for example, memory writing means 62) and counting means (for example, common number calculation means 65) for counting the number of pieces of information stored in common in a predetermined number or more of packet information storage areas are provided. The estimation means 96 uses the count result by the count means as the predetermined count result, and the actual count is obtained from the count result by the count means and the observation probability. Configured to estimate discloses a number of packet losses that have occurred.

  In the above embodiment, the observation probability calculation means 95 stores the number of packet information storage areas, the selection algorithm for the packet information registration means to select the packet information storage areas, and the number of packet information storage areas. A packet information storage area threshold value (for example, a memory number threshold value) that indicates whether the received information is to be counted by the counting means, and a duplicated value of a field value including at least an acknowledgment number in the packet occurs when a packet loss occurs A configuration for calculating the observation probability based on the probability distribution of the probability is disclosed.

  Further, the above embodiment includes sampling means (for example, packet sampling means 81) for extracting a part of the received packets, and the packet information registration means is extracted in the selected packet information storage area. A configuration for storing information corresponding to the value of a field including at least an acknowledgment number in a packet is disclosed.

  In the above embodiment, the observation probability calculation means 95 stores the number of packet information storage areas, the selection algorithm for the packet information registration means to select the packet information storage areas, and the number of packet information storage areas. A packet information storage area threshold value indicating whether or not the received information is to be counted by the counting means, and a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in the packet occurs when a packet loss occurs, A configuration is disclosed in which an observation probability is calculated based on a sampling algorithm in which a sampling unit extracts a packet and a probability that the packet is extracted in the sampling unit.

  Further, the above embodiment discloses a configuration in which the observation probability calculation unit 95 calculates the observation probability based on the number of packet information storage areas selected by the packet information registration unit.

  In the above-described embodiment, the packet includes a combination of at least some of the transmission address, reception address, transmission port number, reception port number, protocol ID, and port number of the packet loss frequency estimation system in the packet. A classifying means (eg, flow identifying means 61) for classifying packets into groups, and the packet information registering means stores information corresponding to the value of the field including at least the acknowledgment number in the packet in the selected packet information storage area The structure which performs this by a group unit is disclosed.

  The present invention is suitably applied to a packet loss frequency measurement system that measures the frequency of packet loss.

61 Flow identification means 62 Memory writing means 63 Packet information holding means 64 Memory reading means 65 Common number calculating means 66 Protocol characteristic holding means 67, 67a Observation probability calculating means 68 E2E loss calculating means 81 Packet sampling means

Claims (27)

Of the number of packet losses that occurred, it is reflected in a predetermined counting result that is counted based on the information stored in the packet information storage area that stores information according to the value of the field including at least the acknowledgment number in the packet. An observation probability calculating means for calculating an observation probability that is a ratio of the number of packet losses according to a mode of storing information in the packet information storage area;
Packet loss frequency, comprising: an estimation means for estimating the number of packet losses actually generated from the predetermined counting result counted based on information stored in a packet information storage area and the observation probability Estimation system. The observation probability calculation means
2. An observation probability that is a ratio of the number of packet losses reflected in a counting result of the number of times that duplication has occurred in a field value including at least an acknowledgment number in a packet among the number of generated packet losses is calculated. The packet loss frequency estimation system described. The observation probability calculation means
The packet loss frequency estimation system according to claim 1 or 2, wherein an observation probability is calculated based on a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in a packet occurs when a packet loss occurs. . Packet information storage means having a plurality of packet information storage areas for storing information according to the value of a field including at least an acknowledgment number in the packet;
A packet that, when receiving a packet, selects one or more of a plurality of packet information storage areas and stores in the selected packet information storage area information corresponding to a field value including at least an acknowledgment number in the received packet. Information registration means;
Counting means for counting the number of pieces of information stored in common in a predetermined number or more packet information storage areas,
The estimation means uses the count result of the count means as the predetermined count result, and estimates the number of packet losses actually generated from the count result of the count means and the observation probability. The packet loss frequency estimation system according to item 1. The observation probability calculation means
Packet information indicating the number of packet information storage areas, a selection algorithm for selecting packet information storage areas by the packet information registration means, and how many pieces of information stored in the packet information storage areas are counted by the counting means The packet loss according to claim 4, wherein the observation probability is calculated based on a storage area threshold and a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in the packet occurs when the packet loss occurs. Frequency estimation system. A sampling means for extracting a part of the received packets;
6. Packet loss frequency estimation according to claim 4, wherein the packet information registration means stores information corresponding to a field value including at least an acknowledgment number in the extracted packet in the selected packet information storage area. system. The observation probability calculation means
Packet information indicating the number of packet information storage areas, a selection algorithm for selecting packet information storage areas by the packet information registration means, and how many pieces of information stored in the packet information storage areas are counted by the counting means A storage area threshold, a probability distribution of the probability of occurrence of a duplication phenomenon of a field value including at least an acknowledgment number in the packet when a packet loss occurs, a sampling algorithm in which the sampling means extracts the packet, and the packet to the sampling means The packet loss frequency estimation system according to claim 6, wherein an observation probability is calculated based on the extracted probability. The observation probability calculation means
The packet loss frequency estimation system according to claim 5 or 7, wherein the observation probability is calculated based on the number of packet information storage areas selected by the packet information registration means. Classifying means for classifying packets into groups based on a combination of at least some of the transmission address, reception address, transmission port number, reception port number, protocol ID, and port number of the packet loss frequency estimation system in the packet. Prepared,
The packet information registration means performs processing for storing information corresponding to a field value including at least an acknowledgment number in the packet in the selected packet information storage area in units of groups. The packet loss frequency estimation system according to item 1. Of the number of packet losses that occurred, it is reflected in a predetermined counting result that is counted based on the information stored in the packet information storage area that stores information according to the value of the field including at least the acknowledgment number in the packet. The observation probability, which is the ratio of the number of packet losses, is calculated according to the mode of storing information in the packet information storage area,
A packet loss frequency estimation method, wherein the number of packet losses actually generated is estimated from the predetermined counting result counted based on information stored in a packet information storage area and the observation probability. 11. An observation probability that is a ratio of the number of packet losses reflected in a count result of the number of times that duplication has occurred in a field value including at least an acknowledgment number in a packet among the number of generated packet losses is calculated. The packet loss frequency estimation method described. The packet loss frequency estimation method according to claim 10 or 11, wherein an observation probability is calculated based on a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in a packet occurs when a packet loss occurs. . At the time of packet reception, select one or more of the plurality of packet information storage area, in the selected packet information storage area, to store information according to the value of the field including at least the acknowledgment number in the received packet,
Count the number of information stored in common in the packet information storage area more than a predetermined number,
The packet loss frequency estimation method according to any one of claims 10 to 12, wherein the number of actually generated packet losses is estimated from the counting result and the observation probability. Number of packet information storage areas, selection algorithm for selecting packet information storage areas, packet information storage area threshold indicating how many pieces of information stored in packet information storage areas are counted, and packet loss occurrence The packet loss frequency estimation method according to claim 13, wherein the observation probability is calculated based on a probability distribution of a probability that a duplication phenomenon of a field value including at least an acknowledgment number in a packet sometimes occurs. Extract some of the received packets,
The packet loss frequency estimation method according to claim 13 or 14, wherein information corresponding to a value of a field including at least an acknowledgment number in the extracted packet is stored in the selected packet information storage area. Number of packet information storage areas, selection algorithm for selecting packet information storage areas, packet information storage area threshold indicating how many pieces of information stored in packet information storage areas are counted, and packet loss occurrence Calculate the probability of observation based on the probability distribution of the probability of occurrence of duplicated field values, sometimes including at least the acknowledgment number in the packet, the sampling algorithm that extracts the packet, and the probability that the packet is extracted The packet loss frequency estimation method according to claim 15. The packet loss frequency estimation method according to claim 14 or 16, wherein an observation probability is calculated based on a selection number when a packet information storage area is selected. The packet is classified into a group from a combination of at least some items of a transmission address, a reception address, a transmission port number, a reception port number, a protocol ID, and a port number of a device that transmits and receives the packet in the packet,
The packet according to any one of claims 13 to 17, wherein processing for storing information corresponding to a field value including at least an acknowledgment number in the packet is performed in a selected packet information storage area in units of groups. Loss frequency estimation method. On the computer,
Of the number of packet losses that occurred, it is reflected in a predetermined counting result that is counted based on the information stored in the packet information storage area that stores information according to the value of the field including at least the acknowledgment number in the packet. An observation probability calculation process for calculating an observation probability that is a ratio of the number of packet losses according to a mode of storing information in the packet information storage area; and
A packet loss frequency estimation program for executing an estimation process for estimating the number of actually generated packet losses from the predetermined counting result counted based on information stored in a packet information storage area and the observation probability. On the computer,
In the observation probability calculation process,
The observation probability which is a ratio of the number of packet losses reflected in the counting result of the number of times that duplication has occurred in the field value including at least the acknowledgment number in the packet among the number of generated packet losses. The packet loss frequency estimation program described. On the computer,
In the observation probability calculation process,
The packet loss frequency estimation program according to claim 19 or 20, wherein an observation probability is calculated based on a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in a packet occurs when a packet loss occurs. . On the computer,
A packet that, when receiving a packet, selects one or more of a plurality of packet information storage areas and stores in the selected packet information storage area information corresponding to a field value including at least an acknowledgment number in the received packet. Information registration processing, and
Causing a counting process to count the number of pieces of information stored in common in a predetermined number or more of packet information storage areas;
The estimation process uses the count result of the count process as the predetermined count result, and estimates the number of packet losses actually generated from the count result of the count process and the observation probability. The packet loss frequency estimation program according to any one of claims. On the computer,
In the observation probability calculation process,
Packets indicating the number of packet information storage areas, a selection algorithm for selecting packet information storage areas in the packet information registration process, and how many pieces of information stored in the packet information storage areas are to be counted in the counting process The packet according to claim 22, wherein the observation probability is calculated based on an information storage area threshold and a probability distribution of a probability that a duplicate phenomenon of a field value including at least an acknowledgment number in the packet occurs when a packet loss occurs. Loss frequency estimation program. On the computer,
Perform sampling processing to extract some of the received packets,
The packet loss frequency estimation according to claim 22 or 23, wherein in the packet information registration process, information corresponding to a value of a field including at least an acknowledgment number in the extracted packet is stored in the selected packet information storage area. program. On the computer,
In the observation probability calculation process,
Packets indicating the number of packet information storage areas, a selection algorithm for selecting packet information storage areas in the packet information registration process, and how many pieces of information stored in the packet information storage areas are to be counted in the counting process Information storage area threshold, probability distribution of probability of occurrence of duplicate phenomenon of field value including at least acknowledgment number in packet when packet loss occurs, sampling algorithm to extract packet by sampling process, and packet sampling process The packet loss frequency estimation program according to claim 24, wherein an observation probability is calculated based on the probability extracted in step (a). On the computer,
In the observation probability calculation process,
The packet loss frequency estimation program according to claim 23 or 25, wherein an observation probability is calculated based on the number of packet information storage areas selected in the packet information registration process. On the computer,
A classification process for classifying packets into groups based on combinations of at least some of the transmission address, reception address, transmission port number, reception port number, protocol ID, and port number of the computer that sent and received the packet. Let it run
27. The process of storing information corresponding to the value of a field including at least an acknowledgment number in the packet in the selected packet information storage area in the packet information registration process is executed in units of groups. The packet loss frequency estimation program according to claim 1.

Images